Privacy policy

Last updated 1 November 2026.

This CTF is a personal project run by Ahmed El Euch. It stores as little as it can, and it has no advertising.

What is collected

From Google or GitHub when you sign in: your email address, your name, and your GitHub login if you use GitHub. The site asks for nothing else and never sees your password. Profile pictures are not used.
The handle and name you choose.
What you do here: which challenges you solved and when, and when you submitted a flag and whether it was right. The text of a wrong guess is not kept.
Limits against abuse count requests for a short time. Your account or IP address is only ever stored scrambled, in a form that cannot be read back.

Your handle, your name, when you joined and what you solved appear on the leaderboard and your profile page. You can change your handle and name at any time, and you can leave the name out.
Your email address and your wrong guesses are never shown.

Only to sign you in, keep your score and stop abuse. Your data is not sold, shared for advertising or used to train AI models.
Data from Google is used only to sign you in and to fill in your first profile.

Supabase holds the database and sign-ins. Vercel hosts the site and keeps the usual server logs, and may count page views and measure page speed without cookies. Google and GitHub handle their own sign-in pages.

The site sets only what sign-in needs: a session cookie, and a short-lived cookie that ties a sign-in to your browser. Your light or dark theme is kept in your browser. There are no tracking or advertising cookies.

Your data stays until you ask for it to be removed. Rate-limit counters are cleared after about two days.
To see, correct or delete your data, email the address below. Deleting your account removes your player, solves and attempts.