CTF-ORIONPrivacy policy
What CTF-ORION stores about you, why it is stored and how to ask for changes.
What this covers
This page explains what CTF-ORION stores about you, why, who can see it and how to ask for changes. It covers the website, the learning paths, challenges, teams and events. CTF-ORION is a product of QudsLab.
What we store
Only what the site needs to work and to keep competitions fair.
| Data | Why |
|---|---|
| Username, email address, display name, bio | Your account and your name on scoreboards. Your email is used to answer you and for account help; it is not shown to other players. |
| Password | Stored as a one-way hash, never as plain text in the database. |
| Team, team history, role, account status | Teams, team switching rules, teacher access and fair-play decisions. |
| Flag submissions (text, time, result, IP address) | Scoring, rate limits and finding shared flags. |
| Solves, lesson progress, event registrations | Scoreboards and your account page. |
| Last sign-in time and IP address | Security, and finding several accounts used by one person. |
| Contact messages and hosting proposals | To read and answer them. The IP address of a contact message is kept to fight spam. |
| Lessons, paths and challenges you write | To review and publish them under your username. |
| Server logs | Errors, security events and admin actions, including request details such as address, page and time. |
Cookies and similar storage
- session: keeps you signed in and protects forms. Needed for the site to work. It lasts up to 30 days when you are signed in.
- ctfo_login: remembers that you signed in on this browser so the menu can show the right buttons. It lasts one year.
- Colour mode: your light, dark or default choice is kept in your browser storage only.
We do not use advertising cookies.
TracePrint and third parties
Every page loads TracePrint, another QudsLab product. It reads browser and device signals to detect automated abuse, flag guessing and duplicate accounts. Those signals are used for protection, not for advertising.
The site loads fonts from Google Fonts and icons from jsDelivr. Those services receive your IP address when your browser requests the files.
What other people can see
Your username, points, solves and team are shown on scoreboards and on your public profile page. Your email address, IP address and submissions are not public. When a fair-play case is confirmed, an admin can publish the names of the players or teams involved on the integrity page.
Who can access it
The admin team can see account data, submissions, logs and contact messages to run the site and decide fair-play cases. Reviewers of teaching content see what you submit for review. We do not sell your data.
How long we keep it
Account data stays while the account exists. Server logs and submission records are kept for as long as we need them to investigate abuse and errors. Contact messages are kept until they are closed and deleted.
Your choices
- Change your display name, bio and password on your account page.
- Ask for a copy of your data, a correction, or deletion of your account by writing to us from your account email.
- If your account is deleted, your solves are removed from the scoreboards too.
Contact
Write to [email protected] or use the contact page. If this policy changes in a way that matters, we will note it on the changelog.