Privacy Policy

Who we are

Faultline is a QA practice platform operated by Faultline. It is an online service; we do not publish a walk-in address.

For privacy questions or requests, email help@bughuntlab.com.

Scope and changes

This policy covers the Faultline website, challenge workspace, sandbox applications, and support correspondence. It does not cover third-party sites we link to.

We may update this policy as the service changes. The date at the top of this page shows the latest version. If a change materially affects how we use personal data, we will make that clear on the site before it takes effect.

Summary

• The current release is guest-only. You do not create an account and we do not collect your name, email address, or password to use it.
• We process the attempt data needed to run and grade a challenge. Guest attempts are deleted after grading, and abandoned attempts are targeted for deletion after 24 hours.
• We do not use analytics, advertising, tracking pixels, or third-party marketing scripts.
• Do not enter real credentials, card numbers, or sensitive personal data into reports or the demo checkout.

Data we process

Guest attempt data

When you start a challenge, we create an attempt with an opaque identifier and record the scenario, timestamps, timer state, score, and grade breakdown. If you exercise a seeded fault, we record a trigger event containing the bug identifier, channel, timestamp, and an optional short detail string. If you submit reports, we store the title, component, category, severity, reproduction steps, expected result, and actual result.

Reports are free text. They may contain personal data if you type it in. Please describe the product behaviour rather than entering real personal data.

Technical data

Our hosting and database providers may process standard infrastructure logs such as IP address, request time, requested URL, and user agent for security and reliability. The application itself does not maintain a separate request log or user profile.

Browser storage

We store onboarding-tour state, simulated shop cart state, and your cookie-notice acknowledgement in your browser. See the Cookie Policy for names, purposes, and lifetimes.

Correspondence

If you email us, we receive your email address and the contents of your message so we can reply and, where relevant, handle a privacy request.

Demo checkout

The shop checkout accepts name, email, address, and a demo card number so the simulation behaves realistically. The application does not persist those fields. Do not enter real payment or identity details.

Accounts

Accounts are disabled in the current release. If we enable them later, we will update this policy before collecting account data such as an email address, display name, or saved history.

Why we process it

We use this data to:

• create, run, resume, and grade a practice attempt;
• show you your result and explain the score;
• secure, debug, and operate the service;
• respond to support, privacy, and security messages; and
• comply with applicable law.

Where UK/EU GDPR applies, our lawful bases are performance of a contract or steps at your request (running the practice session), legitimate interests (security, reliability, and improving the service), and consent where we ask for it. You can object to processing based on legitimate interests.

Retention

• Guest attempts are deleted after grading. If a submit request fails after grading, the row may remain until the cleanup window.
• Abandoned guest attempts are targeted for deletion after 24 hours. The application purges them opportunistically and a scheduled cleanup is part of the production launch.
• Infrastructure logs are retained according to the hosting and database providers' settings.
• Support and privacy correspondence is kept only as long as needed to resolve the request and meet legal obligations.
• Browser storage remains until you clear it or, for session storage, until the tab closes.

Sharing and processors

We use service providers to host the application, run the database, and handle contact email. They process data on our instructions. We do not sell personal data, share it for advertising, or use third-party analytics.

We may disclose data if required by law, to protect the service or its users, or as part of a reorganisation where the recipient continues to honour this policy.

International transfers

Our providers may process data outside your country. Where UK/EU law applies, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or Standard Contractual Clauses, together with the provider's technical and organisational measures.

Security

We use HTTPS, access controls, least-privilege credentials, and server-side grading. No service can promise perfect security. Do not send secrets or sensitive personal data through reports, the demo checkout, or email.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. You may also complain to your local supervisory authority.

Guest attempts are not linked to an identity, so we may need the attempt identifier and approximate time to find a record. Email help@bughuntlab.com to make a request. We may ask for information needed to verify that we can safely act on it.

Automated scoring

Grading is deterministic matching against a hidden answer key. It explains which reports matched, which faults were missed, and which reports were treated as false positives. It is not profiling and does not produce a decision with legal or similarly significant effects.

Children

Faultline is not directed to children. Do not use the service or submit personal data if you are under 16.

Cookies and storage

The current release uses essential browser storage and no advertising or analytics cookies. Read the Cookie Policy for the full list and how to clear it.

Contact

For privacy, security, or general questions, email help@bughuntlab.com. We can route the message from there.