What we collect and why

CTF Platform is a cybersecurity training site run by Quantum Vanguard. When you play as part of a class or event, your instructor or the event's organisers also manage your account. This page describes what the platform actually records, in plain terms.

Shown publicly

Anyone, without signing in, can see the public scoreboard and the top three on the home page. For each player these show your display name, points, rank and number of solves, plus your country and profile picture if you added them. Use a nickname as your display name if you would rather not appear under your real name. You can change it on your profile page.

What we collect

• Your account: your email address and display name. Your password is held by our sign-in provider (see below); administrators can reset it but never see it.
• Your profile, if you fill it in: bio, country, website, GitHub and Discord names, a profile picture and a banner image.
• Your activity: every flag you submit, right or wrong, and when; your solves and points; hints you unlock; challenges you start and stop; your team; writeups you submit; and bookmarks.
• Your VPN access: the WireGuard configuration we create for you, which includes a key pair (the private key is stored encrypted) and your address on the challenge network.
• Hint signals: while a challenge is open, the page reports simple events (for example, a command that failed in the built-in terminal) so the hint helper can respond. These are linked to your account and the challenge.
• Technical data: our servers receive your IP address and browser details with every request. We use them to enforce request limits and protect the service, they are recorded with administrator actions in our audit log, and they may appear in the web server's logs.
• In your browser: your signed-in session, whether you have seen the welcome guide, which announcements you dismissed, and a per-challenge identifier for hint signals. Nothing here is used for advertising.

Why

• To run your account and the challenges, and to score and rank results.
• To keep competitions fair, including checks for signs that flags were shared between accounts.
• To keep the service secure: request limits, suspending accounts that break the rules, and a record of what administrators did.
• To offer hints that fit where you are in a challenge.

Who can see it

• Everyone: only what the public scoreboard shows (above).
• Instructors and administrators: your account details and the activity listed above, so they can run the class or event, help you and grade results.
• Our service providers: only to provide their service, as listed below.

We do not sell your data, show advertising, or use analytics trackers. Your account and activity are not sent to AI services.

Services we use

• Supabase: sign-in, password-reset emails, the database and uploaded images.
• Hetzner Online: the servers that run the platform and the challenges.
• hCaptcha: checks that the sign-up form is used by a person.
• Google Fonts, the Tailwind CSS CDN, jsDelivr and cdnjs: deliver fonts, styles and script libraries to your browser. Like any website your browser fetches from, they receive your IP address when it does.
• ui-avatars.com: draws a default picture from your display name when you have not uploaded one, so it receives that name.

How long we keep it

Your account and activity are kept while your course or event runs and afterwards, so that results stay intact. There is no automatic deletion. You can ask for your data to be corrected or deleted at any time (below); where results have already been graded, your instructor may need to keep a record of them.

Your choices and contact

• Change your display name and profile at any time on your profile page.
• To ask what we hold about you, or to have it corrected or deleted, contact your instructor or write to security@qvanguard.org.
• If this policy changes, the date at the top changes with it.