← Back to Home

PRIVACY POLICY

Last updated: 28 May 2026  ·  This site operates under the EU General Data Protection Regulation (GDPR).

1. What this site does

Systems Fail Lab is a free preparedness resource. We offer a 27-question readiness test, a personal kit-list builder, a library of field guides, and a weekly briefing. If you create an account (one-click sign-in by email), we save your assessment results, action checklist and personalised kit list in your private Cabinet so you can come back to them.

2. Who we are — data controller

Operated by an independent project based in Europe. A registered legal entity will follow before public launch on 21 September 2026.

Privacy contact: privacy@systemsfaillab.com.

3. Data we collect

(a) Account data — when you sign in via magic-link. Your email address; your saved kit lists, assessment scores, and action-list state. Stored in our own Supabase database.

(b) Telemetry — first-party, server-side. Which step of the assessment or kit builder you reached; how long ago; the answer to our one-line "do you feel more prepared" micro-survey; download events. We do not include personally identifying detail in anonymous-visitor events. Stored in our own Supabase database, never transferred to a third party.

(c) Analytics & advertising — third-party, only with your consent.

• Google Analytics 4 (GA4) — visit patterns, traffic sources, devices. Loads only after you tick Analytics in our cookie banner.
• Google Ads conversion tag — matches a sign-up or download to the ad that brought you. Loads only with your Advertising consent.
• Meta Pixel — the same, for Facebook / Instagram ads. Loads only with your Advertising consent.

None of these load unless you give explicit consent in the cookie banner. Decline once and they never load.

4. Why we collect each

Account data: so your kit list and saved progress sync between devices and survive between sessions.

Telemetry: so we know which questions confuse people, which scenarios trigger drop-offs, and whether our content actually helps users feel more prepared. We aggregate; we act on patterns, not individuals.

Analytics & advertising (consent-based): so we know what content brings traffic, which channels work, and where to spend the small marketing budget that supports this site.

5. Who we share data with

Supabase (EU-region data processor — Frankfurt, eu-central-1) — necessary for the site to function. Acts under a Data Processing Agreement.
Google (only if you consent to Analytics or Advertising) — US-based.
Meta (only if you consent to Advertising) — US-based.
MailerLite (newsletter sending provider; data stored in the European Union, ISO 27001 certified, GDPR-compliant). Subscribers consent explicitly via the newsletter signup form; unsubscribe is one-click in every email.
Nobody else. No data brokers, no email-list sales, no resale.

6. International transfers

Where data goes to Google or Meta (with your consent), it travels under Standard Contractual Clauses (SCCs) and the EU–US Data Privacy Framework adequacy decision. You can withdraw consent any time and stop the transfer for future events.

7. How long we keep it

• Account data: until you delete it (Cabinet → "Clear my data") or close your account.
• Telemetry events: 24 months, then automatically removed.
• Analytics (if consented): Google retention controls — currently 14 months.
• Advertising (if consented): 90 days max for conversion attribution.
• Consent records: 12 months — then we re-ask.

8. Your rights under GDPR

As an EU/EEA resident you have the right to: access a copy of your data, rectify inaccuracies, erase it (Cabinet → "Clear my data" or email us), export it in a portable format, restrict processing, object to legitimate-interest processing, and withdraw consent at any time (cookie banner reopens from the footer link).

To exercise any right, email privacy@systemsfaillab.com. We respond within 30 days at no charge.

You also have the right to lodge a complaint with your national data protection authority. Find yours at edpb.europa.eu.

9. Cookies & tracking technologies

We use cookies in three explicit categories. You control them in the cookie banner.

Open the banner any time from the Cookie preferences → link in the footer.

10. Children

This site is recommended for adults aged 16 and over. We do not knowingly collect data from children under 16. In jurisdictions with a higher digital age of consent, that local age applies and verifiable parental consent is required below it.

11. California consumer privacy (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know. Request a copy of the personal information we have collected about you in the prior 12 months.
• Right to delete. Request deletion of your personal information, subject to certain legal exceptions.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. If we ever did, you would have the right to opt out.
• Right to limit use of sensitive personal information. We do not use sensitive personal information for any purpose other than providing the requested service.
• Right to non-discrimination. We will not deny you services, charge different prices, or provide a different level of quality for exercising any of these rights.

Do Not Sell or Share My Personal Information. Click Manage cookie preferences and disable Analytics + Advertising. We do not engage in sale or cross-context behavioral advertising; this control is provided as a CCPA right.

Categories of personal information collected (last 12 months): identifiers (email address), internet activity (page views, clicks), inferences (resilience score, kit preferences). Sources: directly from you, automatically through your interaction with the site. Purposes: provide the service, send the briefing, measure performance.

