Privacy policy
Last updated: 2026-11
This English translation is provided for convenience and has not yet been legally reviewed. The German version is the original.
1. Controller
Fabio Matt, Heragass 22, 9492 Eschen, Liechtenstein – email: info@faultory.app
The General Data Protection Regulation (GDPR), which applies in Liechtenstein through the EEA Agreement, and the Liechtenstein Data Protection Act (DSG) apply. No data protection officer has been appointed.
2. What data we process
| Data | Purpose | Legal basis |
|---|---|---|
| First name, last name, username, email address | User account, sign-in, communication about the account | Art. 6(1)(b) GDPR (contract of use) |
| Password (stored only as a scrypt hash) | Authentication | Art. 6(1)(b) GDPR |
| Email verification codes (hashed), password reset tokens | Verification of the email address, account recovery | Art. 6(1)(b) and (f) GDPR (protection against misuse) |
| Session data: session ID, IP address, browser identifier (user agent), expiry time | Staying signed in, detecting abusive sign-ins | Art. 6(1)(b) and (f) GDPR |
| Learning activity: commands entered in simulations, answers, results, points, time taken, achievements | Providing the learning features, grading, learning progress | Art. 6(1)(b) GDPR |
| Organisation and course membership, assignments, reviews and feedback from teachers | Organisation of teaching by the school or organisation | Art. 6(1)(b) GDPR; on behalf of the organisation, where applicable, Art. 28 GDPR |
| Lab suggestions: category, topic, description, desired difficulty, optional reasoning, status and reply, linked to your account | Planning new learning content; showing you the processing status. Visible only to you and super administrators. | Art. 6(1)(f) GDPR (developing the service at your request) |
| Contact form: name, email address, topic, message; for abuse prevention, briefly a hash of the IP address | Answering your request. The message is not stored in Faultory but forwarded by email (Resend) to the operator’s mailbox info@faultory.app (Infomaniak, Switzerland). | Art. 6(1)(b) or (f) GDPR |
Language setting (German or English) in the user profile and in the cookie NEXT_LOCALE | Showing the interface and sending emails in the chosen language | Art. 6(1)(b) GDPR |
Optional at sign-up: how you heard about Faultory (e.g. TikTok, Reddit, school) and, if present, the campaign code from the link you came through (e.g. ?ref=reddit). No cookies or tracking are used for this. | Aggregated analysis of which channels lead to new accounts. Visible to super administrators only. | Art. 6(1)(f) GDPR (measuring reach); providing it is optional |
Demo lab at /try: commands entered and the result | Trying Faultory without an account. The demo lab runs entirely in your browser; commands and results are not sent to or stored by Faultory. | – |
| Acceptance of the terms of use (time, version) | Proof | Art. 6(1)(c) and (f) GDPR |
| Audit log of administrative actions (e.g. role changes, suspensions, exports) | Security and traceability | Art. 6(1)(f) GDPR |
| Technical server logs (IP address, time, requested URL, status code) | Operation, error analysis, defence against attacks | Art. 6(1)(f) GDPR |
We do not use advertising, analytics or tracking services, and no social media plugins.
3. Cookies and local storage
Faultory only sets technically necessary cookies (session cookie for signing in, cookie for the chosen language) and stores the chosen colour scheme in the browser’s local storage. No consent is required for this. Details: cookie information.
4. Recipients and processors
We use the following service providers as processors. Data processing agreements under Art. 28 GDPR are or are to be concluded with them:
| Service provider | Purpose | Registered office / region | Transfer to third countries |
|---|---|---|---|
| Vercel Inc. | Hosting of the web application, delivery, server logs | USA (functions in the Frankfurt region) | EU-US Data Privacy Framework (certification according to Vercel); processing under the Vercel DPA |
| Neon, LLC (subsidiary of Databricks, Inc.) | Operation of the PostgreSQL database (accounts, learning results) | USA (database region: EU, Frankfurt) | EU-US Data Privacy Framework (certification according to the Databricks privacy notice) |
| GitHub, Inc. (Microsoft) | Source code management and execution of the automatic database backup; backups are encrypted before storage and cannot be read by GitHub | USA | EU-US Data Privacy Framework or standard contractual clauses (according to GitHub’s privacy statements); backups are additionally end-to-end encrypted |
| Plus Five Five, Inc. (Resend) | Sending transactional emails (verification codes, password reset, invitations) | USA | Standard contractual clauses of the European Commission (Art. 46 GDPR) in the Resend DPA |
| Infomaniak Network SA | Mailbox info@faultory.app (receiving contact requests and emails to the operator) | Switzerland | Adequacy decision of the European Commission for Switzerland (Art. 45 GDPR) |
Teachers and administrators of your organisation see the results of the courses and assignments they are authorised for. Data of different organisations is kept separate.
5. Transfers to third countries
The service providers listed are based in the USA. The database is operated in an EU region; nevertheless, access from the USA cannot be ruled out. Transfers are based on the adequacy decision for the EU-US Data Privacy Framework where the respective provider is certified, otherwise on standard contractual clauses of the European Commission (Art. 46 GDPR). The basis for each provider is listed in the table in section 4.
6. Storage period
- Account and learning data: until the account is deleted.
- Unverified accounts: deleted automatically after 7 days.
- Expired sessions, verification codes and reset tokens: deleted automatically after expiry (daily clean-up).
- Audit log: 12 months.
- Contact requests: in the operator’s mailbox for as long as needed to handle them; IP hashes for abuse prevention for at most 24 hours.
- Database backups: encrypted, for at most 30 days.
- Lab suggestions: until they have been dealt with; if you delete your account, the link to your account is removed and the suggestion text is kept without personal reference for content planning. Please do not include personal data in suggestions.
- Server logs at the hosting provider: according to its retention periods (briefly for Vercel in the chosen plan).
7. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can trigger a full data export and the deletion of your account yourself under Profile & privacy (instructions). For all other requests, an email to info@faultory.app is sufficient.
You also have the right to lodge a complaint with the supervisory authority: Datenschutzstelle Liechtenstein (www.datenschutzstelle.li).
8. Use in teaching
If Faultory is used by a school or organisation, that school or organisation may be the controller for the teaching data (courses, assignments, reviews); Faultory then acts as a processor. Before use with student data, a data protection assessment by the school and an agreement are required.
9. Security
Connections are TLS-encrypted, passwords are stored only as hashes, access is restricted by role and tenant, and administrative actions are logged.