Privacy Policy

This page explains what data ExploitRoom collects, why, and what you can do about it. No fine-print games — this is what actually happens with your information.

• Account data — name, email, hashed password, country, affiliation.
• Security & activity logs — IP address, login timestamps, and actions taken (registrations, password changes, submissions) for abuse prevention and account security.
• Platform activity — challenge/academy progress, submitted flags, ratings and reviews you leave.
• Payment data (career/internship program only) — processed by our payment provider; we do not store raw card details.

• Operate and secure the platform, including detecting cheating and abuse.
• Send transactional email — confirmation, password resets, event notifications — that you trigger.
• Improve challenges, lessons, and the overall experience.

We do not sell or rent your personal data to third parties, ever.

We use a session cookie to keep you signed in and a small cookie to remember your language preference. We don't run third-party ad trackers.

We keep your data while your account is active, plus a reasonable period afterward for security and audit-log purposes. You can request deletion of your account and personal data at any time, subject to what we're required to retain for security/abuse records.

You can access, correct, or request deletion of your data via your account settings, or by reaching out to our support team.

Passwords are hashed, never stored in plaintext. We follow standard security practices, but no system is 100% guaranteed — use a unique password for your account.

We may update this Privacy Policy from time to time. Questions about your data? Reach out to our support team.