Privacy Policy

The Platform is operated by CTF-Hub LTD, Tzvi Tadmor 3, Holon, Israel (“we”). For questions about this policy or your data, contact support@ctf-hub.io.

CTF-Hub is a multi-tenant platform. Your role determines who is legally responsible (“controller”) for your data:

• •Your account & billing data (email, credentials, subscription): we act as the controller.
• •Data you submit inside an organization / event (challenge submissions, scores, org-managed profile, team activity): the organization that operates that tenant is generally the controller, and we act as a processor / service provider on its behalf under its instructions and a data-processing agreement. Requests about that data may be routed to the organization.

We collect the following categories of personal data:

• •Account & identity: email address, username / display name, password (stored only as a salted hash — never in plain text), and, if you enable it, your two-factor authentication (2FA) secret (stored encrypted).
• •Profile & organization: avatar, role(s), team membership, and the organization / tenant you belong to.
• •Competition activity: events you join, challenge submissions and answers (flags), scores, rankings, badges, and activity/audit logs with timestamps.
• •Content you upload: files, images, challenge assets, workshop materials, and onboarding responses. Files are stored in cloud object storage (AWS S3).
• •Support communications: support tickets and messages you send us.
• •Billing: your subscription plan, status, and billing history metadata. Card payments are processed by our reseller/merchant of record, Paddle; we do not receive or store your full card number.
• •Technical & usage data: IP address, browser and device information (user agent), pages viewed, features used, approximate location derived from IP, and bot-detection signals collected by Cloudflare Turnstile.
• •Cookies & similar technologies: essential session/authentication cookies (JWT), security cookies, and — where permitted — analytics cookies (see §6).
• •Compliance records: when you accept our Terms / Acceptable Use Policy, we record the fact, timestamp, and IP address for legal and audit purposes.

Please do not submit sensitive personal data (e.g., health, biometric, or government-ID data) in challenge submissions, writeups, or uploads. CTF-Hub is not intended to process such data.

We use personal data for the following purposes, relying on the legal bases noted (where GDPR applies):

• •Provide the Platform — create/authenticate your account, run events, record submissions and scores, deliver content. Basis: performance of a contract.
• •Security & abuse prevention — bot/fraud detection (Turnstile), rate limiting, tenant isolation, incident investigation, and recording policy acceptance. Basis: legitimate interests and legal obligation.
• •Billing & subscriptions — manage plans, process renewals via Paddle, and meet tax/accounting duties. Basis: contract and legal obligation.
• •Communications — send transactional emails (verification, invitations, receipts, security alerts) via MailerSend. Marketing emails, if any, are sent only with your consent and you can opt out at any time. Basis: contract / consent.
• •Analytics & improvement — understand usage and improve the Platform with Google Analytics and Mixpanel. Basis: consent, which you can withdraw at any time.
• •Advertising measurement — measure which of our Google Ads bring visitors and sign-ups. We do not build advertising profiles of you. Basis: consent, which you can withdraw at any time.
• •Legal & compliance — enforce our terms, resolve disputes, and comply with law. Basis: legitimate interests / legal obligation.

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and where required by law. Our key sub-processors are:

• •Amazon Web Services (AWS) — cloud infrastructure and file (S3) storage.
• •MongoDB Atlas — managed database hosting.
• •Vercel — frontend hosting and privacy-friendly usage analytics.
• •Cloudflare — CDN, web-application firewall, and Turnstile bot protection.
• •Paddle — reseller / merchant of record for payments, invoicing, and sales tax.
• •MailerSend — transactional email delivery.
• •Google Analytics and Google Tag Manager (Google) — product analytics, only if you accept analytics cookies.
• •Mixpanel — product analytics and session replays with all text and inputs masked, only if you accept analytics cookies.
• •Google Ads (Google) — advertising measurement, only if you accept marketing cookies.
• •HubSpot — customer-relationship management for organization / business contacts.

We may also disclose data to comply with a legal obligation, enforce our agreements, protect the rights, safety, or property of CTF-Hub or others, or in connection with a merger, acquisition, or sale of assets (with notice where required).

CTF-Hub and its sub-processors may process your data in countries other than your own, including the United States and the European Union. Where we transfer personal data internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (or an equivalent mechanism) to protect your data. Contact us to request more information about these safeguards.

Only strictly necessary cookies are set without asking. Every other category is off until you switch it on, wherever you are. Until then, no analytics or advertising script is loaded at all, so nothing about your visit reaches those providers.

• •Strictly necessary — sign-in session (JWT), security, Cloudflare Turnstile bot protection, and the record of your cookie choice (cookieConsent, stored in your browser). Vercel Analytics and Speed Insights collect cookieless, aggregate page statistics. These cannot be switched off.
• •Functional — remember settings such as theme and layout.
• •Analytics — Google Analytics (_ga, _ga_*, up to 2 years) and Mixpanel (mp_*, up to 1 year), including session replays in which all page text and inputs are masked.
• •Marketing — Google Ads conversion measurement (_gcl_*, up to 90 days). If your browser sends a Global Privacy Control signal we treat it as a refusal and do not offer this category.

We keep your choice for 6 months, then ask again. You can change or withdraw it at any time, as easily as you gave it; withdrawing deletes the related cookies.

• •We keep account and competition data for as long as your account is active and for a reasonable period afterwards to support recovery, dispute resolution, and integrity of historical results.
• •Security and access logs are retained for a shorter period, typically consistent with operational and security needs.
• •Billing and tax records are retained for the period required by applicable law (commonly up to several years).
• •When you delete your account or we honour an erasure request, we delete or anonymise your personal data, except where we must retain it to meet a legal obligation, resolve disputes, or enforce our agreements.

• •Encryption of data in transit (TLS/HTTPS) and encryption at rest for sensitive fields (including 2FA secrets).
• •Passwords are stored only as salted one-way hashes; optional two-factor authentication is available.
• •Strict multi-tenant isolation so one organization's data is not accessible to another.
• •Role-based access control, rate limiting, bot protection, and audit logging.

No system is perfectly secure. If you believe your account has been compromised, or you discover a vulnerability, contact support@ctf-hub.io.

Depending on where you live, you may have some or all of the following rights over your personal data:

• •Access — obtain a copy of the data we hold about you.
• •Rectification — correct inaccurate or incomplete data.
• •Erasure — request deletion of your data (“right to be forgotten”), subject to legal retention.
• •Restriction & objection — limit or object to certain processing, including processing based on legitimate interests.
• •Portability — receive your data in a portable, machine-readable format.
• •Withdraw consent — where we rely on consent (e.g., marketing, analytics cookies), you can withdraw it at any time.
• •Complain — lodge a complaint with your local data-protection supervisory authority.

California residents (CCPA/CPRA): you have the right to know, delete, and correct your personal information, and to opt out of “sale” or “sharing” — noting that we do not sell your personal data. We honour the Global Privacy Control browser signal as an opt-out of sharing for advertising. We will not discriminate against you for exercising these rights.

To exercise any right, email support@ctf-hub.io. If your data is managed by an organization/tenant (see §1), we may direct your request to that organization as the controller. We will verify your identity before acting and respond within the time required by applicable law.

The Platform is not directed to children under [13 / 16 — the age of digital consent in your jurisdiction], consistent with our Acceptable Use Policy. We do not knowingly collect personal data from children below that age. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes we will notify registered users by email and/or a prominent notice on the Platform, and update the version number and effective date above. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.