Privacy Policy

1. Introduction

finroam GmbH ("finroam," "we," "us") takes your privacy seriously. We are a company incorporated in Switzerland (Canton of Zug).

This Privacy Policy explains how we collect, use, and protect your personal data when you use the finroam mobile application (the "App") and our website (www.finroam.com). By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Who is Responsible? (Data Controller)

For the purposes of the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), the "Data Controller" responsible for your personal data is:

finroam GmbH
Sinserstrasse 67
6330 Cham
Switzerland

3. Information We Collect

We collect the minimal amount of data necessary to provide you with a great learning experience.

A. Information You Give Us

• Account Data: When you sign up, we collect your email address and your age. You can sign up with an email and password, or with "Sign in with Apple" or "Google".
• If you use "Sign in with Apple" or "Google," we receive an authentication token, not your password. If you sign in with Google, we also receive the name linked to your Google account.
• If you sign up with an email and password, your password is encrypted and hashed securely by our authentication provider; we do not have access to or store your actual password.
• Profile Data: An optional username and your full name.
• Onboarding & Interests: Your answers to onboarding questions (for example what describes you best, how you heard about us and what motivates you) and to our interest quiz (for example which skills you want to learn and why), which we use to recommend courses.
• Communications: If you contact support, we collect your email and the content of your message. If you report a question in a lesson, we collect your report and comment.
• Class Invitations: If a teacher or staff member of an organization invites you to a class, they provide your email address to us before you have an account.

B. Information Collected Automatically

• Learning Activity: Your activity in lessons and in the practice area (including unfinished attempts), the answers you give, your scores, how long they take, XP, streaks, completed modules and certificates earned. Certificates store a copy of your full name at the time they are issued.
• Offline Progress: If you practice without a connection, your progress is stored on your device until it can be sent to our servers.
• Push Notifications: If you allow notifications, we store your device's push token, platform (iOS/Android) and time zone, and keep a record of the class notifications we send you.
• Technical Data: Your IP address, authentication and access logs, and technical details (such as app version and platform) when the App checks for updates.
• No tracking: We do not use analytics, advertising, tracking or crash-reporting tools in the App, and we do not access your location, camera, contacts, microphone or photos.

4. How We Use Your Data

We process your data for the following specific purposes:

• To Provide the Service: Logging you in, saving and syncing your progress, and issuing certificates. (Legal Basis: Performance of Contract)
• To Run Classes and Leagues: Showing your display name and XP to your classmates on leaderboards and in class notifications, and giving the organization running your program access to your progress (see section 13). (Legal Basis: Performance of Contract / Legitimate Interest)
• To Send Notifications: Daily reminders and class challenge updates, if you allow notifications. You can turn them off anytime in the App settings or in your device settings. (Legal Basis: Consent)
• To Personalize Your Learning: Using your onboarding and interest quiz answers to recommend courses. (Legal Basis: Performance of Contract)
• To Send Emails: Sign-up codes, password resets and other account emails, and class invitations and reminders sent on behalf of an organization. Every invitation email contains an unsubscribe link; once you unsubscribe, no organization can send you invitation emails again. Sign-in codes and password-reset emails, which you request yourself, are not affected. (Legal Basis: Performance of Contract / Legitimate Interest)
• To Support You and Improve finroam: Answering your support requests and using question reports to improve our content. (Legal Basis: Legitimate Interest)
• To Ensure Security: Preventing fraud and unauthorized access. (Legal Basis: Legitimate Interest)

Important: We do not show third-party advertisements in our App, nor do we sell your personal data to advertisers.

5. Public Credentials & Social Sharing

A unique feature of finroam is the ability to earn and share credentials.

• Public Access: If you choose to share a credential via a public link, you acknowledge that specific details, including your Full Name, the Credential Name, and the Date of Issue, will be visible to anyone with the link.
• Indexing: While we do not actively ask search engines to index these pages, we cannot control third-party platforms.
• Revocation: You may revoke access to a credential at any time in your App settings. However, we are not responsible for screenshots or cached copies taken by third parties while the link was active.

6. How We Share Your Data

We do not sell your data. We only share it with trusted service providers ("Processors") that help us run our Service, and with the organization running your program if you joined through one (see section 13):

• Database, Authentication & Server Functions: To store your account data and progress securely and to log you in. (Supabase, with our database hosted in Frankfurt, Germany (EU)).
• App Updates & Push Notifications: To deliver app updates and to send notifications, including their content. (Expo, USA; delivered by Google Firebase Cloud Messaging on Android and Apple Push Notification service on iOS).
• Sign-in Providers: If you choose to sign in with them. (Google and Apple).
• Email Delivery: To send class invitations and deliver messages from our website's contact form. (Resend, USA).
• Web Hosting: To host our website and our dashboard for organizations. (Vercel, USA).
• Website Analytics: Only if you accept cookies on our website (Google Analytics, see section 12).
• Fonts in Emails: Some of our emails load fonts from Google Fonts, so Google may receive your IP address when you open them.

7. International Data Transfers

Our primary database is located in the European Union (Supabase, hosted in Frankfurt, Germany). Switzerland recognizes the EU as providing an adequate level of data protection. Supabase Inc. is a US company, and some of our other providers (like push notifications, sign-in, email delivery, web hosting and website analytics) may process data in the United States.

