Privacy & Terms

What this site is

Free 120 Simulator is an independent subscription study tool that recreates the look and pacing of computer-based medical licensing exams so students can get comfortable with the format before test day. It is not affiliated with, sponsored by, endorsed by, or in any way associated with the NBME®, FSMB, ECFMG®, the USMLE® program, or any other question bank, publisher or study provider. All trademarks and product names referred to anywhere on this site remain the property of their respective owners, and are used only to describe the format a section recreates — never to imply a partnership, licence, or approval of any kind.

Content provenance and redistribution

Original Free 120 material may be written or revised with AI assistance and should be identified as AI-assisted only when that description is accurate. Product names and third-party material do not become original or freely redistributable because they are described as AI-generated. A name, disclaimer, or educational purpose does not replace permission from the rights holder. Material is eligible for hosting or mirroring only when the project has documented ownership, a compatible licence, or written redistribution permission. Material whose rights cannot be verified should not be published or copied to permanent storage.

Privacy

What we store

• Account details — your email address, the display name you choose, and (if you set one) a salted hash of your password. Passwords are never stored or logged in plain text.
• Billing records — the plan and payment method you select, amount and currency, provider order or transaction references, payment status, subscription dates, and renewal/cancellation state. Card numbers, card security codes, private keys, seed phrases, and wallet credentials are not collected or stored by Free 120.
• Study progress — your answers, scores, timing, and exam history, so you can resume on any device. Administrators can access it for account support, recovery, and coaching.
• Support — ticket subjects, messages, ratings, and image attachments you choose to send. Images are re-encoded before upload to remove embedded metadata. A limited section/app-version context may accompany a ticket; full browser user-agent and viewport data are not needed for support.
• Security and device signals — a random browser-profile identifier, a coarse browser/platform label, recent sign-in/device activity, and signals for concurrent use, screenshot attempts, client tampering, or suspected scraping. The application truncates IPv4 addresses to /24 and IPv6 addresses to /48 before storing security signals; routine audit entries do not store IP addresses.
• On your device — the same progress is saved locally (localStorage / IndexedDB) so a temporary connection loss does not erase your work. Draft support messages and a user-supplied Anthropic API key may also stay in localStorage. The progress sync allowlist excludes the Anthropic key. You can clear site data in your browser or export/delete progress from the start page.

Cookies and logs

• An essential Secure, HttpOnly, SameSite=Strict session cookie keeps password accounts signed in for up to 14 days. Cloudflare Access may set its own essential authentication cookies.
• Application logs must not contain passwords, API keys, session/reset tokens, support attachments, or full request bodies. Infrastructure providers may still create security and delivery logs under their policies.

Service providers and external requests

• Cloudflare provides Pages, Functions, Access, D1 storage, DNS/security, and network delivery.
• areeba provides the provider-hosted card checkout and, when enabled for the merchant account, recurring card payments. Card details are entered on areeba's payment surface, not this website.
• OxaPay provides provider-hosted cryptocurrency invoices. Crypto payments are one-time payments and do not renew automatically.
• Resend is used only when transactional email is configured. Support notifications are generic and do not copy ticket text or attachments into email.
• Anthropic receives question content and images only when you invoke an AI feature with a key supplied in your browser. The request goes directly from your browser to Anthropic.
• Google Drive/Google APIs and Brightcove may receive normal connection data such as your IP address and browser headers when you play externally hosted media.

No personal data is sold and no advertising profile is created. Providers process only the data needed to deliver their service, subject to their own terms and privacy notices.

Encryption and key separation

Sensitive progress snapshots, recovery copies, support text, and support attachments are protected with versioned AES-256-GCM application-layer encryption when the encryption secret is configured. Encryption keys are stored as deployment secrets separately from D1 and separately from encrypted off-provider backups. Application-layer encryption protects database copies; it is not end-to-end encryption, because the running service and authorized administrators can decrypt data to provide the features above.

Retention

• Active account details and study progress: while the account exists.
• First-party sessions: no more than 14 days; reset links: 30 minutes or until first use.
• Device records and screenshot/tamper/scrape/sharing signals: 30 days.
• Deleted-attempt recovery copies and administrative progress snapshots: 30 days.
• Support attachments: 30 days; closed support conversations: 90 days.
• Administrative audit entries: 90 days.
• Payment and subscription records: for the period reasonably needed for account support, reconciliation, fraud prevention, tax/accounting duties, dispute handling, and other legal obligations.
• Encrypted disaster-recovery backups, once enabled: versioned copies under the documented backup schedule, with deleted records aging out when the last containing backup expires.

Deletion behavior

A full account erasure removes the account, live progress, recovery records, support messages and attachments, device/security records, subscription records, and matching application audit entries. Browser-local copies must be cleared on each device separately. Data may remain temporarily in encrypted disaster-recovery backups until those backups expire, and external email/infrastructure providers may retain their own delivery or security logs. Use the in-app support channel to request erasure.

Terms of use

Plans, renewals, and access

• The currently offered plans are US$15 for one month and US$60 for six months. The exact plan, amount, billing interval, and renewal behavior are shown again before you leave for provider-hosted checkout.
• Card plans renew automatically at the selected interval only when the checkout explicitly says so after the areeba contract confirms a provider-managed renewal and cancellation process. Crypto invoices are one-time payments and must be renewed manually.
• Access begins only after the server independently confirms a successful payment with the provider. A browser redirect, screenshot, transaction hash supplied by a user, or “payment sent” state is not proof of payment.
• You can stop a future card renewal yourself at any time from Manage subscription in your account menu, or by asking support. Cancellation stops the next charge; access continues through the already-paid period unless a refund, reversal, fraud decision, or applicable law requires a different result.
• Paying again while a plan is still running extends it from its current end date rather than restarting from the day of payment, so renewing early never discards remaining days.
• Your own record of every payment, plan change, and renewal decision — with dates, amounts, and the order reference to quote to support — is listed under Manage subscription.
• When a subscription lapses, study content is locked but nothing you created is deleted. Answers, scores, notes, and review history are retained under the retention rules above and are available again as soon as a plan is active.
• Refunds, reversals, disputes, and chargebacks are handled under applicable law and the payment provider or card-network rules. If a confirmed payment is reversed, related access may be suspended or shortened.

• This tool is provided as-is for personal study. There is no guarantee of availability, accuracy, or fitness for any purpose — including your exam score.
• Practice scores here are for self-assessment only and do not predict performance on any real licensing examination.
• Don't attempt to disrupt the service, access other students' data, or use the site for anything other than personal exam preparation.
• Accounts that abuse the service may be removed.

Questions, account help, and deletion requests: use the in-app support channel, or email [email protected]. Billing and payment queries: [email protected]. Security and vulnerability reports: [email protected].