Log in

This English version is provided for information. The Czech version applies in the Czech Republic and the Slovak version in Slovakia.

Without the legal language: Data in plain words

Contents
Data processing

Security measures

Version 1.0 · Effective from 16 October 2026 · About 4 min read
In short, in plain words
  • The best protection is having nothing to steal: we do not know the names or contact details of students in the game.
  • Data is encrypted in transit and at rest. We run the primary database in the EU (Ireland); the List of processors explains when the data may be accessed from the USA and how that access is protected.
  • Everyone sees only what they strictly need – this is enforced by the database itself, not just by the app.
  • Sensitive administrator actions are logged, and administrators sign in with two-factor authentication.
  • If something were to happen, we know what to do, and if you were at high risk, we would let you know.

1. Minimisation and pseudonymisation

  • We do not collect students' names, e-mail addresses, phone numbers or ages; they play under a generated nickname.
  • Answers to research surveys are separated from the profile (see the Student privacy notice).
  • We show aggregate results only for groups of at least 10 people, so that no individual can be identified from them.
  • One-time codes and keys (e.g. for linking a profile or for reminders) are stored only as a cryptographic fingerprint.
  • We delete data according to fixed retention periods (see Data retention and deletion).

2. Encryption and infrastructure

  • All communication with the website and the app takes place over an encrypted connection (HTTPS/TLS).
  • The database and backups are encrypted at rest with the provider Supabase in the EU (Ireland).
  • We operate on the infrastructure of providers holding international security certifications (see the List of processors).
  • Secret keys are stored only in the secured server configuration, never in the browser or in the source code.

3. Access control

  • Rules in the database itself. Every table has row-level security enabled. The website's personal data is accessible only through controlled database functions that verify who is asking.
  • Least necessary privileges. An administrator sees only the campaigns and organisations they are authorised for. A teacher sees only the aggregates for their own school. An ambassador sees only their own account and the ambassador leaderboard.
  • Separate administration runs at a separate address.
  • Passwordless sign-in. Users sign in with a one-time code sent by e-mail; there are no passwords that could leak.
  • Two-factor authentication for administrators. In addition to the e-mailed code, administrators also verify themselves with a code from an authenticator app.
  • Access to raw research data is specifically restricted, and every viewing is logged.

4. Logging and review

  • Sensitive administrator actions (publishing, activating and rolling back campaign versions, verifying teachers, exports, access to research data) are written to an append-only audit log; neither ordinary administrator privileges nor the app allow it to be modified. The records are deleted after 3 years.
  • Database changes go through code review and automated tests which, among other things, verify that no table has been left unsecured and that no role has more privileges than it should.

5. Backups and recovery

The database is backed up daily; backups are kept for 7 days. A deleted item of data therefore disappears from the backups within 7 days at the latest.

6. People and contracts

  • Only authorised staff who need the data for their work have access to it.
  • We have data processing agreements under Article 28 GDPR with our processors, and a joint controller arrangement under Article 26 GDPR with the campaign organisers.

7. Security incidents

We have a procedure for handling security incidents. If a personal data breach occurs, we will report it without undue delay and, where feasible, within 72 hours to the Czech Office for Personal Data Protection (ÚOOÚ), unless the breach is unlikely to result in a risk to the rights and freedoms of the people concerned. We will always inform the organiser of the affected campaign. If the breach poses a high risk to your rights, we will also inform you without undue delay; students whose contact details we do not know will be informed by a notice in the app and on the website.

8. Reporting a vulnerability

Have you found a security flaw? Write to privacy@arwell.works. Do not exploit it or share it with anyone else until we have fixed it. We will not take any action against you on our part for a report made in good faith.