Privacy Policy

1. Who we are

Finicade operates this website and the games hosted on it. For any privacy question, or to exercise the rights described below, contact us at [email protected]. For the purposes of the EU and UK General Data Protection Regulation (GDPR), Finicade is the “controller” of the personal data described here.

2. Information we collect

• Account details. When you create an account we store your email address, a display name, and a securely hashed version of your password (we never store or see the plaintext). If you sign in with Google or Apple, we receive a unique identifier and the email/name they share instead of a password.
• Your preferences. Theme, popup-alert and newsletter settings you choose, so they follow your account across devices.
• Learning activity. Your progress through levels — attempts, XP, badges and trophies — tied to your account (or, before you sign up, to a temporary guest identifier that we migrate onto your account when you register).
• Community posts. Questions and answers you post on lesson cards and quiz questions, together with your display name and the time posted. These are public to other signed-in users.
• Newsletter. If you subscribe (or create an account, which opts you in by default), your email address is added to our mailing list. You can opt out at any time — see your settings or the unsubscribe link in any email.
• Technical & usage data. A first-party visitor measure that helps us understand sign-ups and drop-off, and — where enabled — a privacy-friendly, cookieless analytics beacon (Cloudflare Web Analytics) that reports aggregate page views without profiling you.

3. Cookies & local storage

We use a single, essential session cookie to keep you signed in and to protect forms against cross-site request forgery. We store your theme choice in your browser’s local storage so pages paint correctly before you sign in. We do not use advertising or cross-site tracking cookies. Because the session cookie is strictly necessary to provide the service, it does not require consent under GDPR/ePrivacy.

4. How we use your data

• To create and secure your account and sign you in.
• To save and display your learning progress, badges and trophies.
• To power community Q&A and notify you when someone answers you.
• To send you the newsletter and essential service emails (email verification, password resets).
• To keep the service safe — rate-limiting, abuse prevention and debugging.
• To understand, in aggregate, how the site is used so we can improve it.

5. Legal bases for processing (GDPR)

• Contract. Creating your account, saving progress and providing the games and community features you asked for.
• Consent. Sending marketing emails (the newsletter). You may withdraw consent at any time without affecting your account.
• Legitimate interests. Keeping the service secure, preventing abuse, and understanding aggregate usage to improve Finicade — balanced against your rights and never used for intrusive profiling.
• Legal obligation. Where we must retain or disclose data to comply with the law.

6. Who we share it with

We do not sell your personal data. We share it only with the service providers (“processors”) that make Finicade work, and only as needed:

• Brevo — delivers our newsletter and stores newsletter contacts.
• Google and Apple — only if you choose “Sign in with Google/Apple”, to authenticate you.
• Our email provider — sends transactional emails such as verification and password-reset links.
• Cloudflare — provides content delivery, security and the optional cookieless analytics beacon described above.

We may also disclose data where required by law, or to protect our rights, users, or the safety of others.

7. International transfers

Some of our processors may store or process data outside your country, including outside the EU/UK. Where they do, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses or an adequacy decision) to protect your data.

8. How long we keep it

We keep account, progress and community data for as long as your account is active. If you delete your account, we delete or anonymise the associated personal data, except where we must keep something to comply with a legal obligation or to resolve disputes. Newsletter contacts are kept until you unsubscribe.

9. Your rights

Depending on where you live, you have the right to access, correct, delete, export (portability), restrict or object to the processing of your personal data, and to withdraw consent for marketing at any time. To exercise any of these, email [email protected] and we’ll respond within the time the law requires. You also have the right to lodge a complaint with your local data-protection authority.

10. Marketing emails

Every newsletter includes a one-click unsubscribe link, and signed-in users can turn the newsletter on or off in settings at any time. Unsubscribing from marketing does not stop essential service emails (for example, a password reset you request).

11. Security

Passwords are stored only as salted hashes, the site is served over HTTPS, session cookies are HTTP-only, and we apply a content-security policy and rate limits to reduce abuse. No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong. Security researchers can reach us via our security.txt.

12. Children

Finicade is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the service evolves. When we make material changes we’ll update the “Effective” date above and, where appropriate, notify you. Continued use of Finicade after a change means you accept the updated policy.

14. Contact

Questions about this policy or your data? Email [email protected].