This page describes what LevelUpCTF collects, why, and what we never do. This Privacy Policy is the canonical privacy text for this training workspace.
Last reviewed: 2026-07-11. Contact: platform privacy team.
Email, display name (handle), and password hash. Optionally display name, country, stream selection, and social links if you fill them in on your profile.
Solve history, attempt timestamps, hint usage, ELO rating, category scores, and badges. The LevelUpCTF challenge-type skill vector uses 15 axes: Web, Cryptography, Binary Exploitation, Smart Contracts, Reverse Engineering, Forensics, General Security, OSINT, AI Security, API Security, Malware Analysis, Incident Response, OT/ICS Security, Mobile Security, and Boot2Root. This is what lets us match you to challenges at the right difficulty.
LevelUpCTF records attempt timestamps and outcomes, tool and command execution events, retries, hint usage, and sandbox session metadata. Session replay is recorded where the selected service or workspace enables it. Free-tier telemetry is mandatory because it supports difficulty calibration, fair matchmaking, abuse prevention, and aggregate platform reliability. Enterprise, Event, and Academia agreements may define additional session-replay access and retention controls.
Standard request/response logs, IP address at auth time for rate-limiting and abuse prevention, and Docker container lifecycle events. Kept for 30 days by default, longer if required for incident investigation.
You can export or delete your account from Profile → Account, or ask for help by emailing platform privacy team. Deleting an account immediately disables access and removes live profile, authentication, and direct identity data. Encrypted backups expire within 30 days. De-identified aggregate solve-time and calibration metrics may be retained and cannot be used to restore the account.
We set an authentication cookie (7-day lifetime) and a CSRF marker where applicable. Google Analytics and third-party advertising or cross-site tracking cookies are not used in this institution workspace.
Password hashing: bcrypt. Transport: TLS 1.3 only. Sandbox isolation: Docker with seccomp + no-new-privileges + network policy + read-only filesystems where applicable.
We do not claim SOC 2 Type II or ISO 27001 certification. We welcome security reports at platform security team.
Material changes are announced via email to all registered accounts at least 14 days before taking effect. The current version of this page is the canonical text.