1. What We Collect
- Account information: username, email address, and a securely hashed password (if you sign up with email), or your name and email address if you sign up via Google.
- Usage data: labs started, flags submitted, progress, and activity logs within the Platform.
- Technical data: IP address, browser type, and basic device information, collected automatically for security and troubleshooting purposes.
- VPN session data: information necessary to issue and manage your private VPN connection to lab environments (your assigned private IP, session timestamps).
We do not collect or store the contents of your activity inside a lab's VPN-connected environment beyond what's needed for flag verification.
2. How We Use Your Data
- To create and manage your account.
- To provide access to lab environments and track your progress.
- To send account-related emails (such as email verification codes).
- To maintain platform security, including detecting abuse of the Acceptable Use policy.
- To improve the Platform based on aggregate usage patterns.
We do not sell your personal data to third parties.
3. Third-Party Services
We use the following third-party services, which may process limited data on our behalf:
- Google, for "Continue with Google" sign-in. Google's handling of your data is governed by Google's own Privacy Policy.
- Email delivery provider, to send verification codes and account-related emails.
- Cloudflare, for content delivery, security, and DNS.
These providers only receive the minimum data necessary to perform their function.
4. Cookies
We use cookies necessary for authentication and session management (keeping you logged in). We do not currently use third-party advertising or tracking cookies.
5. Data Retention
We retain your account data for as long as your account remains active. If you delete your account, your personal data will be removed within a reasonable timeframe, except where retention is required for security or legal reasons.
6. Your Rights
You may request access to, correction of, or deletion of your personal data at any time by contacting us. You may delete your account directly from your account settings, where available.
7. Data Security
We take reasonable technical measures to protect your data, including encrypted connections (HTTPS), secure password hashing, and isolated per-user lab environments. No system is perfectly secure, and we cannot guarantee absolute security.
8. Children's Privacy
The Platform is not intended for users under 13. We do not knowingly collect data from children under 13.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
10. Contact
Questions about this Privacy Policy can be sent to breaktheroot@proton.me.