Resources

Privacy policy

Last updated October 16, 2026

What personal data root-me.cloud stores, why, who can see it, how long we keep it, and how to exercise your rights. The short version: we keep what the platform needs to work, we publish only what you or the disclosure process make public, and we do not track you.

On this page

1.Who we are
2.What we store
3.What is public
4.Cookies
5.Who we share it with
6.How long we keep it
7.Deleting your account
8.Your rights
9.Security
10.Children
11.Changes

1.Who we are

root-me.cloud operates this bug bounty and vulnerability disclosure platform and its capture-the-flag event. We are responsible for the personal data described here. You can reach us about privacy at the platform team.

2.What we store

Data	What it includes	Why
Account	Username, email address and a salted hash of your password (never the password itself), role and account status.	To create your account, sign you in and protect it.
Profile (optional)	Display name, bio, website, country, affiliation, GitHub and X handles.	To show on your public profile, if you choose to fill them in.
Reports and activity	Reports you submit, comments, votes on Hacktivity, and the history of each report (state, severity, rewards, disclosure).	To run the report workflow, compute reputation and publish what both sides agree to disclose.
CTF activity	Your team, flag submissions, solves and hints you unlocked.	To run the capture-the-flag event and its scoreboard.
Sessions	For each signed-in device: a hash of the session token, the IP address and browser user agent at sign-in, and the expiry date.	To keep you signed in, show and revoke your sessions, and detect account abuse.
Rate limits	Short-lived counters keyed by IP address or account, for example for sign-in attempts and new reports.	To protect accounts against password guessing and the platform against spam.

We do not use advertising or analytics trackers, and we do not buy data about you. Our hosting provider processes technical request logs, including IP addresses, to deliver and secure the service.

3.What is public

Some of what you do here is public by design:

your username, the profile fields you fill in, your reputation, signal, impact and rank;
the programs that thanked you, and Hacktivity entries for your resolved reports (program and date only);
reports that you and the program agreed to disclose, in full or limited form.

Your email address is never shown publicly. Reports that are not disclosed are visible only to you and the program team, as described in the disclosure guidelines.

4.Cookies

We set one cookie, ctf_session, when you sign in. It is strictly necessary: it holds a random token that identifies your session, cannot be read by scripts, and expires after 30 days or when you sign out. We set no other cookies, which is why we do not ask for consent.

The CTF remembers a few display preferences, such as which announcements you have already read, in your browser’s local storage. They stay on your device and are never sent to us.

Program teams see the reports you submit to their program, the comments in them, your username and your public profile. On root-me.cloud, program teams are part of the platform staff.
Service providers that host the application and its database process data on our behalf, under contracts that limit its use to providing the service.
Authorities, when the law requires it, or when it is necessary to protect people or the service from serious harm.

We do not sell personal data or share it for advertising.

6.How long we keep it

Data	Kept for
Account, profile, reports and CTF activity	As long as the account exists.
Sessions	Until you sign out, or 30 days after sign-in at most.
Rate-limit counters	About one day after the last attempt.
Hosting request logs	The retention period of our hosting provider, typically a few days to weeks.

7.Deleting your account

Ask us at the platform team to delete your account. Deletion removes your profile, sessions, votes, CTF activity and the reports you submitted, including disclosed ones. Comments you left on other people’s reports remain, but no longer show your name.

Program teams may keep copies of report content they needed to fix an issue, under their own policies. We may keep the minimum needed to meet legal obligations or to prevent a banned person from returning.

8.Your rights

Depending on where you live, you may have the right to access the data we hold about you, to correct it, to have it deleted, to restrict or object to its use, and to receive a copy in a portable format. You can update most profile data yourself in your settings; for everything else, contact the platform team. We answer within one month.

We process your data to provide the service you signed up for, to keep it secure, and to meet legal obligations. If you think we have not handled your data properly, tell us first; you can also complain to your local data protection authority.

9.Security

Passwords are hashed, session tokens are stored only as hashes, and access to reports is checked on every request. If you find a vulnerability in root-me.cloud itself, please report it privately to the platform team and do not test beyond what is needed to show the issue.

10.Children

The service is not intended for anyone under 16, and we do not knowingly collect their data.

11.Changes

We will update this policy when what we collect or how we use it changes. The date at the top shows the latest version; significant changes are announced on the platform before they take effect.