Privacy

Version 1.0. Effective date: 9 November 2026. Written 7 November 2026. This notice applies to lab.sectratek.com and covers visitors in the United States.

At a glance

Your challenge progress stays in your browser. Nothing leaves it unless you send the optional form. You can see, fix or delete what we hold by writing to us.

Reading the site

The public pages set no cookies and load nothing from other sites. Fonts, scripts and images all come from this site. We run no analytics script.

Your browser keeps a few choices on your own device, in local storage: your theme (light or dark), your reduced-motion choice, and your challenge progress. Progress includes the answers you typed, the hints you opened and, if you sent the optional form, the id of that entry. None of it is sent to us on its own: the only thing sent is the id, and only when you press Delete my answers. You can clear all of it in your browser settings.

Like any website, our hosting service records each request in an access log. See Server logs.

Challenges and answer checking

Challenges are always open and need no account. Your points, badges and hints used stay in your browser. Clear your browser data and they are gone.

What is sent. When you press Check, the page sends your answers for that challenge to the Lab’s server. It sends no name, no email and no identifier. The reply says which answers are right, your score and, for a wrong answer, a hint. We do not keep a record of your answers in the Lab’s tables, and we do not write request contents to logs.

Rate limits. To stop abuse, the server counts requests per network. It does this with a salted hash of your network address. The salt changes every day, so a hash cannot be followed from one day to the next. The hash is deleted after one day. The Lab’s tables never hold your raw address. The hosting service also runs its own rate rule, which counts requests per address for a few minutes.

The optional participant form

After a challenge, and on the About you page, you can tell us a little about yourself. It is optional. Nothing is sent until you press the send button.

Why. To learn who uses the challenges, so we can improve them. The form stores no name, no address and no network data. Your email is never stored with your form entry. It is used only for the newsletter, and only if you tick that box.

How long. A form entry is kept for up to 24 months, then deleted.

Delete it. After you send the form, the page shows an id. Keep it. Press Delete my answers on that page, or send us the id, and the entry is removed. The id is the only key, so we cannot find an entry without it. Deleting does not cancel a confirmed newsletter subscription. Use the unsubscribe link for that. A newsletter request that you had not yet confirmed is withdrawn.

Newsletter

The newsletter is a separate choice. The box is unticked, and the form works without it. Sending the form or checking an answer never subscribes you.

• Double opt-in. If you tick the box and give an email, we send one message with a confirm link. You are subscribed only when you open the link and press the confirm button. If you never do, we delete the request after 7 days.
• What we store. Your email, the topic, and when and on which wording you agreed.
• What we send. A welcome message, then Lab publications and SectraTEK news. We expect a few a year.
• Unsubscribe. You can withdraw your consent at any time. Every message has an unsubscribe link, and one press removes you. We then keep only a minimal record so we do not write to you again.
• Your choice. Nothing on the site depends on the newsletter, and you lose nothing by leaving it unticked.
• Sender. Messages come from the SectraTEK newsletter address, sent through Amazon Web Services. Every message carries our postal address (Prudential Associates & Cyber-Investigations Group, 9200 Corporate Blvd, Suite 200, Rockville, MD 20850, United States).

Dataset downloads and other sites

The Lab’s datasets are served from this site. A download is a request like any other, so it appears in the server logs for the period given there. We keep no separate list of who downloaded what, and the datasets need no account or form.

Some pages link to public projects on GitHub and to other sites. When you follow such a link, you leave this site and the other site’s own notice applies, for example GitHub’s privacy statement.

Ask the Lab

When you send a question, we store the topic, your question, the name and email address if you gave them, whether you chose a public or a private answer, a reference number and the time. The form stores no IP address. Your question reaches a staff inbox by email, and a person reads it. We use your email address only to reply.

Send words only: no case data and no details about other people. If a question holds them, we delete it. If you choose a public answer, we publish the question and answer after removing anything identifying, and we credit you only if you ask. A private answer is never published. The form uses a hidden field, a minimum fill time and rate limits, and no CAPTCHA service.

Server logs

The hosting service (Amazon Web Services) logs each request to the site. It keeps two kinds of log. An access log line holds the time, your full IP address, the page requested including anything after a question mark, the result and your browser type. Access logs are kept 30 days. A separate security log from the site’s firewall holds the time, your full IP address, the page requested, the result and your browser type, but not anything after a question mark. Security logs are kept 3 months.

The Lab’s own server also writes a log. It holds the kind of request (never the query or the content), the result and your IP address cut to a network prefix (the last part removed, a /24 prefix for IPv4). Those logs are kept 3 months. The Lab’s own tables hold no IP address.

Two links carry a token in the address: the newsletter confirm link and the unsubscribe link. The token stays in the access logs for 30 days. A token alone cannot confirm anything, because confirming needs a button press.

We use logs to keep the site running and to stop abuse. When a log period ends, the log is deleted.

Do Not Track and Global Privacy Control. The site sets no cookies and runs no tracking, so there is nothing to switch off. We treat a Do Not Track or Global Privacy Control signal from your browser as a request not to sell or share your data, which we do not do in any case.

Who sees your data

A small team at the Lab sees what you send. Staff sign in with a password and a one-time code. Amazon Web Services hosts the site and sends our email, and processes data only for us. We also share data if the law requires it, or to stop fraud or abuse. We do not sell it. Servers are in the United States, and the Lab serves US visitors only.

Links to other sites, including SectraTEK.com, leave this site, and those sites have their own notices.

How we protect it

Pages and forms use HTTPS. Stored data sits in private storage. Each person on staff gets only the access they need, and publishing actions are logged. No system is perfectly safe. If a breach affects you, we will tell you as the law requires.

How long we keep it

When a period ends, we delete the data or remove what identifies you. Backups drop deleted data within 35 days.

Your rights

You can ask us to:

• tell you what we hold about you, and give you a copy;
• correct it;
• delete it.

Deleting your form entry needs only the id the page showed you. For anything else, we may ask you to write from the email address we hold. We offer these rights to every visitor in the United States, whatever your state. We do not sell or share personal data, so there is nothing to opt out of. We never treat you worse for asking. An agent can ask for you with your written permission.

How to ask. Use Contact or write to the research address.

How fast. We confirm receipt within 10 business days and answer within 45 days. If we need more time, we say why. If we decline, we explain why and how to appeal.

Children

This site is not directed to children under 13, and we do not knowingly collect their personal information. The participant form and the newsletter are for people 16 and older. If you think a child has given us data, tell us and we will delete it.

Changes to this notice

We date every version. For a material change, we post the new text 14 days before it applies and, for newsletter members, tell them by email. Older versions are available on request.

Contact

Write to research@sectratek.com, or use Contact. Postal address: Prudential Associates & Cyber-Investigations Group, 9200 Corporate Blvd, Suite 200, Rockville, MD 20850, United States.