fata logo

Privacy Policy

Your privacy and trust are important to fata.dev, and so is being clear about how we collect, use and disclose information about you.

This Privacy Policy describes how fata.dev ("we," "us," or "our") collects, uses, and shares information when you use our mobile application and related services (collectively, the "Service"). This policy covers all data collection practices implemented in our app and complies with Google Play Store requirements.

For any questions about our Privacy Policy, you can contact us at: [email protected].

Last Updated: October 31, 2026

1. Data Controller

The controller of your personal data is fata.dev, incorporated as 14734696 CANADA INC, with headquarters at 720 Luc Street, Ottawa, K1K 3M6 ON, CANADA.

Contact Information:

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Email address
  • First name and last name
  • Display name and profile preferences
  • Authentication tokens from third-party providers
  • Phone number (optional, for contest notifications)
  • WhatsApp number (optional, for contest notifications)

2.2 Personal Information

You may optionally provide:

  • Gender (Female, Male, or Prefer not to say)
  • Date of birth
  • Whether you have access to a computer

2.3 Education and Work Information

To personalize your learning experience and enable school leaderboards:

  • School or institution type (Primary, Middle, High School, Higher Education, Other)
  • School name and location (city, country)
  • Occupation status (Student, Employee, Unemployed, Entrepreneur, Other)

Note: Your school information may be displayed publicly on school leaderboards if you choose to participate.

2.4 Authentication Data

We use Firebase Authentication and collect:

  • Google Sign-In: Email, name, profile picture, and Google account ID
  • Apple Sign-In: Email (or private relay), name, and Apple ID
  • Email Link Authentication: Email address for passwordless login
  • Authentication tokens and refresh tokens

2.5 Learning Analytics Data

We collect detailed information about your educational activities:

  • Course progress and completion status
  • Quiz results and scores
  • Time spent on lessons and activities
  • Learning preferences and settings
  • Study streaks and achievement data
  • Performance metrics and analytics
  • Daily learning goal preference (Casual, Regular, Serious, Intense)
  • Learning motivation (Career, Hobby, School, Entrepreneurship, Other)
  • Topic interests (e.g., Web Development, Mobile Development, Security, Data Science, AI, IoT)

2.6 Social Features Data

For interactive learning features:

  • Friend connections and challenges
  • Leaderboard rankings and scores
  • Social interactions within the app
  • Challenge invitations and responses

Leaderboards and activity feeds show your username; challenge lists show your display name. When your profile visibility is set to Incognito, all three show the generated alias described in section 2.7 instead.

2.7 Your Public Profile and Its Visibility

Your public profile page is reachable by a link built from your username. Depending on the visibility level you choose, it can show:

  • Your display name, username and profile picture
  • Your country and the date you joined
  • Your lifetime XP, current league, study streak and badges
  • Your friend and follower counts
  • Your recent learning activity

Choosing a level. The setting is in the app under Settings > Public Profile, and there are three levels:

  • Visible on Google: Opt-in. Your profile may appear in search engine results, and any visitor sees the full profile. We allow search engines to index a profile only once it has earned XP and completed at least one module.
  • Standard (link only): The default. Your profile stays reachable by its link, but we tell search engines not to index it and leave it out of our sitemap. To a visitor who is not signed in, the page shows your username, your learning statistics and your badges; it leaves out your display name, your profile picture, the date you joined, your friend and follower counts and your recent activity.
  • Incognito: Other learners see a generated alias in place of your identity, alongside your learning statistics, your badges and your friend and follower counts. Your display name, username, profile picture and country are replaced, and the date you joined is reduced to the year. Your friend and follower lists and your recent activity are not shown at all, and a visitor who is not signed in is told only that the profile is private.

Your connections. The learners you have added as friends see your real display name, username and picture even while you are Incognito. A connection is a learner you added: following you does not need your approval and so does not reveal your identity, and a learner who follows you without being added back sees your alias.

Leaving Incognito. If you move to another level, the same statistics are shown under your real name again, as soon as your devices and our servers next sync. The app warns you before saving that change. Your alias is kept rather than redrawn, so returning to Incognito later reuses it.

Organizations. If you hold a seat in an organization, that organization can set Incognito as the default for its seat holders. Your own choice always takes precedence: the organization's default applies only for as long as you have not chosen a level yourself.

