Privacy

CTFEpi is a personal, noncommercial project at ctf.xera.ac.

Without an account

Your progress stays in your browser (local storage). To limit submissions, the server keeps a salted hash of your IP address with each submission; the address itself is not stored.

With an account

Signing in with Google or GitHub gives us your name, email address, and profile picture from that provider. We store them with your solves, opened notes, surrenders, and submissions. Wrong flags are kept to find ambiguous statements; correct flags are not stored. Your email is never shown to anyone. The leaderboard shows only the display name you choose, and only if you opt in.

API tokens

Tokens for the ctfepi R package are stored as SHA-256 hashes; we cannot read them back. Revoke them on your profile at any time.

Deletion

Delete your account on your profile page. This removes your account, tokens, solves, notes, and surrenders; your past submissions are kept without any link to you.

Cookies and trackers

Only the sign in session cookie. No analytics, advertising, or third party trackers. Fonts load from Google Fonts.