This Privacy Policy (the Policy) sets out how personal data of users of the PassFront service at https://passfront.app (the Site or the Service) is processed and protected. The data is processed by the owner of the PassFront service (the Administration) in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 "On Personal Data".
By using the Service, the User confirms that they have read and accept the Policy. A User who does not accept the Policy must stop using the Service.
1. Terms and definitions
1.1. Personal data means any information relating directly or indirectly to an identified or identifiable natural person (data subject).
1.2. Administration means the owner of the PassFront service, who organises and carries out the processing of personal data of the Service's users.
1.3. User means a natural person who visits the Site, has registered with the Service or otherwise uses its features.
1.4. Processing means any operation or set of operations performed on personal data, with or without automated means.
1.5. Account means the User's account in the Service, created by registering with an email address or by signing in with GitHub.
2. Requests
2.1. Requests about personal data processing are accepted via Telegram @rainteaar.
3. Personal data we process
3.1. When registering with an email address:
- email address;
- the name the User provides;
- a password hash (the password itself is never stored).
3.2. When signing in with GitHub, the data GitHub shares with the User's permission:
- GitHub account ID and login;
- name and email address from the profile;
- profile picture (avatar) URL.
3.3. While using the Service:
- task solutions, their check results and learning progress;
- notes, favourites and custom packs;
- interview materials the User creates or takes part in;
- requests to the AI assistant and its answers.
3.4. Automatically when the Site is accessed: IP address, browser and device details, request dates and times, and server logs needed to run and protect the Service.
3.5. The Administration does not process special categories of personal data (health, political views, religious beliefs and the like) or biometric personal data.
4. Purposes of processing
4.1. The Administration processes personal data to:
- register, identify and authenticate the User and restore access to the Account;
- provide the Service's features: code practice with automatic checks, the question bank, roadmaps, progress tracking, interviews and the AI assistant;
- send service notifications such as password reset emails or interview invitations;
- keep the Service secure and prevent fraud and abuse;
- handle the User's requests.
4.2. The Administration does not use personal data for advertising and makes no solely automated decisions that have legal effects for the User.
5. Legal grounds
5.1. The Administration processes personal data on the following grounds:
- the User's consent to personal data processing, given at registration (Article 6(1)(1) of Federal Law No. 152-FZ);
- performance of the User Agreement to which the User is a party (Article 6(1)(5) of Federal Law No. 152-FZ).
6. How data is processed
6.1. Processing includes collection, recording, organisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access), blocking, deletion and destruction of personal data.
6.2. Processing is mainly automated.
6.3. Personal data of Russian citizens is recorded, organised, accumulated, stored and clarified in databases located in the Russian Federation.
6.4. Personal data is kept for as long as the Account exists. After the Account is deleted or consent is withdrawn, the data is deleted within 30 days unless the law requires a longer retention period. Backups are overwritten as they are rotated.
7. Sharing with third parties
7.1. To run the Service, the Administration uses:
- Mail.ru mail service (VK LLC, Russia) to send service emails;
- RouterAI (routerai.ru) to generate AI assistant answers; request text may be processed by language model providers, including outside the Russian Federation;
- GitHub, Inc. (USA), only if the User chooses to sign in with GitHub; authentication happens on GitHub's side.
7.2. The User should not include personal data in requests to the AI assistant. By sending a request, the User agrees to its cross-border transfer to generate the answer.
7.3. The Administration does not sell personal data or share it with third parties for advertising.
7.4. The Administration may disclose personal data to public authorities in the cases and manner required by the laws of the Russian Federation.
8. Cookies and local storage
8.1. The Service uses only strictly necessary cookies: a secure session cookie without which signing in is impossible.
8.2. Interface settings (theme, language, code editor preferences) are kept in the User's browser local storage and are not sent to the Administration.
8.3. With the User's consent given in the banner on the first visit, the Service uses Google Analytics for page visit statistics. Page addresses are sent without identifiers or tokens. The choice is kept in the browser's local storage; if the User declines, analytics is never loaded. The Administration uses no advertising trackers.
9. User rights
9.1. The User may:
- obtain information about how their personal data is processed;
- require their personal data to be clarified, blocked or destroyed if it is incomplete, outdated, inaccurate or processed unlawfully;
- withdraw consent to personal data processing;
- delete the Account in the Service settings.
9.2. Requests and withdrawal of consent are sent via Telegram @rainteaar. The Administration replies within 10 business days of receiving a request.
9.3. The User may appeal the Administration's actions or inaction to Roskomnadzor or in court.
10. Data protection measures
10.1. The Administration takes legal, organisational and technical measures to protect personal data from unauthorised access, alteration, destruction and disclosure, including:
- transferring data only over HTTPS;
- storing passwords only as a strong cryptographic hash;
- restricting access to servers and databases;
- regular backups.
11. Final provisions
11.1. The Administration may amend the Policy. A new version takes effect once published on the Site unless the new version states otherwise.
11.2. The current version of the Policy is always available at https://passfront.app/privacy. The date of the last update is shown at the top of the document.
11.3. The Policy and the relations between the User and the Administration are governed by the laws of the Russian Federation.