Privacy Policy

1. Introduction

Britain Builders ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you visit our website at britainbuilders.com and participate in our recruitment challenges.

We are a civic tech coordination platform based in the United Kingdom. This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Anonymous Analytics Data

We collect anonymous usage data to understand how people interact with our challenges and improve the recruitment process. This includes:

• Session information: Anonymous session ID (browser session only, not persistent)
• Navigation data: Pages viewed, time spent on pages, navigation paths
• Puzzle interaction: Challenge attempts, hint usage, completion times
• Technical metadata: Browser type, screen resolution, viewport size, language preference
• Referrer information: Which website referred you to us (if any)

Storage: All analytics data is stored locally in your browser's localStorage. No data is transmitted to external servers.

2.2 Credential Information

When you complete recruitment challenges, we generate a verifiable credential containing:

• Solver handle: Optional username you provide (if you choose to enter one)
• Achievement level: Your completion tier (Initiate, Codebreaker, Builder, etc.)
• Completion timestamp: Date and time you completed challenges
• Solve time: How long it took you to complete the challenges
• Skills: Skills demonstrated through challenge completion

Storage: Credentials are stored locally in your browser's localStorage. You can export your credential as JSON at any time.

2.3 Information We Do NOT Collect

We specifically do not collect:

• Email addresses (unless you voluntarily provide them when joining the registry)
• IP addresses (Cloudflare may log these for security purposes, but we do not access them)
• Names or other personal identifiers
• Location data beyond general region (Cloudflare edge routing)
• Cookies or persistent tracking identifiers
• Payment information (our platform is free)

3. How We Use Your Information

3.1 Purpose of Data Collection

We use the collected information to:

• Improve user experience: Understand how people navigate challenges and where they struggle
• Optimize difficulty: Adjust puzzle difficulty and hint timing based on completion data
• Verify credentials: Generate verifiable proof of your challenge completion
• Prevent abuse: Detect and prevent automated bots from gaming the system
• Analyze recruitment funnel: Understand conversion rates at each stage

3.2 Legal Basis for Processing

Under UK GDPR, our legal basis for processing is:

• Legitimate interests (Article 6(1)(f)): We have a legitimate interest in understanding how our recruitment process performs and improving it. This is balanced against your privacy rights by collecting only anonymous, aggregated data.
• Consent (Article 6(1)(a)): If you choose to join the Britain Builders registry and provide personal information, we will obtain your explicit consent.

4. Data Storage and Security

4.1 Where Your Data is Stored

Browser localStorage: All challenge progress, credentials, and analytics are stored locally in your browser. This means:

• Data never leaves your device during Phase 1
• We cannot access your data remotely
• You have full control to view, export, or delete it

Cloudflare Pages: Our website is hosted on Cloudflare Pages (UK/EU data centers). Cloudflare may collect connection metadata for security and performance. See Cloudflare's privacy policy for details.

4.2 Data Retention

• Analytics data: Automatically deleted after 30 days (client-side cleanup)
• Session data: Deleted when you close your browser (stored in sessionStorage)
• Credentials: Stored indefinitely in your browser until you delete them

4.3 Security Measures

• HTTPS encryption: All connections to our site are encrypted via TLS 1.3
• No external trackers: We do not use Google Analytics, Facebook Pixel, or any third-party tracking
• Cloudflare protection: DDoS protection and Web Application Firewall (WAF)
• Regular security audits: See our SECURITY.md for technical details

5. Your Rights Under UK GDPR

You have the following rights regarding your data:

5.1 Right to Access

You can access all your data at any time. Open your browser's Developer Tools (F12) and navigate to Application → Local Storage → britainbuilders.com.

5.2 Right to Export (Data Portability)

Export your analytics data in JSON format:

Export your credential:

5.3 Right to Deletion (Right to be Forgotten)

Delete all your data at any time:

Or clear your browser's localStorage/cache for britainbuilders.com.

5.4 Right to Object

You can object to analytics tracking by disabling JavaScript or using browser privacy features. The site will still function for challenges.

5.5 Right to Lodge a Complaint

If you believe we have mishandled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

6. Third-Party Services

6.1 Current Services

Cloudflare Pages (Hosting): Our website is hosted on Cloudflare's network. Cloudflare may collect connection metadata for security purposes. See Cloudflare's Privacy Policy.

Google Fonts (Typography): We load fonts from Google Fonts. This may result in your IP address being sent to Google. See Google's Privacy Policy.

QRCode.js (CDN): We load the QRCode library from cdnjs.cloudflare.com for credential QR codes. No tracking occurs.

6.2 Future Services (Phase 2)

When we launch Phase 2 with a backend, we will use:

• Supabase: Database and authentication (UK/EU hosted)
• GitHub API: For contribution tracking (optional)

We will update this policy and obtain your consent before any Phase 2 data collection begins.

7. Cookies and Tracking

We do not use cookies. Our site uses browser localStorage and sessionStorage instead, which:

• Are not transmitted to servers
• Cannot track you across sites
• Are fully under your control
• Do not require cookie consent banners under UK law

8. Children's Privacy

Britain Builders is intended for adults (18+) and professionals. We do not knowingly collect data from children under 13. If you are under 18, please obtain parental consent before participating in challenges or joining the registry.

9. International Data Transfers

Our website is hosted in the UK and EU via Cloudflare's network. No data is transferred outside the UK/EEA during Phase 1. If future services require international transfers, we will ensure adequate safeguards (Standard Contractual Clauses or equivalents).

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make significant changes:

• We will update the "Last updated" date at the top of this page
• We will display a notice on our homepage for 30 days
• For registered users (Phase 2), we will send an email notification

We encourage you to review this policy periodically. Continued use of our site after changes constitutes acceptance of the updated policy.