To exercise California rights: email privacy@systemsfaillab.com with subject "CCPA request — [type]". We respond within 45 days. We may ask to verify your identity (email confirmation + match of records).

Authorized agents: a California consumer may designate an authorized agent to make a request on their behalf. Written agent permission + identity verification required.

12. Other US state privacy laws

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other US states with consumer privacy laws have similar rights — access, deletion, correction, opt-out of sale/sharing/targeted advertising. The same contact path applies: privacy@systemsfaillab.com.

13. United Kingdom (UK-GDPR + DPA 2018)

If you are based in the United Kingdom, the UK General Data Protection Regulation and Data Protection Act 2018 apply. These mirror the EU GDPR in substance — same rights of access, rectification, erasure, restriction, portability, and objection. UK residents enjoy identical rights to EU residents under this policy. The supervisory authority for UK residents is the Information Commissioner's Office (ICO), ico.org.uk. International transfers from the UK to non-adequate jurisdictions use the UK International Data Transfer Agreement (IDTA) or equivalent.

14. Canada (PIPEDA + provincial laws)

If you are based in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies federally, with provincial laws in Quebec (Loi 25), British Columbia (PIPA), and Alberta (PIPA). Under PIPEDA you have the right to:

• Access the personal information we hold about you
• Challenge the accuracy of that information
• Withdraw consent to processing (with limited statutory exceptions)
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial commissioner

Same contact path: privacy@systemsfaillab.com. We respond within 30 days. Quebec Loi 25 grants additional rights including portability and erasure.

15. Right to be forgotten — verified deletion path

If you exercise your right to erasure (GDPR Article 17, CCPA §1798.105, PIPEDA, UK-GDPR), we delete your data from:

• Supabase — account record, saved kit lists, assessment scores (immediate, hard delete)
• MailerLite — newsletter subscription (1-7 days propagation; you can also unsubscribe yourself with one click)
• Plausible analytics — uses no personal identifiers, nothing to delete on a per-person basis
• Local browser data — your Cabinet localStorage data — you control directly; clear it via browser settings or via "Sign out and delete local data" in the site footer

Confirmation of deletion is sent to your email within 30 days. Backup snapshots are purged from backup rotation within 30 additional days. Data we are required to retain for legal/tax purposes (purchase records, if any) is retained per statutory minimums and deleted thereafter.

16. Changes & contact

Last updated: 28 May 2026. Material changes will require fresh consent — the banner reopens automatically when policy version bumps. For everything else: privacy@systemsfaillab.com.

← Back to Home

METHODOLOGY

How Systems Fail Lab builds the protocols, checklists, and guidance on this site — where the material comes from, what we deliberately will not do, and how to flag a mistake when you spot one.

How we built this

Every protocol on the site starts from published guidance issued by recognised institutions, then we adapt it for an ordinary European household reading it on a phone. We strip technical jargon, add the context that civilian readers need (apartment vs house, kids vs no kids, with or without power), and pair every threat statement with an achievable action — because threats without actions produce denial, not preparation.

Editorial process. Draft → sources cross-check → voice pass (calm / non-prepper / empathy-first) → technical review against the originating guidance → publish. Updates are dated.

Update cadence. Field guides are reviewed at least annually. The weekly briefing is published every Thursday. When something material changes — a protocol revision, a new public-health guideline — we update affected pages and note it in the changelog at the bottom of each guide.

Sources we draw from

Wherever we describe medical, water, energy, evacuation, or safety procedures, we adapt them from the following public sources. We are not affiliated with any of these organisations.

• World Health Organization (WHO) — public-health emergency guidance and oral-rehydration / disease-outbreak protocols. who.int
• International Red Cross / Red Crescent Movement — first-aid, evacuation, and household-preparedness practice. ifrc.org
• Resuscitation Council (UK and ERC) — CPR, AED, and acute-care protocols. resus.org.uk · erc.edu
• National civil-protection authorities (Europe) — BBK (DE), Gov.uk (UK), Protezione Civile (IT), SAMV (CH), MSB (SE), DSB (NO), AT-GeoSphere (AT), AEMET (ES), DWD (DE), Met Office (UK), RCB (PL), and equivalent regional bodies.
• EU Civil Protection Mechanism — cross-border emergency coordination and household-preparedness campaigns. civil-protection-knowledge-network.europa.eu
• European Centre for Disease Prevention and Control (ECDC) — vaccine-preventable disease, vector-borne disease, and respiratory illness epidemiology. ecdc.europa.eu
• FEMA / Ready.gov (US) — federal household-preparedness guidance, evacuation zones, NFIP flood insurance documentation. ready.gov
• CDC, NWS, NOAA, Cal Fire, USGS (US) — public-health emergency, weather warnings, hurricane forecasting, wildfire defensible-space standards, earthquake seismology. cdc.gov · weather.gov · fire.ca.gov
• American Red Cross — US household preparedness, hurricane safety toolkit, winter storm guidance. redcross.org
• Conference of European Postal and Telecommunications administrations (CEPT) — the source for radio-band allocations across Europe.
• Peer-reviewed research — Eric Klinenberg's Heat Wave (2002) on community-level disaster response (Chicago 1995 heatwave) is a recurring citation in our community-resilience content.