We ensure these transfers are protected under Swiss and EU law by relying on recognized legal frameworks (such as the Swiss-U.S. Data Privacy Framework) and standard contractual clauses (SCCs) where applicable.

8. Data Retention

We retain your personal data only for as long as your account is active or as needed to provide you with the Service.

• If you deactivate your account: Your account is hidden immediately. If you sign in again within 30 days, you can reactivate it and everything is restored. After 30 days, your personal data is erased.
• If you delete your account permanently: Your personal data is erased immediately. This cannot be undone.
• What is erased: your email address, name, username and login; your onboarding and quiz answers (including your age); your messages to us and your comments on questions; the name on your certificates; your notification settings and devices; and class invitations sent to your email address.
• What is kept: Your learning activity (lessons, exercises, scores and XP) is kept for statistical purposes, linked only to a random identifier and to nothing that identifies you. It no longer appears on any leaderboard or organization dashboard.
• Backups: Residual copies may remain in our encrypted backups for up to 30 days before being permanently overwritten.

9. Your Rights (Swiss & GDPR)

You have the following rights regarding your data:

• Right to Access: You can ask for a copy of the data we hold about you. We send it to you within one month.
• Right to Rectification: You can update your profile information in the App settings.
• Right to Deletion: You can deactivate or permanently delete your account at any time, directly in the App settings or by email (see below and section 8).
• Deleting some of your data: You can clear your username and full name in the App (Edit profile) and switch notifications off in the App settings. To have any other data deleted without deleting your account, email us from your account's email address and tell us what to delete. We do this within one month. See also finroam.com/help/delete-some-of-my-data.
• Right to Withdraw Consent: You can turn off notifications in the App settings or in your device settings, and change your cookie choice on our website via "Cookie settings".

To exercise any of these rights, email us at contact@finroam.com. For requests about your data (such as a copy or deletion), please write from the email address of your finroam account (for "Sign in with Apple" or "Google", the email address of that account), so we can make sure the request comes from you. We only act on requests sent from the account's own email address.

Deleting your account

You can delete your account in the app (Settings → Delete account) or follow the steps at finroam.com/help/delete-account. In the app, you can choose to deactivate your account (restorable for 30 days) or delete it permanently.

If you cannot use the app, email contact@finroam.com from your account's email address with the subject "Delete my account". We delete your account within 30 days and confirm by email.

10. Children's Privacy

Our Service is restricted to users aged 16 and older. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information.

11. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Our Website, Hosting and Contact Form

• Hosting: Our website is hosted by Vercel Inc. (USA). When you visit the website, Vercel processes technical data such as your IP address, browser type, date and time of access and the pages requested, in order to deliver the website securely. (Legal Basis: Legitimate Interest)
• Cookies and Google Analytics: With your consent, we use Google Analytics 4 (Google Ireland Ltd. / Google LLC, USA) to understand how our website is used, e.g. pages visited, referring websites, approximate location (country/city), device type and interactions such as opening or sending the contact form. Google Analytics sets cookies (_ga, _ga_*) that are stored for up to 13 months. IP addresses are not logged or stored by Google Analytics 4. Google Analytics is only loaded after you click "Accept" in our cookie banner, and you can withdraw your consent at any time via "Cookie settings" at the bottom of the page; the cookies are then deleted. Your choice itself is saved in your browser's local storage. Our website does not use advertising cookies. Fonts and animations are served from our own website. (Legal Basis: Consent)
• Contact form: When you send a request through our website (e.g. "Book a 20-minute call" or "Contact us"), we collect your name, work email, university or school, and, if you provide them, your role, the number of students and your message. We use this data only to answer your request and to organize the Campus Challenge with you. Your request is delivered to us by email through Resend Inc. (USA). (Legal Basis: Consent and pre-contractual measures)
• Retention: We keep contact requests for as long as necessary to handle your request and any resulting collaboration, and delete them afterwards unless we are legally required to keep them.

Transfers to Vercel, Resend and Google in the United States are protected as described in section 7.

13. Programs Offered Through Organizations

finroam can be offered through organizations, for example a university, school or company running a program such as the Campus Challenge.

• What the organization sees: If you join finroam through an organization's program, the organization's authorized staff (for example your teacher) can see, through a dedicated dashboard and only for their own class, your display name (or "Learner" if you have not set one), email address, XP and ranking, your progress in the program's courses, modules and lessons, your scores (including your overall average score), exam and knowledge-check results, and your study activity (for example when you were last active). Your classmates in the program can see your display name and XP on class leaderboards and in class notifications.
• What the organization does not see: your answers to individual questions, your full name, your age, your onboarding answers, and any activity from before the program's challenge started or after it ended.
• How long: The organization's access ends 7 days after the challenge ends. The final leaderboard also stays visible to the class for 7 days after the challenge ends.
• Leaving a class: You can leave a class at any time in the App settings (Leave institution). You are then removed from its leaderboard and the organization no longer sees you. Your own progress stays in your account.
• Purpose: We share this data with the organization only to run and follow up on the program.
• Legal Basis: Performance of Contract (providing the program you joined) and Legitimate Interest (enabling the organization to run the program).
• Questions about the organization's use: The organization is responsible for how it uses the program data it can access. For questions about this, please contact the organization directly, or contact us.