Privacy policy

Last updated 11 October 2026 · Terms of use

The short version. Your application material is kept in your own private workspace and is shown only to you, and to anyone you choose to share a letter or link with. There is no advertising, no analytics, no tracking cookie and no sale of data. You can download everything or delete everything from Settings, at any time, without asking anyone. The service providers that help run it — hosting, the database and email — are listed in section 5, along with the few lookups that happen only when you ask for them.

1. Who is responsible

MatchRight is operated by an individual (the "operator"), reachable at amrk.almasri@gmail.com. The operator is the person accountable for the information the Service holds, under the Personal Information Protection and Electronic Documents Act (PIPEDA) and any provincial law that applies to you.

MatchRight is not affiliated with CaRMS, the AFMC, or any program. Nothing you enter here is sent to any of them. Your CaRMS application is a separate thing that lives in CaRMS Online; this Service never connects to it.

2. What is collected

Account

Your email address and a hash of your password (the password itself is never stored).
Your name, medical school, campus and graduation year, and the disciplines you chose.
When the account was created, when you last used it, and the version of the terms you accepted and when.

Application material — what you type in

Which programs you are applying to, your notes on them, your rank criteria.
Referees: names, roles, institutions, contact details you record, your notes on interactions with them, and the status of each reference.
Personal letters, stories, experiences, elective and interview notes, documents you have marked as assigned, costs you have logged, and generated email drafts.
A photo, if you add one, resized and stored as part of your file.
A PDF of your CV for each discipline, if you upload one, stored beside your file and shown only to you.
Evaluation PDFs you upload for a referee, and the quotes you pick from them.
A signature image, if you add one for your letters.
Your CaRMS ID, phone number and email sign-off, if you enter them.
If you connect your own calendar: its secret address, and the events the server reads from it so they can be drawn on your Dashboard. The events are held only briefly in memory and are not saved to your file.
Comments, suggested edits and notes written on a letter shared for review — by you, or by the person reviewing it.
Feedback you send about the app, with your name and email so the operator can reply.

Trying the CV reader on the home page

If you try the CV reader on the home page without an account, a PDF is turned into text in your browser, and that text (or a Word file) is sent to the server, read, and the result sent straight back to you. Nothing from it is saved or logged. To stop the reader being overused, the server counts how many times it has been tried from your network address in the last hour, stored under a scrambled form of the address; the count is not linked to anything else and expires after an hour.

Automatically

One session cookie (matchright_session) so you stay signed in. It carries a random token and nothing else, is not readable by scripts, and expires after 30 days or when you sign out.
Ordinary server logs — request paths and errors — kept briefly for operating the Service. They do not contain the content of what you write.

Nothing is collected from your device beyond what you type, no analytics or advertising scripts run, and no fingerprinting is done.

3. Why it is collected

Only to run the Service for you: to show you your own workspace, generate emails and reference sheets from your own details, keep you signed in, back up your file, and let an administrator see that the Service is in use. There is no secondary use. Your material is never used for advertising, never sold, never used to train models, and never shared with programs, schools or CaRMS.

4. Who can see it

You. Your working file is yours alone; no other account can read it.
Administrators of this instance can see account-level facts — email, join date, last seen, chosen disciplines, and aggregate counts. The administration portal deliberately shows nothing from inside anyone's application.
The operator, as the person running the server, has technical access to the files on it. That access is used only to operate, back up, and restore the Service, or to answer a request you make. It is not used to read your material.
People you share a letter with. When you share a personal letter for review, the person whose email address you enter is sent a private link. Through it (or through their own account at that address) they can read that letter as it currently stands, with the program's prompt and word limits, and can leave comments and suggested edits. The invitation shows them your name, your account email and any note you add. Nothing else in your application is visible to them. Anyone they forward the link to could open it too, so share only with people you trust. You can stop sharing at any time; their comments stay with your letter.
Anyone holding a link you created. A calendar link shows the titles and dates on your calendar; a referee-sheet link shows that one sheet as printed. Both work without an account, for as long as you leave them on, so give them only to the calendar or the referee they are for. You can turn either off, or replace it, in the app.
Nobody else, unless the law requires it, in which case you will be told where lawful.

5. Service providers and third parties

These providers store or carry data so the Service can run. They act on the operator's instructions and may not use your data for their own purposes. Some of them process data outside Canada, including in the United States, where it can be subject to the laws of that country, including lawful access by its authorities.

