This document is the redpwnCTF capture the flag (CTF) competition's privacy policy. Disclaimer: The privacy policy of CTF may change anytime without prior warning or notification. This page will always contain the most updated version of the policy, identified by the date at the end of the file. ========== NOTICE ========== What information do we collect? This application collects and stores all information submitted to it by users, including (but not limited to): * personally identifiable information (PII) such as email addresseses * team information including team name, association with CTFtime (https://ctftime.org/) profiles, and team division information * log information including timestamps, IP addresses, user agent information, and basic HTTP request information. ---------- What do we use users' information for? Aside from account management, redpwnCTF uses email addresses for promotion of future redpwnCTF events. Additionally, redpwnCTF shares email addresses with HackerOne and Carnegie Mellon University's Security & Privacy Institute (CyLab) according to the policy in the next section. Additionally, redpwnCTF uses team information to verify qualification and contact winning teams. redpwnCTF collects log information for statistical and security reasons only. ---------- Who do we share users' information with? redpwnCTF shares information about teams with HackerOne (https://hackerone.com/) and Carnegie Mellon University's Security & Privacy Institute (https://www.cylab.cmu.edu/) for research purposes only. Neither HackerOne nor CyLab will contact competitors using team information provided by redpwnCTF. HackerOne intends to associate team information with HackerOne users for research purposes. Note that information stored on HackerOne users is subject to HackerOne's privacy policy (https://www.hackerone.com/privacy) and not redpwnCTF's policy. redpwnCTF will provide HackerOne and CyLab with the following information: * form survey results provided outside of the rCTF platform * email addresses without association to team names or teammates ========== ACCESS AND CORRECTION ========== How do users access or modify information stored by the platform? Users may modify their team's PII using the page at /profile. The platform does not keep track of change history; thus, users can delete their information through modification. ========== FOOTNOTES ========== Please reach out to privacy@redpwn.net if you have any questions regarding this policy. Last edited on May 6, 2020.