Privacy notice

Collection details

• Your account: choose a nickname to play without email or password. The platform stores your nickname, session, IP address and browser information as described below. Progress is tied to your browser cookie unless you link GitHub. Nickname accounts show their chosen nickname on rankings, including after linking. GitHub is optional: to keep your progress on another device, link GitHub from /play. Linking keeps the current account and all progress. A GitHub identity already attached to another account cannot be linked; accounts are never merged. If you link or sign in with GitHub, the platform keeps your GitHub numeric user id, your GitHub username, and your ranking display choice and handle if you choose one. It keeps no other part of your GitHub profile. Existing GitHub accounts show either their GitHub username (the default) or a chosen handle. Linked accounts have a small GitHub-verified mark; this verifies control of a GitHub account, not a real-world identity. You can switch at any time from /play, up to three changes per Pacific calendar day. Handles have no GitHub profile link. If a handle later matches another participant’s GitHub username, rankings use a neutral name until its owner chooses another handle. A handle you choose that matches your own GitHub username still shows that text. The scoreboard is visible to participants. Public first-capture rankings show the chosen display names and first correct submission times of the first 20 solvers of each offered challenge, without requiring sign-in. These public snapshots may remain cached for up to five minutes after a display change or after an account is deleted or suspended. Changes of ranking display are recorded in the private audit log without storing the handle in its metadata. Deleting your account also removes its handle. To detect flag sharing, the platform keeps keyed fingerprints of issued flags linked to your account and challenge; these are removed with your account and contain no plaintext flag.
• Security: your IP address and browser user agent, stored with your session and in an audit log of account and platform events. They enforce rate limits and help investigate abuse.
• Edge logs: The content delivery network and web application firewall in front of the platform log each request to the platform with your IP address, the time, the path and query string, the status, and the request headers other than cookies and credentials. Of the requests you send to targets they log only those a rate limit or IP reputation rule matched, without the query string. They stop floods and help investigate abuse. Only the operator can read them.
• Your play: the instances you start, whether each flag submission was correct (not the text you submitted), and the score records your solves create.
• Request analytics: fixed categories of the requests you send to targets (method, kind of route, status, and timing). Analytics keeps no URLs, request bodies, cookies, flags, or IP addresses.
• Participation measurement: on a separate private cloud instance, a scheduled job reads existing records of account creation, successful sign-ins, lab opens, and first solves. It records the event time and challenge label where needed, using a pseudonymous HMAC identifier instead of your account ID. The source database applies the configured GitHub owner exclusions without exposing GitHub numeric IDs to analytics. It does not copy your GitHub login or name, visitor IP or browser, flags, commands, request bodies or query strings. Configured owner accounts are excluded when participation events are processed. Recreated owner accounts must be added to the exclusion list again. Previously recorded events follow the retention and deletion rules below. Self-test accounts and accounts that are suspended or deleted when events are processed are also excluded.
• Target request logs: for each request you send to a target, the server logs record your account id and, only when you choose GitHub as your display mode, your GitHub username, the target, the method, the path and query string (cut to 1 KiB, with flags, tokens, and passwords masked), the status, timing, sizes, and your browser’s user agent. Request bodies, cookies, and IP addresses are not logged. Only the operator can read them. They cannot be edited or removed early, including by “Delete my data”, and expire after 30 days.
• Access map: an approximate country, worked out from your IP address on its own servers; the IP address is not stored for it. Participants see a country-level map, and any area with fewer than three participants is hidden.
• Treasure wallet: Ethereum transactions and addresses are public. Anyone can see a transfer from the published wallet to its destination. There is no site claim or operator payout, and the platform collects no prize eligibility, sanctions or tax documents. Blockchain records cannot be removed by “Delete my data”.
• Retired SSH entry: public SSH entry and key registration have been removed. Previously registered public keys remain stored but are no longer read or used for authentication. Historical SSH gateway server logs expire after 30 days. SSH connection and public-key change audit records, including source IP addresses and event metadata, are retained for 180 days. Backups follow the retention periods below.
• Stage execution logs: when execution collection is enabled, the operator records programs started in your Node, Ruby and PHP environments, including through SSH and in the background. In the stages' standard Bash shells, this also includes executed shell-command text, builtins, functions and commands in scripts or background subshells, reported by a shell hook. Records include your account id, the environment and stage, program names and arguments, working directories, process relationships, timing, and failure or exit status. Recognized flags and credentials are masked. Process environments, injected private keys, raw terminal recordings and arbitrary file contents are not collected by this feature. Only the operator can read these logs. They expire after 30 days and are not removed early by “Delete my data”. Collection limits, outages or a disabled shell hook can leave gaps.
• Secret-location access observations: a separate optional host-side monitor records attempts to open, read or map the fixed flag, onward SSH-key and PHP wallet locations. It records your account, chain, stage, container, process, server time, outcome and bytes read, without collecting file contents. These private observations follow the same retention as stage execution logs. They show access to a monitored location, not proof of the original contents, a complete exploit chain or a wallet transfer. Disabled collection, interruptions and unsupported access methods can leave gaps.

