Privacy Policy

The data controller for personal data processed through FraudCodex is CYBER DREAM SAS, 3 Rue Jacques Daguerre, 44300 Nantes, France (SIREN 951 325 984). See the Legal Notice for full company information.

When you create an account or sign in:

• Email address - required to create the account, send transactional emails and recover access
• Display name / first and last name - optional, shown on your profile and certificates
• Password hash - only if you sign up with email/password; we never store plaintext passwords
• Learning progress - completed lessons, exercise attempts, exam scores, XP and badges
• A session cookie issued after sign-in so we can keep you logged in

You can delete your account at any time from your profile settings; this removes your personal data from our database.

To make registration easier, you can sign up or sign in using your Google or LinkedIn account through the OAuth 2.0 / OpenID Connect protocol.

When you choose this option, the provider redirects you back to FraudCodex with a minimal identity payload. We only read and store:

• Your verified email address
• Your display name (and, if available, first/last name)
• A stable provider identifier so the same Google/LinkedIn account always maps to the same FraudCodex account

We do not request access to your contacts, calendar, posts, connections or any other data. We do not post on your behalf. The provider may log the authorization event on their side under their own privacy policy (Google, LinkedIn).

We use a small number of strictly necessary cookies - no advertising or analytics cookies.

• Session cookie (set by FraudCodex, HttpOnly, Secure, SameSite=Lax) - keeps you signed in after authentication. Cleared when you sign out.
• OAuth state / CSRF cookie (set by FraudCodex during sign-in with Google/LinkedIn) - short-lived, protects against cross-site request forgery during the OAuth flow.
• Cloudflare cookies (__cf_bm, cf_clearance) - set by our security/CDN provider to distinguish humans from bots and to protect the service from abuse.

FraudCodex is served behind Cloudflare, which acts as a reverse proxy in front of our origin server. Cloudflare terminates HTTPS, caches static assets, filters malicious traffic (DDoS protection, bot mitigation, WAF) and routes legitimate requests to us.

Cloudflare automatically processes technical request data: IP address, user agent, requested URL, timestamp, TLS metadata and signals used to detect abusive traffic. Cloudflare also sets the __cf_bm and (occasionally) cf_clearance cookies to support these protections.

Cloudflare acts as a data processor on our behalf. See the Cloudflare Privacy Policy and their Cookie Policy.

We send transactional emails only (account confirmation, password reset, important account notices). We do not send marketing or promotional emails.

Delivery is handled by Scaleway Transactional Email (TEM), a service operated by Scaleway S.A.S. (France, European Union). To deliver a message, we transmit your email address, the rendered message content and standard SMTP metadata to Scaleway, which forwards it to the recipient mail server and may retain delivery logs for the period required by their service.

See the Scaleway Privacy Policy for details. Scaleway acts as a data processor on our behalf.

The FraudCodex application and its database are self-hosted by CYBER DREAM SAS in datacenters owned and operated by CYBER DREAM SAS, located in France (European Union). All personal data (account information, learning progress, session data) is stored on this infrastructure.

Because CYBER DREAM SAS operates both the service and the underlying infrastructure, there is no separate hosting sub-processor. Personal data is not transferred outside the European Union as part of normal operations.

Some features (UI preferences, draft answers, exam timer state) use your browser's localStorage. This data is stored exclusively on your device and is never transmitted to any server. You can clear it at any time through your browser settings.

For functionality purposes, the site loads the following assets from public CDNs:

• Google Fonts - Inter typeface (fonts.googleapis.com)
• Tailwind CSS - styling framework (cdn.tailwindcss.com)
• D3.js - data visualization library (d3js.org)

These services receive your IP address and user agent when your browser fetches the asset, per their own privacy policies. FraudCodex does not send any user-level data to them.

Standard application and access logs (IP address, requested URL, timestamp, user agent, response status) are retained for a limited period for security, debugging and operational purposes. They are not used for tracking, profiling or marketing, and are not shared with any third party other than the infrastructure providers strictly necessary to operate the service.

The following sub-processors are involved in operating FraudCodex:

• CYBER DREAM SAS - application & database hosting (own datacenter, France)
• Cloudflare, Inc. - CDN, TLS termination, WAF / anti-DDoS proxy
• Scaleway S.A.S. - transactional email delivery (France, EU)
• Google LLC / LinkedIn Ireland UC - optional OAuth 2.0 / OIDC sign-in (only if you choose to use it)

If you are located in the European Economic Area or the UK, you have the right to access, rectify, export, restrict, object to and delete your personal data, and to withdraw consent at any time. Most of these can be exercised directly from your profile settings (edit profile, delete account).

For anything else - or to lodge a complaint with the supervisory authority (CNIL in France) - contact us via the address listed in the Legal Notice.