1. Who we are
ilymi is a practice platform built exclusively for ICAN candidates. ilymi is operated by Koma Michi, and this policy applies to the ilymi website at ilymi.com and any services offered through it. By creating an account or using the platform, you agree to the practices described here.
2. Information we collect
We collect only what we need to run the service properly, and we collect as little as possible:
- Account information. Your name (username), email address and password (stored in an encrypted hash) when you register.
- Profile information. Your chosen ICAN level, any subjects you are exempt from, and your study cohort.
- Practice activity. Quiz attempts, answers, flashcards, streaks and scores. This is what powers your dashboard and your progress tracking — without it the product does not work.
- Technical information. Your IP address, browser type and device information, collected in server logs for security and reliability.
We do not collect payment card details. Payment processing, when introduced, will be handled by a licensed payment provider on their own infrastructure.
3. How we use your information
- To create and manage your account.
- To deliver the practice experience: quizzes, flashcards, diagnostics and progress tracking.
- To send service emails — including your welcome email and password reset emails. We do not sell or send marketing emails without your separate consent.
- To keep the platform secure — detecting and preventing abuse, fraud and unauthorised access.
- To improve the product — using aggregate, de-identified data about how the platform is used.
4. Legal basis
We process your data on the following grounds under the Nigeria Data Protection Regulation (NDPR) and applicable data protection law:
- Performance of a contract — processing needed to provide the account and study services you sign up for.
- Legitimate interests — keeping the platform secure, preventing abuse, and improving the service, balanced against your privacy rights.
- Consent — where we rely on consent, you can withdraw it at any time by contacting us.
5. Cookies and analytics
ilymi uses essential cookies to keep you logged in and to protect against abuse (including rate limiting). We do not use advertising trackers. If we introduce analytics cookies, we will ask for your consent before they run and will update this policy.
6. Where your data is stored
Your account and study data are stored in a managed Postgres database hosted by Supabase on cloud servers in the European Union. Email messages are delivered through Resend. We and our processors apply technical and organisational measures — including encryption in transit (HTTPS) and restricted access — to protect your data. We never sell your personal data.
7. How long we keep your data
We keep your account and study data for as long as your account is active, so your progress is available to you across devices. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we are legally required to retain certain records (for example, for fraud prevention).
8. Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you.
- Correct — update inaccurate or incomplete information (you can edit much of it yourself in your profile).
- Delete — request deletion of your account and data.
- Object — object to processing based on legitimate interests.
- Withdraw consent — where processing relies on your consent.
To exercise any of these rights, use our contact page. We will respond within 30 days. You also have the right to lodge a complaint with the Nigeria Data Protection Commission if you believe your data has been handled improperly.
9. Children
ilymi is intended for users aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Security
We take reasonable steps to protect your information: HTTPS across the site, encrypted password storage, rate limiting on sensitive actions, and restricted server access. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and notify registered users by email where the change is significant. Continued use of the platform after changes means you accept the updated policy.
12. Contact
Questions about this policy or your data? Use our contact page.