Privacy Policy

• Your Google account. You sign in with Google, which shares your name, email address and profile photo with us, and tells us whether your email is verified. We never see your Google password. We create a username and team name for you from your name.
• Registration details. Before you compete we ask for your first and last name, enrolment ID, college, year, program, department and phone number. Organizers decide which of these are required.
• Competition activity. Every flag you submit, including the text you entered and whether it was correct, plus the points you earn, the hints you unlock, the challenges you like and the clans you join or ask to join, each with the time it happened.
• Learning progress. The CTF Learning Path tasks you complete while signed in, and your certificate's ID and issue date.
• Sign-in sessions. While you are signed in we keep a session record with your IP address and browser type (user agent).
• Technical logs. Our hosting provider keeps standard request logs, such as IP addresses and the pages requested.

• To create your account and keep you signed in.
• To run the competition: check flags, keep scores and show the scoreboard.
• To confirm you are eligible to take part, and to contact you about the competition if we need to.
• To save your learning progress and issue your certificate.
• To keep the competition fair and the site secure, for example by limiting how fast flags can be submitted and looking into cheating or abuse.

We don't sell your information or use it for advertising.

• Everyone can see your username, team name, profile photo, score and solves on the scoreboard and challenge pages. If you join a clan, other players see you on that clan's scoreboard.
• Anyone with your certificate's link or QR code can see the name on it, its ID and the date it was issued. Certificate IDs are random, so people only find a certificate if they are given its link or see the certificate itself. We ask search engines not to list certificate pages.
• Organizers can also see your email address, your registration details and the log of flags you submitted.

• Service providers that run the site for us: Google for sign-in, Vercel for hosting and Neon for our database. They handle your information only to provide those services.
• When you choose to share your certificate on LinkedIn, X or by email, your browser opens that service with your certificate's link. What happens there is covered by that service's own privacy policy.
• When the law requires it, or to protect the safety and rights of our players and organizers.

• A session cookie keeps you signed in, and short-lived cookies protect the Google sign-in step. The site needs them to work.
• The CTF Learning Path keeps your progress in your browser's local storage, so it works before you sign in. Once you sign in, that progress is added to your account.
• We don't use advertising or analytics cookies.

• We keep your account information for as long as your account exists. Sign-in sessions expire on their own.
• When an account is deleted, its registration details, submissions, hint unlocks, likes, clan memberships, learning progress and certificate are deleted with it, and the certificate's link stops working.
• Hosting logs are kept for the period our hosting provider sets.

• You can view and update your registration details at any time from your profile. The name on your certificate comes from them.
• To get a copy of your information, correct something you can't edit yourself, or delete your account, email hello@zerodayalliance.com. We may need to confirm that the request comes from you.
• Depending on where you live, data protection law may give you further rights. Contact us to use them.

The site is served over HTTPS and only organizers can see registration details. We take reasonable steps to protect your information, but no system is perfectly secure. If you find a security problem in the platform, please report it to us instead of exploiting it.

The site is meant for students and adults. If you are under 18, please get permission from a parent or guardian before you sign up.

When we change this policy, we update the date at the top of this page. We announce significant changes on the site.

Questions about this policy or your information? Email hello@zerodayalliance.com.