flagPrivacy Statement

CMU appreciates your interest in the picoCTF Services (as the term “Services” is defined in our Terms of Use). We have posted this privacy statement (“Privacy Statement”) to inform you of our practices for handling data collected online by Carnegie Mellon University (“CMU”) through the Services. This Privacy Statement states CMU’s privacy practices solely with respect to information collected by it online via the Services, and it does not apply to information collected via other mechanisms and/or by other departments or areas of CMU. By using the Services, you are indicating your assent to the Privacy Statement described here. This Privacy Statement is incorporated into and subject to the terms of the picoCTF Terms of Use.


Modification of Privacy Statement.

CMU shall have the right to modify this Privacy Statement at any time, which modification shall be effective immediately upon posting. Accordingly, we suggest that you check this page periodically. To make your periodic review more convenient, we will post a date at the bottom of this page.

Collecting Site Visitor Information (including use of Cookies and Web Beacons)

A cookie is a small text file containing information that a web site transfers to your computer for recordkeeping purposes. Cookies are used for running the Services, and are used to track you within the Services. A web beacon is a transparent, 1-pixel image in .gif format that helps us collect data about visitors viewing a web page – for example, to count the number of visitors to a page or to deliver a cookie to visitors’ browsers when they view that page. We may use web beacons on the Services from time to time for these and other purposes. When you visit the Services or click on internal links within the Services, we may collect information through technologies such as cookies and beacons. By using the Services, you consent to any such collection and use of this information as described in this Privacy Statement.

We use the information we gather to, among other things, help us improve our understanding of how visitors use the Services, measure interest in various pages, improve the Services’ content and usability, monitor the level of activity on the Services, and run the Services more efficiently. We may also use such information for other purposes, including as a way to gather broad demographic information, to enhance users’ experience on our Services, or to better prepare future content based on the interests of the users of our Services. However, we are not using these technologies to monitor or track you for advertising purposes.

Use of these Technologies by Authorized Third Party Service Providers and Integrated Services.

As described in our Terms of Use, we may be working with Third Party Providers (as defined in the Terms of Use) with respect to the Services. In addition, CMU and/or those Party Providers may be using Third Party Integrated Services (as defined in the Terms of Use) in connection with the Services. Use of these Third Party Providers and Third Party Integrated Services may help us to provide you with a better, faster and/or safer experience. Those Third Party Providers and/or Third Party Integrated Services may place third-party cookies, web beacons, or similar technologies for storing information in our Services. These Third Party Providers and/or Third Party Integrated Services may use these technologies to help us deliver the Services and/or to compile anonymous site metrics and analytics.

Collecting Your Personal Information

In order for you to register to access picoCTF materials, participate in picoCTF competitions, or access or use certain parts of the Services, we may require you (or someone with a relationship to you, such as parent/child or teacher/student) to provide us with information that personally identifies you. This information may include, without limitation, contact data like your name, your selected username, and your email address. If the account registration is being done on behalf of an individual under 18 years of age, we may require the parent or legal guardian to provide specific contact information (such as an email address) to signify their approval of the account registration on behalf of their minor child. If you register to use certain Services, communicate with us by e-mail through any links on the Services, or otherwise complete online forms or otherwise submit information through the Services, any information provided in such communication may be collected. CMU may receive such information directly from you and/or through others involved in the Services (such as from Third Party Providers, Third Party Integrated Services, parents, teachers and/or other Services users).

Choice Regarding Collection of Personal Information

You may choose not to provide any individually-identifiable information. In such an event, you may not be able to complete a registration for picoCTF or access or use those portions of our Services that require you to have completed registration or otherwise to have provided such individually-identifiable information.

How We Use and Share Information Collected

We will use information collected from you to, among other things: enable your use of the Services, providing information to you about picoCTF and CMU’s other activities and/or offerings, and/or to contact you when necessary. These uses further include but are not limited to: tracking your performance in any picoCTF competitions; contacting you and others as contemplated under the Terms of Use; and monitoring and ensuring your compliance with the Terms of Use (including but not limited to verifying your registration for yourself or on behalf of a minor child); monitoring your picoCTF activities and displaying information any competition or leaderboards as provided in any competition rules). We may also use and share your information with third parties as needed for purposes of any competition in which you are participating (which could include, but is not limited to, communicating with your school and other members on your team).

In the event that some of CMU’s assets and/or information are sold or transferred or used as security, the information collected through our Services may be transferred to third parties as part of that transaction.

CMU may also provide such information or provide access to such information to any of our affiliates, licensors, content providers, contractors (including but not limited to Third Party Providers) and sponsors.

CMU may use your information to reply to you and send information to you. CMU also may provide aggregated information received from Services users to third parties.

Regarding any of your personally identifiable information collected by CMU through the Services, CMU will not sell or rent such personally identifiable information to third parties for the third parties’ commercial marketing purposes.

If CMU is requested by law enforcement officials or judicial authorities to provide information on individual users, we may, without your consent, provide such information. In any matters involving claims of personal or public safety (as determined by CMU in its sole discretion) CMU may provide your personal information to appropriate authorities without your consent or court process. CMU may also use your information to enforce CMU’s rights, intellectual property or other property, including but not limited to enforcing the Terms of Use.

CMU does not intend to reveal your personally-identifiable information to third parties except in the ways described in this Privacy Statement.

Your Ability to Access, Update and Correct Personal Information

If you do not want to receive email or other mail from us or if you wish to check the personal information that we have about you (or, if applicable, about your minor child) at CMU that was collected through the Services, please email us at other@picoctf.com. As permitted under applicable law, we may retain in our files information you have requested to remove in some circumstances, such as to resolve disputes, troubleshoot problems and/or enforce our Terms of Use. In addition, although we will take reasonable steps to honor your request, there may be situations where certain prior information is never completely removed from our databases due to technical constraints and the fact that we back up our systems.

Children’s Privacy

Protecting children’s privacy is extremely important to us. Our Services are not intended for the use of or designed to attract the attention of children. The Services are available only to those 13 or older, and any user under 18 must have parental consent. We do not collect personal information from anyone we know to be under age 13, and children under 13 should not send us any information. If you believe your child under 13 has registered for Services or provided us with information through the Services, please email us at other@picoctf.com and we will use reasonable efforts to delete their account and remove their information, subject to the limitations stated above.

Other Sites

Links to third-party web sites may appear on some pages within the Services for your convenience and information. Using these links will cause you to access web sites that are not part of the Services. We suggest that you carefully review the privacy policies of each site you visit. In addition, although you may be registering for a picoCTF account through a Third Party Provider (such as Amazon Web Services) and/or using your Google, Facebook or Twitter account as your login credentials for picoCTF, CMU does not operate or control those third party services. You should review the privacy policies and privacy settings on such services before deciding to use them for your registration and account services.

Please direct your questions or comments regarding this Privacy Statement to other@picoctf.com.

August 29, 2018 version