Vercel hosts the Service and handles every request to it, under Vercel's privacy policy.
MongoDB Atlas is the database where accounts, workspaces, uploaded files and backups are stored, encrypted at rest, under MongoDB's privacy policy.
Google Fonts (fonts.googleapis.com, fonts.gstatic.com) serves the typefaces. Your browser requests them directly, which discloses your IP address to Google under Google's privacy policy. Nothing about you or your application is sent.
Public professional directories — provincial college registers and university faculty pages — are queried only when you click "Research" on a referee. The query contains that referee's name and, where needed, discipline, and goes from the server, not your browser. Results are cached on the server for up to seven days so a repeat lookup costs nothing, and are shown to you rather than saved into the referee's record until you accept them.
CaRMS and CANPREPP public pages are read by the server on a schedule to refresh the program catalogue. Those requests carry nothing about any user.
Resend, the email provider, delivers the verification code, review invitations and, unless you turn it off in Settings, a weekly summary, under Resend's privacy policy. Those messages contain your name, the program a letter is for, your upcoming dates and referee names, and any note you add to an invitation — not the text of your letters or your referees' feedback.
PubMed (the US National Library of Medicine) and, where this instance has one configured, a web search provider receive a referee's name and discipline when you click "Research" on that referee — never anything about you.
Your calendar provider (Google, Outlook or iCloud), only if you connect your calendar: the server fetches the secret address you gave it every few minutes while you are using the app.
jsDelivr, a public code CDN, serves the text-recognition library your browser downloads only when you read a scanned PDF. Your browser contacts it directly, which discloses your IP address; the PDF itself never leaves your device.
The AI service you choose, only when you use "AI feedback". When you open ChatGPT, Claude or Gemini from it, nothing is sent by the Service: your writing and what it is for are copied to your clipboard and, for ChatGPT and Claude, also placed in the address of the page that opens, so they reach that service when it loads and may be kept in your browser history. With an API key, your browser sends the writing directly to the provider you pick (Anthropic, OpenAI or Google) with your own key; it does not pass through this Service, and the key is not stored here. Either way, that provider's own terms and privacy policy apply. If you press "Save feedback", the AI's reply and which of its edits you took are stored with the rest of your data, and you can delete them at any time.

No payment processor, analytics provider or advertising network is involved.

6. Where it is stored and how it is protected

Data is stored in the database described in section 5, reachable only by the server, with the connection encrypted and the data encrypted at rest. The Service is served only over HTTPS. Passwords are hashed with scrypt. Session tokens are 256-bit random values. State-changing requests are checked against the page that made them. When the Service is served over HTTPS, the cookie is marked Secure. A copy of each user's file is taken once a day as a backup.

So that your dates are readable without a connection, your browser keeps a copy of the app and of the data it last loaded. That copy stays on your device, is read only when the server cannot be reached, and is deleted when you sign out.

No system is perfectly secure. If a breach creating a real risk of significant harm occurs, affected users and the Office of the Privacy Commissioner of Canada will be notified as PIPEDA requires.

7. How long it is kept

Until you delete it. Backups of your file are deleted together with the account. An account left untouched for more than eighteen months after the end of a match cycle may be deleted by the operator after notice to the email on the account. Directory-lookup caches expire within seven days. Server logs are rotated within a few weeks.

8. Your rights and how to use them

Access and portability. Settings → Download my data gives you everything held about you as one JSON file, immediately. Uploaded CVs and evaluation PDFs are your own documents and are not repeated in it; open them from the app.
Correction. Every field is editable in the app.
Erasure. Settings → Delete my account removes the account record, your working file, uploaded CVs and evaluations, every backup, every session, every link you made, and every letter you shared along with its comments. Feedback you sent is kept without your name or email. Comments you left on someone else's letter stay with their letter. It asks for your password and cannot be undone.
Withdrawal of consent. Deleting your account withdraws it.
Complaints. Write to the operator first at amrk.almasri@gmail.com. You may also complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

9. Information about other people

Referee and contact details you record are personal information about someone else. Record only what you need to manage your application, and treat this Service as a private notebook rather than a directory. The research feature only looks things up in registers those people have chosen to be listed in, and only when you ask it to.

10. Children

The Service is for adults applying to residency. It is not directed at anyone under 18 and knowingly holds no information about them.

11. Changes

If this policy changes materially you will be asked to accept the new version the next time you sign in, and the date at the top will move.

Back to MatchRight · Terms of use