Privacy notice
In short
G4A Pass stores what it needs to run your account and your learning record, and nothing for advertising. There are no analytics, no tracking, no third-party scripts and no embedded content: fonts and icons come from this server. The only cookie is the one that keeps you signed in.
Who is responsible
Controller under the GDPR: Dr. Jesus del Valle, Sonatenweg 10, 13158 Berlin, Germany. Email: pass@yeysus.com.
When you open a page
Your browser sends your IP address and the usual request details (the address of the page, the time, your browser). The server uses them to deliver the page and keeps no access log. Error messages go to a container log that is capped in size and overwrites its oldest entries.
To stop people guessing passwords or flooding sign-up, the server counts attempts per IP address and per email address. It stores only a one-way hash of the address with the count, and a nightly clean-up deletes these counters once they are a day old.
Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in delivering the service securely.
Your account
To create an account you give your email address, your name and, if you like, why you want to join. We store them with a hash of your password (never the password itself), your language, your role and the account's status. Sign-up and password reset send a six-digit code by email; we store only a hash of it, it expires after 10 minutes and is deleted a day later.
If your email or your organization's domain is not on the list of organizations that join directly, an administrator of this service reads your name, address and reason and decides. You get an email either way when you are approved.
Signing in sets one cookie, g4a_session: a random value that keeps you signed in for up to 30 days. It is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG) and is removed when you sign out.
Legal basis: Art. 6(1)(b) GDPR, providing the service you signed up for.
Your learning record
What you enter while using G4A Pass is stored with your account: your expertise, interests, learning goal and technical confidence; the evidence and reflections you submit; reviewers' feedback; your XP and marks; and any share text you write. Nothing is posted anywhere: share texts are copied by you.
You see your own record. Administrators and reviewers of this service can see account lists and the evidence of milestone missions, which they review. There are no public profiles and no leaderboard.
Legal basis: Art. 6(1)(b) GDPR.
G4A Generations
In the optional Generations area an adult who is the guardian of a young Explorer, or authorized by the guardian, enrolls them. We store only a nickname, an age band and interests, never a legal name, and the young person gets no account and no public profile.
We keep a record of which version of the Generations policy the guardian agreed to and when, as proof of consent (Art. 7(1) GDPR). Revoking consent ends the pair and deletes the nickname, age band and interests immediately; the consent record stays.
Legal basis: consent, Art. 6(1)(a) and Art. 8 GDPR, which can be withdrawn at any time with effect for the future.
The codes and notices G4A Pass sends (sign-up, approval, password reset) go out from pass@yeysus.com through the mail server of that mailbox's provider, which receives your address and the message to deliver it. The emails contain no links and no tracking.
If you write to pass@yeysus.com, your address and message are used only to answer you and deleted when that is done.
Optional AI coach
Mission suggestions come from fixed rules on this server. The operator can additionally switch on an AI coach that reorders those suggestions and explains them in one sentence. Only then, and only when suggestions are requested, the server sends Anthropic PBC (548 Market Street, San Francisco, CA 94104, USA) your expertise, interests, learning goal, technical confidence, XP per path and the shortlist of missions. It never sends your name, email address, evidence, or anything about a young participant. If the coach is unavailable, the rules decide on their own.
Anthropic processes this data as a processor. The transfer to the USA relies on the EU standard contractual clauses in Anthropic's data processing addendum. Legal basis: Art. 6(1)(f) GDPR, the legitimate interest in useful suggestions; you can object at any time by email.
API tokens
If you create an API token, we store its name, scopes, expiry, a short prefix to recognise it, a hash of the secret (never the secret), and when it was last used. Revoked tokens stay listed as revoked.
Audit log
Security-relevant actions (sign-ins, approvals, role changes, reviews, consent, token changes) are recorded with who did them and when, so misuse can be traced. Entries are deleted after one year.
Legal basis: Art. 6(1)(f) GDPR, keeping the service secure and accountable.
In your browser
If you use the language or light/dark switch, your choice is saved in your browser's local storage (g4a-locale, g4a-theme) so the next page opens the same way. It never leaves your device and is stored only because you asked for it (§ 25(2) no. 2 TDDDG).
Hosting
The server is rented from Contabo GmbH, Aschauer Straße 32a, 81549 München, Germany, which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). Data stays in the EU unless the AI coach above is switched on.
How long
Your account and learning record are kept while you have an account. Write to pass@yeysus.com to have it deleted; we then delete your data except what we must keep for longer by law, and the audit entries, which follow their one-year limit.
Your rights
You have the right to:
- know what data about you is processed (Art. 15 GDPR),
- have it corrected (Art. 16) or deleted (Art. 17),
- have its processing restricted (Art. 18),
- receive it in a portable format (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw a consent at any time, without affecting what happened before (Art. 7(3)).
An email to pass@yeysus.com is enough. You can also complain to a data protection authority, for example the one responsible here: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.