Legal

Privacy Policy

Last updated: 6 September 2026

This policy describes our current data practices in plain language. It is provided for transparency and is not a substitute for independent legal advice for your specific jurisdiction or use case.

1. What we collect

  • Account information: your email address, display name, and password (stored as a salted hash by our authentication provider — we never see or store your plaintext password).
  • Assessment responses: your self-reported answers to the cyber hygiene assessment, and the score derived from them.
  • Usage data: mission progress, streaks, points, and badges earned within the product.
  • Contact and newsletter data: if you use the contact form or subscribe to our newsletter, we store the email address and message you provide.

2. What we do not collect

  • We do not scan your devices, install any agent or extension, or request your real passwords, MFA codes, private keys, or credentials for any of your other accounts.
  • The product is an educational self-assessment — it evaluates your reported habits and knowledge, not the technical state of your systems.

3. How we use your data

  • To provide the assessment, dashboard, missions, and passport features you sign up for.
  • To send you account-related emails (password resets, email confirmation) and, if you opt in, occasional product or threat-awareness updates.
  • To compute aggregate, de-identified statistics for organizations that invite their team — individual scores and answers are never shared with an employer or team admin.

4. Data sharing

  • We do not sell your personal data. We use Supabase (a third-party database and authentication provider) to host our application data, and Vercel to host and run the application — both act as data processors under our instruction.
  • We do not share individual assessment answers or scores with any third party, employer, or organization admin.

5. Data retention and deletion

  • We retain your account data for as long as your account is active.
  • You can request deletion of your account and associated data at any time from Settings, or by contacting us. We will delete or anonymize your data within a reasonable timeframe, except where retention is required by law.

6. Your rights

  • Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent for optional processing (such as marketing emails) at any time.
  • To exercise any of these rights, use the controls in your account Settings or contact us using the details below.

7. Cookies

  • We use a small number of strictly necessary cookies to keep you signed in and to protect your session. We do not use third-party advertising or tracking cookies.

8. Contact

  • Questions about this policy or your data can be sent through our contact page.