Privacy Policy
Version: 2026-10-31-68dcab59b74e · InteractiveCats
Who operates the service
InteractiveCats operates FraudAttacks and is responsible for the personal information it processes for its own service purposes. Contact: ben@fraudattacks.com. This policy covers the current service for account holders, visitors, and learning-session participants. Future school or company agreements may assign additional responsibilities for organization-controlled information. They will not automatically make all information anonymous or remove our own duties.
Information we process
For accounts, we process email addresses, authentication-provider identifiers, account status, access permissions, session records, and records of terms acceptance. We store workshops, authored content, revisions, uploaded or generated media, and related operational records. Support requests contain the information you send us. Infrastructure and authentication providers may process IP addresses, device and browser details, request logs, and security events to deliver and protect the service.
Learning sessions and children
Current classroom players use generated nicknames instead of entering names or email addresses. We process a session identifier, participant identifier, nickname, answers, answer timing, scores, and connection state to run the activity. Hosts and other participants may see nicknames, responses, results, or scoreboards as the activity permits. These are pseudonymous records, not a promise of anonymity: a host or another person may recognize a participant. No optional PostHog or Google Analytics collection runs on join, player, host-game, or discussion pages. Hosts must explain their activity and obtain any permissions required for their setting. We remain responsible for our own obligations. Contact us if a child has provided personal information that should not be there.
Why we use information
We use information to authenticate users, apply permissions, save and deliver content, run learning activities, provide support, prevent abuse, secure and maintain the service, keep necessary records, and meet legal obligations. Providing account information is voluntary, but without required information we cannot provide an account or the requested feature. Optional analytics and future marketing choices are separate from account terms. Where applicable law requires a legal basis, we rely on the basis appropriate to the purpose, such as providing the requested service, legal obligations, legitimate operational interests where allowed, or consent where required.
Cookies and browser storage
Essential cookies and browser storage support sign-in, security, interface language, session participation, and recovery of unsaved edits. They are not optional analytics. Where configured, PostHog and Google Analytics load on eligible adult pages only after the corresponding optional choice is enabled. Our analytics integration sends limited page-use events rather than scenario text, names, answers, or classroom activity. Session replay and automatic click capture are disabled. You can refuse or change optional choices through Cookie settings. Refusing optional analytics does not prevent account use. The authentication provider operates its own sign-in page and storage.
Service providers and sharing
WorkOS provides authentication. Hosting, PostgreSQL database services, and Cloudflare R2 or the configured object store support operation and media storage. If you request AI assistance, the selected prompts, content, or media are sent to OpenRouter and the model providers selected for that request. Optional analytics use PostHog and Google Analytics only as described above. Providers receive information needed for their function and may process it in other countries. Their processing and safeguards depend on the service and configuration used. We may disclose information where required by law, to protect rights and safety, or in a business transfer subject to applicable safeguards. We do not sell personal information or use classroom answers for advertising.
Retention and deletion
We retain information for the purposes described here, including operating accounts and saved activities, security, legal requirements, and resolving disputes. The duration depends on the record and service configuration. Expiry of a game access code does not automatically delete its answers or results. Backups and immutable edit or permission records may remain after removal from active views. Contact us to request access, correction, deletion, or account closure. We will explain any retention that remains necessary. We do not promise immediate deletion from all backups or providers.
Your choices and rights
Depending on the law that applies, you may have rights to access or correct information, request deletion or restriction, object to certain processing, withdraw consent, receive a copy, or complain to a competent privacy authority. Write to ben@fraudattacks.com. We may need proportionate information to verify your identity and locate records. Do not send passwords or unnecessary identification documents. Withdrawal of optional consent does not change processing already lawfully performed. Organization-controlled records may also require a request to the organization; we will explain our role.
Security and policy changes
We use access controls and other technical measures to protect information, but no service is completely secure. Report suspected misuse or a privacy issue to ben@fraudattacks.com. We identify policy versions and will communicate material changes as appropriate. New audiences or features will receive relevant notices before new uses of information; this policy is not advance consent for unspecified future processing.