What the setting does not cover. It governs your public profile and the social surfaces inside the app. It does not change what you share deliberately, such as a certificate verification page.

One limit. While you are Incognito, your statistics stay attached to an internal learner identifier that appears in shared records such as challenge participant lists. Someone who has that identifier can read the statistics it carries.

2.8 Subscription and Payment Data

Through our payment processor RevenueCat:

  • Subscription status and history
  • Purchase transactions and receipts
  • Payment method information (processed by app stores)
  • Subscription preferences and settings
  • Revenue and usage analytics

2.9 Technical and Device Information

We automatically collect:

  • Device Information: Model, operating system, version, unique device identifiers
  • App Usage Data: Features used, session duration, user interactions
  • Session Recordings: On our web app (fata.app), how you navigate and interact with its pages: clicks, scrolling and what each page displays. Text you type into form fields is masked and never recorded; code you type into exercise editors is recorded as part of the page. We do not record sessions in the mobile apps
  • Performance Data: App crashes, errors, response times, network performance
  • Network Information: IP address, internet connection type, network performance

2.10 Location Information

  • IP-based Location: We use a third-party service (api.ipapi.is) to determine your approximate country location based on your IP address for localization purposes
  • We do not collect precise GPS location data

2.11 Communication Data

  • Push notification tokens per device
  • Device-specific notification permissions
  • Email communication preferences
  • Granular notification settings across 3 categories (13 notification types) including:
    • Daily reminders and news updates
    • Social notifications (challenge invites, followers, kudos)
    • Achievement notifications (badges, league changes, challenge rewards)

3. Third-Party Services and Data Collection

3.1 Firebase Services (Google)

We use Firebase services that collect and process data:

Firebase Analytics

  • User engagement metrics
  • App usage patterns
  • Custom analytics events
  • User demographics (when available)

Firebase Crashlytics

  • Crash reports and error logs
  • App performance metrics
  • Device and OS information
  • User ID for crash attribution

Firebase Performance Monitoring

  • App startup times
  • Network request performance
  • Screen rendering performance
  • Custom performance traces

Firebase Cloud Messaging

  • Push notification tokens
  • Notification delivery status
  • Message engagement metrics

3.2 RevenueCat (Subscription Management)

  • Customer identification and profiles
  • Subscription status and history
  • Purchase events and revenue data
  • App Store transaction information
  • Usage analytics for subscription features

3.3 IP Geolocation Service (api.ipapi.is)

  • IP address (automatically transmitted)
  • Country and region information
  • ISP and organization data

3.4 Apple App Store / Google Play Store

When using in-app purchases:

  • Transaction data
  • Purchase history
  • Account information
  • Payment processing data

3.5 PostHog Analytics

We use PostHog for product analytics:

  • User identification (learner ID)
  • App usage patterns and feature engagement
  • Data synchronization health monitoring
  • Device identifiers for analytics attribution
  • Session recordings of visits to our web app, as described in section 2.9

4. How We Use Your Information

We use the collected information for:

4.1 Service Provision

  • Creating and managing your account
  • Authenticating your identity
  • Providing personalized learning experiences
  • Tracking your educational progress
  • Enabling social features and interactions

4.2 App Improvement

  • Analyzing app performance and usage patterns
  • Identifying and fixing bugs and crashes
  • Improving app features and user experience
  • Developing new educational content and features

4.3 Communication

  • Sending push notifications about your progress
  • Communicating about account issues or updates
  • Providing customer support
  • Sending important service announcements

4.4 Business Operations

  • Processing subscription payments
  • Managing billing and account status
  • Preventing fraud and abuse
  • Complying with legal obligations

5. Data Storage and Security

5.1 Local Storage

  • We use local storage (IndexedDB/RxDB) on your device to store learning data for offline access
  • Local data is synchronized with our cloud servers when internet is available
  • You can clear local data through app settings

5.2 Cloud Storage

  • Primary data storage uses Firebase Firestore (Google Cloud)
  • Data is encrypted in transit and at rest
  • Regular backups are maintained for data recovery

5.3 Security Measures

  • Transport-layer encryption (TLS) for data in transit
  • Secure authentication protocols
  • Regular security audits and updates
  • Access controls and monitoring systems