Where a specific page leans heavily on one source, we cite it inline in the article. Adapted text is never reproduced verbatim from a copyrighted document.

Our commitments

• Educational reference, not professional advice. Medical, legal, and financial domains require a qualified human who knows your situation. Our role is to give you the vocabulary and the baseline so that conversation goes faster. Every clinical or safety protocol carries a Disclaimer pointer — see Disclaimer.
• Calm before urgency. Every threat statement is paired with an action you can finish today. No countdown timers, no red-banner front pages, no copy that performs anxiety. The evidence is clear: panic-driven shopping leaves people less ready, not more.
• Function over brand. When a kit item belongs in your list, we describe what it has to do — capacity, certification, expected duty cycle — so you can choose the brand. Recommendations are independent of any commercial relationship.
• Organisation voice, sourced authority. The voice here is Systems Fail Lab at the organisation level. Every claim points to a primary source you can verify; the methodology above is the audit trail.
• Transparent about tracking. The site uses analytics and advertising tags to measure performance and reach more people who could use this. The full list of categories — what runs, what data they collect, your control over them — lives in our Privacy Policy, and you can switch categories on or off any time from the consent banner.
• Reviewed when source guidance changes. Medical and safety content is reviewed against current published guidance from WHO, Red Cross/Red Crescent, Resuscitation Council (ERC), CDC, and equivalent national authorities. When source guidance is revised, affected pages are updated and dated in the per-page changelog.
• No affiliate-driven gear recommendations. Items in the Kit List are selected for capacity, certification, and expected duty cycle. We are not paid to recommend any brand, and we do not run affiliate links.

Updates and corrections

If you find an error — an outdated guideline, a mistranslation, a dead link, a protocol that disagrees with current published guidance — please tell us. Email contact@systemsfaillab.com with subject Correction — [page name]. We respond within 7 days and acknowledge substantive corrections in the page changelog.

For broader feedback, partnership enquiries, or press, the same address is fine.

← Back to Home

DISCLAIMER

Last updated: 27 May 2026

1. Educational Purpose Only

All content on this site — articles, checklists, the risk assessment, downloadable guides, and reference cards — is provided for general educational and informational purposes only. It does not constitute medical, legal, financial, or other professional advice, and must not be relied upon as such.

2. Medical Disclaimer

Nothing on this site constitutes medical advice, diagnosis, or treatment. First-aid procedures, medication references, and emergency protocols described here are provided for educational reference only and are adapted from published guidance, including the World Health Organization (WHO), the International Red Cross and Red Crescent Movement, and the Resuscitation Council. They are intended for situations where professional medical care is genuinely unavailable. Always seek the advice of a qualified healthcare professional for any medical condition, and contact your local emergency number whenever professional help can be reached.

3. No Professional Relationship

Systems Fail Lab is an educational resource. Using this site, downloading our materials, or contacting us does not create a doctor–patient, attorney–client, or any other professional relationship.

4. Assumption of Risk & Limitation of Liability

Emergency, first-aid, and self-reliance activities carry inherent risks. You are responsible for assessing your own situation, abilities, equipment, and surroundings before acting on any information provided here. To the fullest extent permitted by applicable law, Systems Fail Lab and the individuals operating it disclaim all liability for any loss, injury, or damage arising from the use of, or reliance on, this content. You assume full personal responsibility for your decisions and actions.

5. Laws and Regulations Vary

Rules governing water and food handling, fire and fuel, radio equipment, self-defence, and emergency response differ by country and region and change over time. It is your responsibility to know and comply with the laws that apply where you live and act.

6. External Links and Sources

We reference reputable external organisations for further reading and verification. We are not responsible for, and do not endorse, the content, accuracy, or availability of any external website.

7. Questions

If anything here is unclear, contact us at contact@systemsfaillab.com before relying on the content. See also our Privacy Policy.