Privacy Policy

1. Introduction

Welcome to Play CTF (playctf.in), operated by HackerHub8 LLP ("we," "our," or "us"). Play CTF is a dedicated non-profit platform built to foster cybersecurity education, facilitate hands-on skill development, and provide a competitive environment where individuals can showcase their technical expertise.

We are deeply committed to protecting your personal data, respecting your privacy, and maintaining the highest standards of digital security. This Privacy Policy comprehensively explains how we collect, use, process, and protect your personal information when you access our Capture The Flag (CTF) platform, forums, donation portals, and educational services.

This policy is designed in strict compliance with the Digital Personal Data Protection (DPDP) Act, 2023, the Information Technology Act, 2000 (including the SPDI Rules, 2011), and applicable global data protection frameworks. By registering an account, utilizing our training resources, or making a donation, you acknowledge and consent to the data practices described in this document.

2. Information We Collect

To provide a secure, competitive, and legally compliant educational environment, we collect specific categories of data (Data Principal information).

A. Account, Profile & Skill Showcase Information

To help you build a portfolio and showcase your skills to the community and potential employers, we collect:

• Your chosen username, email address, and securely hashed passwords.
• OAuth provider details and OAuth IDs, if you choose to authenticate via third-party services.
• Optional public profile details intended for skill showcasing, including your full name, biography, nationality, and avatar.
• Optional professional and social links, specifically URLs for GitHub, LinkedIn, Twitter, and personal portfolios.

B. KYC & Identity Verification Data (Sensitive Personal Data)

To verify user identities, prevent platform abuse, and ensure a safe environment for all participants, we collect sensitive documentation during the KYC process:

• Your first name, middle name, last name, and full legal name exactly as it appears on your government document.
• Your contact number and email address.
• Government-issued ID types, specifically limited to passports, national IDs, or driving licenses.
• The ISO 2-letter country code that issued your identification document.

Note: This data is securely stored, accessible only to authorized reviewers, and is never displayed publicly.

C. Donation & Financial Information

As a non-profit platform, Play CTF relies on community support. When you use our donation function, we collect:

• Basic billing information (e.g., name and email) to issue receipts and acknowledge your contribution.

Note: All financial transactions are processed securely by third-party payment gateways (razorpay). We do not store your credit card numbers, UPI PINs, or raw banking credentials on our servers.

D. Technical & Activity Data

We automatically log platform interactions to ensure fair play, monitor security, and validate the skills you are showcasing:

• IP addresses associated with your account actions.
• Detailed timestamps of your logins, logouts, password resets, and account registrations.
• Gameplay metrics, including exact flags submitted (both correct and incorrect), challenge solve times, points awarded, and rank positions.
• Social and collaborative actions, such as creating or joining teams, creating forum topics, and replying to forum posts.

E. User-Generated Content

• Custom CTF challenges created and submitted by users for approval to test the community.
• Grievances, reports of cheating, or abuse submitted to our administration team.

3. How We Use Your Data

We process your data strictly for legitimate business purposes and to ensure the operational integrity of the Play CTF platform:

• Skill Development & Platform Operation: To manage accounts, calculate team points, update leaderboards, and award achievement badges, allowing you to verifiably showcase your progression.
• Identity & Security (KYC): To verify user identities, prevent platform abuse, and maintain a legally compliant environment for cybersecurity training.
• Donation Processing: To facilitate voluntary financial contributions, issue tax-compliant receipts, and (with your permission) publicly acknowledge your support on the platform.
• Anti-Cheating Enforcement: To actively monitor IP addresses, submission metadata, and activity logs to detect, investigate, and penalize cheating or account sharing, thereby protecting the integrity of everyone's skill metrics.
• Communication: To send platform announcements, security alerts, password reset tokens, and newsletters to opted-in subscribers.

4. Legal Basis for Processing (DPDP Act, 2023)

We process your personal data based on the following legal grounds:

• Explicit Consent: You provide informed and explicit consent when registering for an account, submitting KYC documentation, or making a donation.
• Legitimate Purpose: For the continuous operation, security monitoring, and improvement of our non-profit educational platform.
• Legal Obligation: To comply with Indian cybersecurity laws, IT Act mandates, and lawful requests from regulatory bodies (such as CERT-In).

5. Data Sharing and Non-Disclosure

Play CTF operates strictly as a non-profit entity and absolutely prohibits the sale of your personal data. We are deeply committed to operational security and adhere to a strict policy of non-disclosure regarding sensitive information:

• Zero Disclosure of Sensitive Security Data: We do not disclose our internal security mechanisms, your password hashes, or your raw KYC documentation to any unauthorized external parties, marketers, or third-party vendors.
• Authorized Internal Access: KYC documents and abuse reports are accessible only to authorized administrators and moderators for the explicit purpose of platform governance.
• Third-Party Payment Processors: Your payment details are shared solely with secure, legally compliant payment gateways strictly for processing your voluntary donations.
• Legal & Regulatory Authorities: We will only share specific data if legally compelled by a court order, law enforcement agency, or government mandate.
• Public Display: To aid in your professional networking and skill showcasing, non-sensitive data—such as your username, avatar, nationality, earned badges, and team affiliation—will be publicly visible on platform leaderboards and forums.

6. Data Security Practices

As an organization grounded in cybersecurity education, we implement rigorous security practices and procedures (RSPP) to safeguard your data:

• Cryptographic Protection: All user passwords are encrypted using advanced, industry-standard cryptographic hashing algorithms before being stored in our database.
• Secure File Storage: KYC documents and sensitive uploads are stored using randomized, obfuscated filenames to prevent unauthorized direct access or enumeration.
• Continuous Auditing: We maintain comprehensive, tamper-evident activity logs tracking all critical platform actions (such as logins, privilege changes, and flag submissions) to rapidly detect and mitigate anomalous behavior.

7. Data Retention

• Account Data: Retained for as long as your account remains active on the platform.
• KYC Documents: Retained only for the duration necessary to verify your account or as legally mandated, after which they are securely purged from our systems.
• Donation Records: Retained for the statutory period required by Indian tax and accounting laws.
• Activity Logs: Retained for security auditing, forensic analysis, and anti-cheat verification in accordance with applicable cybersecurity compliance frameworks.

8. Your Rights as a Data Principal

Under the DPDP Act, 2023, you hold the following statutory rights regarding your personal data:

• Right to Access & Information: You may request a comprehensive summary of the personal data we hold about you.
• Right to Correction & Erasure: You may request the correction of inaccurate or incomplete profile data, or request the permanent deletion of your account and associated data (subject to overriding legal retention requirements for financial transactions or abuse logs).
• Right to Withdraw Consent: You may withdraw your consent for data processing at any time. Please note that withdrawing consent for core account data or KYC verification will result in immediate account suspension or termination.
• Right to Nominate: You possess the right to nominate another individual to exercise your data rights in the event of death or physical incapacity.

9. Governing Law & Dispute Resolution

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes, controversies, or claims arising out of this policy shall be subject to the exclusive jurisdiction of the competent courts located in Bengaluru, Karnataka, India.

10. Contact Us & Grievance Redressal

In accordance with the IT Act, 2000 and the DPDP Act, 2023, if you have any questions, wish to report a privacy concern, or want to exercise your rights as a Data Principal, please contact our designated Grievance Officer:

Play CTF (HackerHub8 LLP)
Bengaluru, Karnataka, India
Email: [email protected]

(Please allow our security and compliance team up to 72 hours to formally acknowledge your request).