How long it is kept

We do not send behavioral data to third-party analytics services; we aggregate only the fields we need in our own cloud environment.

• Audit log: 180 days.
• Sessions: a session lasts 400 days from your last visit, and is removed 7 days after it expires.
• Request analytics, access-map origins, and exercise traces: 7 days.
• Server logs, including target request logs: 30 days.
• Automatic database backups are retained for seven days. Encrypted manual database snapshots are also kept for rollback and recovery and may remain longer. No fixed deletion period is currently specified for manual snapshots.
• Edge logs (CDN and web application firewall): 30 days.
• Participation analytics: 90 days by default; the operator can shorten this period. Its encrypted backups expire under a seven-day snapshot policy.
• Your account and its play history: until you delete them.

Light abuse prevention

A web application firewall challenges nickname creation and lab starts using a silent JavaScript browser check, rather than a CAPTCHA. JavaScript and cookies are needed to play. Each address can create at most three nickname accounts per rolling hour and run one lab at a time. IPv6 addresses in the same /64 share these limits. The normal per-account start throttle also applies. A short-lived keyed IP fingerprint reserves a running lab through its target lifetime, including when you close its terminal; it expires when the target expires or is stopped. Account-creation audit records keep their normal retention even if the account is deleted, so deletion does not reset the hourly limit. We do not automatically prune unused nickname accounts.

Cookies

A session cookie for this site, which keeps you signed in for up to 400 days and is renewed while you play, and an entry cookie on each challenge host you open. While you sign in with GitHub or link it, a second cookie holds that sign-in’s security checks and the page to return to; it lasts at most 10 minutes and is removed when GitHub sends you back. Progress stays on the server, but access to an unlinked nickname account lives in this browser cookie. Clearing this site’s cookies or signing out can permanently lose access unless GitHub is linked. A nickname alone cannot recover an account. Linked users can sign in with GitHub on another device. The web application firewall also stores an aws-waf-token cookie for its silent JavaScript browser challenge. There is no advertising or third-party tracking.

Planned public run logs

The operator plans to publish reviewed logs of successful runs as learning material, including their timeline, commands, and available output. This is a future feature; detailed run logs are currently visible only to the operator as described above. The publication timing, attribution, and redaction rules will be stated before publication begins.

Sharing and your choices

• Nothing is sold. Data is shared only with the hosting provider, or where the law requires it. Optional GitHub linking and sign-in go through GitHub, under GitHub’s own privacy statement.
• “Delete my data”, at the top of the page while you play, deletes your account here at once; your GitHub account is not affected. It removes the records linked to your account or unlinks them; unlinked records then expire on the schedule above.
• The private analytics job also removes your pseudonymous events during its scheduled cleanup, normally every five minutes. Failed cleanup is retried after outages. Deleting your account removes it from the active service but does not immediately erase retained audit records or backup copies. Automatic backups follow the seven-day policy; manual snapshots may remain as described above.
• GitHub lists this site among the apps you have authorized; you can revoke it in GitHub’s settings (Applications, Authorized OAuth Apps). That does not delete your account here; “Delete my data” does.
• To see your data, or to have it deleted if you can no longer sign in, write to elenchist.dev+security@gmail.com with your nickname or linked GitHub username. A nickname alone is not proof of account ownership.
• Security and privacy questions: elenchist.dev+security@gmail.com. Abuse reports: elenchist.dev+abuse@gmail.com.