Privacy Policy

1. Overview

Hack n Roll is operated by the Platform operator. Our current place of establishment is Brazil. This policy describes our practices regarding personal data when you use the Platform.

We do not use advertising cookies or third-party analytics trackers in the product. We collect only the data necessary to provide authentication, challenges, forums, and related features. Infrastructure providers used for DNS, CDN, and security (such as Cloudflare) may set their own cookies or process technical data under their own policies; Hack n Roll does not control that processing. See our Cookie Policy.

2. Data We Collect

Depending on how you use the Platform, we may process the following categories of personal data:

• Account data: username, email address, and password hash (stored using argon2; we never store plaintext passwords).
• Authentication data: HttpOnly session cookies (access_token and refresh_token). See Cookie Policy.
• Challenge activity: flag submissions, solve records, and related metadata such as timestamps.
• Forum content: posts, threads, and other material you submit in community areas.
• Technical data: IP address and user-agent when collected by our infrastructure or by infrastructure providers we use (for example, Cloudflare for DNS, CDN, and security), under that provider's own processing.
• Policy acceptance: audit trail of accepted Terms of Use and Privacy Policy versions (policy, version, timestamp, IP address, and user-agent). See Data Retention for how long we keep these records.
• Email delivery metadata: messages sent through Resend for account verification, password reset, and other transactional emails.

We do not collect payment information. The Platform is free to use. We do not run advertising or behavioral analytics in the product.

3. How We Use Data

We use personal data to operate and improve the Platform, including:

• Creating and managing your account and authentication sessions.
• Delivering challenges, recording solves, and maintaining leaderboards.
• Hosting forum discussions and enforcing Community Guidelines.
• Sending transactional emails (verification, password reset, security notices).
• Protecting the Platform against abuse, fraud, and security threats.
• Complying with legal obligations and responding to lawful requests.

4. User-Generated Content

Forum posts, tutorials, articles, comments, and other community contributions remain the intellectual property of their authors.

By publishing such content on Hack n Roll, you grant Hack n Roll a worldwide, non-exclusive, royalty-free, and perpetual license to host, display, distribute, archive, and otherwise use that content as needed to operate and improve the Platform. See our Terms of Use.

Hack n Roll may continue hosting and displaying content that remains on the Platform after account deletion or anonymization, as described in Data Retention. Authors remain free to publish the same content elsewhere. This license does not transfer ownership.

Community-submitted CTF challenges are not covered by this section. They are governed by the Terms of Use.

5. Legal Bases for Processing

Where LGPD or GDPR applies, we rely on the following legal bases as appropriate:

• Contract: processing necessary to provide the services you request when you register and use the Platform.
• Legitimate interests: security, abuse prevention, and maintaining platform integrity, balanced against your rights.
• Consent: where required for specific processing activities; you may withdraw consent where applicable.
• Legal obligation: when we must retain or disclose data to comply with applicable law.

6. Service Providers and International Transfers

We use trusted third-party processors to operate the Platform. Your data may be processed outside Brazil, including in the United States, as necessary to provide the service:

• Vercel: frontend hosting and delivery.
• Cloudflare: DNS, CDN, and security services. When traffic is routed through Cloudflare, that provider processes technical data under its own policies; Hack n Roll does not control Cloudflare's processing.
• Resend: transactional email delivery.
• Amazon Web Services (AWS): backend infrastructure, application hosting, storage, and database hosting in the United States.

Hack n Roll shares only the minimum personal data necessary for each service provider to perform its services. When data is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place, consistent with applicable data protection requirements.

We may replace or add service providers from time to time. We will update this policy when changes materially affect how personal data is processed.

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Retention periods vary by data type. For a detailed breakdown, see our Data Retention policy.

Some data (such as forum discussions and moderation logs) may be retained after account deletion when necessary to preserve platform integrity, security, historical accuracy, or to comply with legal obligations. Personal identifiers on retained forum content and moderation records are anonymized as "Deleted User". Challenge progress, submissions, and other user-owned challenge data are permanently deleted with your account.

You may close your account at any time from your account settings, or contact privacy@hacknroll.dev for assistance. Account deletion is permanent: your identity, credentials, sessions, and challenge data are hard-deleted. Forum posts and comments remain visible with the anonymized author label "Deleted User".

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you, including your policy acceptance records.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your data, subject to legal and operational requirements.
• Restriction: request that we limit processing in certain circumstances.
• Portability: request your data in a structured, commonly used format where applicable.
• Objection: object to processing based on legitimate interests, where applicable.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise these rights, contact privacy@hacknroll.dev. We will respond within the timeframes required by applicable law. You may also lodge a complaint with your local data protection authority.

9. Security

We implement technical and organizational measures to protect personal data, including password hashing with argon2, HttpOnly authentication cookies, and infrastructure-level protections through providers such as Cloudflare and AWS (each under their own terms). For more detail, see our Security page.

If you discover a security vulnerability, please report it through our Responsible Disclosure process rather than exploiting it. No security measure is completely secure, and we cannot guarantee absolute security of personal data.

10. Children and Minors

The Platform is available to users aged 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered, please contact us so we can take appropriate action.

Where local law requires parental or guardian consent for minors, that consent must be obtained before use.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Legal documents are versioned, and changes are reflected in the "Last updated" date and version shown on this page. Hack n Roll records the version of legal documents accepted by each user.

Legal documents are versioned. Material changes may require renewed acceptance before you continue using some or all Platform features. Minor editorial or non-material changes do not require renewed acceptance. We encourage you to review this policy periodically.

12. Contact

For privacy-related questions, data subject requests, or concerns about this policy, contact privacy@hacknroll.dev.