Privacy Policy
This page describes what AimCorp CTF collects, why, and what we never do. This Privacy Policy is the canonical privacy text for this training workspace.
Last reviewed: 2026-07-11. Contact: platform privacy team.
What we collect
Email, display name (handle), and password hash. Optionally display name, country, stream selection, and social links if you fill them in on your profile.
Solve history, attempt timestamps, hint usage, ELO rating, category scores, and badges. The AimCorp CTF challenge-type skill vector uses 16 axes: Web, Cryptography, Binary Exploitation, Smart Contracts, Reverse Engineering, Forensics, General Security, OSINT, AI Security, API Security, Malware Analysis, Incident Response, OT/ICS Security, Mobile Security, Boot2Root, and Space Operations. This is what lets us match you to challenges at the right difficulty.
AimCorp CTF records attempt timestamps and outcomes, tool and command execution events, retries, hint usage, and workspace session metadata. Session replay is available only when enabled for your organisation workspace. Your organisation agreement and administrator control replay access and retention. Contact your programme administrator for the approved workspace policy.
Standard request/response logs, IP address at auth time for rate-limiting and abuse prevention, and Docker container lifecycle events. Kept for 30 days by default, longer if required for incident investigation.
What we never do
- We don’t sell your personal data.
- We don’t share individual behavioural telemetry with third parties. Aggregate metrics (e.g. “average solve time by category”) may appear in research papers or marketing — never with identifiers.
- We don’t use your solve patterns to train foundation models outside the AimCorp CTF platform. Enterprise AI evaluation customers license anonymised aggregate telemetry under a separate explicit agreement.
- We don’t read challenge-sandbox command history for anything other than the platform uses above.
Account deletion
You can export or delete your account from Profile → Account, or ask for help by emailing platform privacy team. Deleting an account immediately disables access and removes live profile, authentication, and direct identity data. Encrypted backups expire within 30 days. De-identified aggregate solve-time and calibration metrics may be retained and cannot be used to restore the account.
Cookies and tracking
We set an authentication cookie (7-day lifetime) and a CSRF marker where applicable. Google Analytics and third-party advertising or cross-site tracking cookies are not used in this institution workspace.
Security posture
Password hashing: bcrypt. Transport: TLS 1.3 only. Sandbox isolation: Docker with seccomp + no-new-privileges + network policy + read-only filesystems where applicable.
We do not claim SOC 2 Type II or ISO 27001 certification. We welcome security reports at platform security team.
Changes to this policy
Material changes are announced via email to all registered accounts at least 14 days before taking effect. The current version of this page is the canonical text.