6. Data Sharing and Disclosure

6.1 Third-Party Service Providers

We share data with trusted service providers who help us operate the Service:

  • Google/Firebase: Analytics, authentication, cloud storage, crash reporting
  • RevenueCat: Subscription management and payment processing
  • Apple/Google: App store services and payment processing
  • IP Geolocation Service: Location detection for app localization
  • PostHog: Product analytics and user behavior insights

6.2 Search Engines

We put your profile forward to search engines only at the Visible on Google visibility level described in section 2.7, and only once it meets the conditions named there. At the other two levels the page carries an instruction not to index it and is left out of our sitemap. Search engines are still allowed to fetch the page, because reading it is how they receive that instruction.

6.3 Legal Requirements

We may disclose information if required by law or to:

  • Comply with legal processes or government requests
  • Protect our rights, property, or safety
  • Investigate potential fraud or policy violations
  • Respond to emergency situations

6.4 Business Transfers

In case of merger, acquisition, or sale of assets, user information may be transferred to the new entity. We will notify users of any such changes.

6.5 What We Don't Do

  • We never sell your personal data to third parties
  • We don't share data with advertisers or marketing companies
  • We don't use your data for advertising purposes

7. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this policy:

  • Account Data: Retained while your account is active
  • Learning Progress: Retained to maintain your educational history
  • Analytics Data: Aggregated data may be retained for longer periods for service improvement
  • Crash Reports: Typically retained for 90 days for debugging purposes
  • Session Recordings: Deleted after 30 days
  • Feedback Reply Address: If you choose to leave an email address when sending feedback from the app, we use it only to reply to you. It is typically cleared 90 days after the feedback is sent, and the feedback itself is kept.

You can request deletion of your account and associated data at any time.

8. Your Rights and Choices

8.1 Account Controls

  • Access: View and download your personal data
  • Correction: Update incorrect or incomplete information
  • Deletion: Request deletion of your account and data
  • Portability: Export your data in a common format
  • Profile Visibility: Choose who can see your public profile, under Settings > Public Profile (/settings/profile) in the app, as described in section 2.7

8.2 Communication Preferences

  • Push Notifications: Disable through app settings or device settings
  • Email Communications: Unsubscribe through email links or contact us

8.3 Analytics Opt-Out

You can disable analytics and crash reporting in the app under Settings > Account > Privacy:

  • Analytics (Firebase Analytics & PostHog): Can be disabled in app settings. When disabled, we stop collecting usage data, screen views, and product analytics.
  • Crash Reporting (Firebase Crashlytics): Can be disabled in app settings. When disabled, we stop collecting crash reports and error logs. Note that disabling crash reporting reduces our ability to detect and fix issues that affect your experience.
  • Session Recordings: Stop once your Analytics setting has reached the browser you are using, which can take a moment after you sign in on a new one. If your browser sends a Global Privacy Control or Do Not Track signal, we do not record your visit, whether or not you are signed in.

8.4 Exercising Your Rights

To exercise any of these rights, contact us at: [email protected]

We will respond to your request within 30 days and may require identity verification.

9. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete such information from our servers.

10. International Data Transfers

Your data may be stored and processed in countries other than your country of residence, including:

  • Google Cloud Platform: Data centers worldwide
  • Firebase Services: Global infrastructure
  • RevenueCat: US-based infrastructure

All transfers are protected by appropriate safeguards and comply with applicable data protection laws.

11. Google Play Data Safety

This privacy policy, together with our Google Play Data Safety form, provides comprehensive disclosure of our data collection and sharing practices. You can view our Data Safety information on the Google Play Store listing for our app.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

  • We will post the updated policy in the app and on our website
  • We will notify you via email or push notification of significant changes
  • The "Last Updated" date will reflect when changes were made
  • Continued use of the Service after changes constitutes acceptance

If you disagree with changes, you may delete your account and stop using the Service.

13. Contact Us

For questions about this Privacy Policy or our privacy practices:

For privacy-related complaints or concerns, you may also contact your local data protection authority.

14. Jurisdiction and Governing Law

This Privacy Policy is governed by Canadian privacy laws and regulations. For users in the European Union, GDPR rights and protections apply. For users in California, CCPA rights and protections apply.

This privacy policy was last updated on October 31, 2026 and is effective immediately.