CTF ORIONPrivacy policy
What CTF ORION stores about you, why it is stored and how to ask for changes.
What this covers
This page explains what CTF ORION stores about you, why, who can see it and how to ask for changes. It covers the website, the learning paths, challenges, teams and events. CTF ORION is a product of QudsLab.
What we store
Only what the site needs to work and to keep competitions fair.
| Data | Why |
|---|---|
| Username, email address, display name, bio | Your account and your name on scoreboards. Your email is used to answer you and for account help; it is not shown to other players. |
| Password | Stored as a one-way hash, never as plain text in the database. |
| Team, team history, role, account status | Teams, team switching rules, teacher access and fair-play decisions. |
| Flag submissions (text, time, result, IP address) | Scoring, rate limits and finding shared flags. |
| Solves, lesson progress, event registrations | Scoreboards and your account page. |
| Last sign-in time and IP address | Security, and finding several accounts used by one person. |
| Contact messages and hosting proposals | To read and answer them. The IP address of a contact message is kept to fight spam. |
| Lessons, paths and challenges you write | To review and publish them under your username. |
| Server logs | Errors, security events and admin actions, including request details such as address, page and time. |
Cookies and similar storage
- session: keeps you signed in and protects forms. Needed for the site to work. It lasts up to 30 days when you are signed in.
- ctfo_login: remembers that you signed in on this browser so the menu can show the right buttons. It lasts one year.
- Colour mode: your light, dark or default choice is kept in your browser storage only.
We do not use advertising cookies.
TracePrint and third parties
Every page loads TracePrint, another QudsLab product. It reads browser and device signals to detect automated abuse, flag guessing and duplicate accounts. Those signals are used for protection, not for advertising.
The site loads fonts from Google Fonts and icons from jsDelivr. Those services receive your IP address when your browser requests the files.
Challenge play statistics
On challenge pages we count simple events: opening the page and its description, downloading a file, opening a hint or the writeup, that you focused, typed in or pasted into the flag box (only that it happened, never what you typed), each flag try, leaving the page, and how long a solve took. We store these events with times, linked to the challenge and your account; no keystrokes, no screen recording. Creators see only totals for their own challenges (for example how many people opened, downloaded and solved, and the usual solve time) so they can fix challenges that are too hard or broken. At most 60 events per minute are kept per person.
Translations and badges
Texts you suggest on the Translate page are stored with your account. Approved texts are shown on the site without your name; the count of your approved texts decides your Translator badge, which is public on your profile like every other badge.
What other people can see
Your username, points, solves and team are shown on scoreboards and on your public profile page. Your email address, IP address and submissions are not public. When a fair-play case is confirmed, an admin can publish the names of the players or teams involved on the integrity page.
Who can access it
The admin team can see account data, submissions, logs and contact messages to run the site and decide fair-play cases. Reviewers of teaching content see what you submit for review. We do not sell your data.
How long we keep it
Account data stays while the account exists. Server logs and submission records are kept for as long as we need them to investigate abuse and errors. Contact messages are kept until they are closed and deleted.
Your choices
- Change your display name, bio and password on your account page.
- Ask for a copy of your data, a correction, or deletion of your account by writing to us from your account email.
- If your account is deleted, your solves are removed from the scoreboards too.
Contact
Write to [email protected] or use the contact page. If this policy changes in a way that matters, we will note it on the changelog.