Privacy policy

Last updated 30 October 2026

Short version: we only collect what we need to run accounts, the leaderboard and moderation. We don't collect or store IP addresses. No email is required, there are no ads, no analytics and no tracking, and we never sell your data.

What we collect

Your account

• Username and password. Passwords are stored as a one-way hash (bcrypt), so nobody — including us — can read them.
• When your account was created and when you were last active.

Discord, if you use it

If you log in with or link Discord, we store your Discord user ID and Discord username. We only ask Discord for the basic identify permission: we never see your email, servers, friends or messages.

Login records

Each time you log in we record the time, the login method and your browser's user-agent (e.g. "Chrome on Windows"). We use these to keep accounts secure and to look into appeals. We don't record your IP address.

Gameplay

The runs you play, the flags you place on each clip and your scores.

Messages you send us

If you use the contact form we store what you write, any name, email or Discord username you give, and which account you were logged into (if any).

Moderation

Admins can add notes to an account and record a reason when they suspend one. Admin actions are kept in an internal audit log.

IP addresses

Your browser has to send your IP address to reach the site, but HackTrainer doesn't save it anywhere: not with your account, your logins or your messages, and not in our database or server logs. To stop people spamming logins and the contact form, the site counts recent attempts per connection in temporary memory, using a scrambled one-way code instead of the IP itself. Those counts are thrown away after an hour at most, and whenever the server restarts.

What's public

Your username, scores, rank, stats and recent runs are public: they appear on the leaderboard, on your profile page (/profile/<username>) and through the HackTrainer Discord bot's /profile and /leaderboard commands. Everything else above is private.

Who can see the private parts

• Site admins, depending on their permissions. Only admins with extra access can see login history.
• Our hosting and database providers, who store the data on our behalf.
• Authorities, only if we are legally required to share it.

We don't sell, rent or trade personal data, and we don't share it with advertisers.

Cookies

We use a single cookie, ht.sid, which keeps you logged in. It's only set when you log in, lasts up to 30 days and is strictly necessary for accounts to work, so there's no cookie banner. We use no analytics or advertising cookies.

Third-party services

• Google Fonts — the site's fonts load from Google, which receives your IP address when they download. See Google's privacy policy.
• YouTube — some clips are YouTube videos embedded in the page. When one loads, YouTube may set its own cookies and collect data under Google's privacy policy.
• Discord — if you log in with Discord or use our bot, Discord's privacy policy applies to what happens on Discord's side.

How long we keep it

Account, gameplay and login data are kept for as long as your account exists. When an account is deleted, its profile, runs and login records are deleted with it. Audit log entries may still mention the username. Contact messages are kept until we've dealt with them and may be kept afterwards as a record; you can ask us to delete them.

Your rights

You can ask us to show you the data we hold about you, correct it, delete your account and data, or object to how we use it. Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you may have further rights, including complaining to your local data protection authority.

To make a request, send us a privacy request while logged into the account in question. We may need to confirm the account is yours before acting on it.

We process your data because it's needed to provide the service you signed up for, and in our legitimate interest of keeping the game fair and secure.

Children

HackTrainer isn't meant for children under 13 (or the minimum age for online services in your country), and they shouldn't create an account. If you're a parent or guardian and think your child has signed up, contact us and we'll delete the account.

Security

Passwords are hashed, login cookies are HTTP-only, and access to private data is limited to admins who need it. No system is perfectly secure, so please use a password you don't use anywhere else.

Where data is stored

Data is stored on servers run by our hosting provider, which may be in a different country from you.

Changes

If we change this policy we'll update the date at the top, and for big changes we'll post an announcement on the site.

Contact

Questions about this policy? Get in touch.