Your account. Your information.
Privacy Policy
Last updated 26 October 2026
This notice explains how Fault Found at playfaultfound.com uses personal information when you visit, sign in, play or contact the operator.
At a glance: your email signs you in, and your account holds your saved gameplay. The operator sees aggregate statistics and can inspect one account’s progress when needed for support, a specific bug or security investigation. Other players cannot browse your records.
Independent accounts are for players aged 16 or over. Contact privacy@playfaultfound.com for questions or access, correction and deletion requests. An account does not subscribe you to marketing.
1. Operator and contact
The controller is Gustav Urbas, Estonia. The controller decides why and how the personal information described here is used.
Privacy contact: privacy@playfaultfound.com. You can use this address without signing in. For game or account support, email support@playfaultfound.com.
2. Who can use an account
Independent Fault Found accounts are available from age 16. Players aged 16–17 must obtain parent or guardian authorisation where applicable law requires it.
Younger viewers can watch an adult aged 18 or over demonstrate the game from the adult’s own account. The adult must control the session. Do not create child profiles or enter a younger viewer’s name, email or other personal details in the account or feedback.
Before email sign-in or opening a saved sign-in session, the website checks for a remembered 16+ declaration. If none is available, it asks for an age-range declaration. It remembers only a successful 16+ declaration on this browser until you sign out or clear site data, when storage is available, and does not send the selected age group to the game server. It does not ask for a date of birth or identity document and is not verified proof of age. Concerns about an existing younger person’s account can be sent to the contact above.
3. Information used
- Account information: your email address, account identifier, registration, email verification and sign-in information, and authentication/session records.
- Workshop progress: your chosen display name, settings, cases opened, saved case states, measurements and evidence, repair attempts, achievements and scores. The display name can be a nickname. Workshop time and costs are simulated game values.
- Feedback and correspondence: messages you send, the category, account and case where relevant, game version, submission time, and information needed to handle your request.
- Technical information: hosting, authentication and email providers process information such as IP addresses, browser/request details, security and service logs, and email-delivery records to deliver and protect the service.
Please avoid including unnecessary personal information about yourself or other people in display names, feedback or correspondence. The game does not request access to your contacts, microphone, camera or precise device location.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide sign-in, saved gameplay and the account features you request | Performance of the account service requested by you, limited to the information necessary to provide it (GDPR Article 6(1)(b)). |
| Deliver and protect the website, answer support, investigate specific bugs and protect accounts | Legitimate interests in providing a reliable, secure service and resolving requests and faults (Article 6(1)(f)). Account progress is inspected only where needed for the particular support, bug or security issue. |
| Understand registrations and use of the game | Legitimate interests in understanding uptake and improving the game (Article 6(1)(f)). The routine dashboard uses aggregate counts and registration-day totals derived from existing account and save records. |
| Handle statutory rights requests and other specific legal obligations | Compliance with the applicable legal obligation (Article 6(1)(c)). |
You may object to processing based on legitimate interests. Requests are assessed under the applicable rules. The game does not sell player data, use it for advertising, or send marketing emails. Any new optional purpose requiring consent will need its own choice before it begins.
5. Access to records
Account progress and feedback are private to the player and operator, with service providers processing information as needed for their services. The operator’s routine statistics overview does not download player emails or individual progress to the dashboard. Individual progress is available through a separate exact-account lookup for support, a specific bug or security investigation.
There are no public player profiles or teacher dashboards. Schools do not automatically receive students’ records. Game scores are not a professional qualification or a formal assessment of vocational competence. Account information is not used for automated decisions with legal or similarly significant effects.
Information may also be disclosed where a specific legal requirement applies or where necessary to address a security incident or legal claim, subject to applicable safeguards.
6. Service providers and international processing
| Provider | Role |
|---|---|
| Cloudflare | Website delivery, network/security services and forwarding mail sent to the public support and privacy addresses. |
| Supabase | Authentication, cloud progress, saved feedback and server-side services. The project’s database is in EU North (eu-north-1). |
| Resend | Login-code and developer-notification delivery and the support/privacy inbox, including delivery records. Open and click tracking are disabled. Resend states that stored service data is in the United States, including when a European sending region is selected. |
| Google Gmail (earlier correspondence) | Contact correspondence and developer notifications received before the support-inbox transition may remain until handled under the retention process. New correspondence is directed to the Resend support inbox after that transition. |
An EU database location does not mean that every provider or subprocessor processes all information inside the EEA. Supabase, Cloudflare and Resend publish data-processing terms and international-transfer safeguards, including Standard Contractual Clauses where applicable. Ask the operator for information about relevant safeguards or a copy, with appropriate protection for other people’s information and security details.
Fonts are hosted on this website. The game does not load Google Fonts or embedded social-media widgets. Sharing links open an external service only when you choose them.
7. Browser storage and cookies
The game uses browser storage for sign-in and the features you request. It is not used to build an advertising profile or track you across other websites.
| Information | Purpose and duration |
|---|---|
| Authentication/session information | Keeps you signed in and supports account access. Stored locally until removed by sign-out, the service or clearing site data. |
| Game progress, settings and conflict backups | Supports saving, reconnection, your settings and safe conflict handling. Local copies can remain until removed by the game or you clear site data. |
| Successful age declaration | Remembers only a 16+ declaration in local browser storage until sign-out or clearing site data, when available. The selected age range is not retained on the server. |
| Read/dismissed notices and installation prompts | Remembers the display choices you make on this device. These preferences can remain until you clear site data. |
The application does not set advertising or analytics cookies. The release’s browser security policy blocks external analytics scripts, including Cloudflare’s automatically inserted Web Analytics beacon. Cloudflare may still use necessary network/security technologies to deliver and protect the website. Server-side operational statistics and logs are separate from browser tracking.
Signing out can leave cached game data on a device. Clearing site data can sign you out and remove settings or unsynchronised progress; it does not delete your cloud account. Use sign-out on shared devices and clear this site’s stored data when appropriate. Blocking required storage may prevent sign-in or saving.
8. Retention and deletion
Account and progress records are kept to provide your ongoing account and saved workshop history. Accounts are reviewed after 24 months without recorded activity. Records no longer needed are removed or anonymised after that review; the game does not automatically delete every account at that point.
Resolved feedback and support correspondence are normally removed no later than 12 months after their recorded resolution. Provider email retention may remove copies sooner. A limited record may be kept longer where a specific legal obligation, unresolved issue, security investigation or legal claim justifies it. Such exceptions are reviewed rather than treated as indefinite retention.
Provider technical logs, delivery records and backup copies follow the applicable service-specific retention arrangements. Deleting a live record does not immediately erase every retained backup copy. Completed deletion requests must be respected if information is restored from a backup. Browser copies on your devices are handled separately, as described above.
You do not have to wait for the inactivity review to request deletion. An age declaration does not automatically delete earlier accounts or progress.
9. Your rights
Subject to the applicable conditions, you can request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. If a future activity relies on consent, you can withdraw that consent for the future. You also have the right to lodge a complaint with a data protection supervisory authority.
Email privacy@playfaultfound.com. The operator may need proportionate verification before disclosing or deleting information. Do not send login codes or passwords. GDPR requests are normally answered within one calendar month; any permitted extension and its reason will be explained within that period.
10. Choices and updates
An email address is needed for an account and cloud saving. Feedback is optional, and a display name need not be your real name. The public information pages and privacy contact are available without an account.
This notice shows its update date. Material changes to how information is used will be explained before new processing begins where required. For questions, contact privacy@playfaultfound.com.