Terms of use

By creating an account on Hackout CTF you agree to these terms and to the rules of each event you join.

• You use your own account and keep your password private. One account per person.
• You only attack the targets named in a challenge. Attacking the platform, its infrastructure or other participants is forbidden and leads to disqualification and removal of the account.
• The organizers may suspend accounts that break these terms or an event's rules.
• The platform is provided as is, for educational competitions. The organizers try to keep it available but cannot guarantee it is free of interruptions.

Privacy: what we collect and why

Who is responsible for your data: Asociația Hackout, contact: [email protected]. Hackout CTF is operated by Asociația Hackout.

What we collect when you register:

• full name, nickname, email address, phone number, age, sex;
• occupation, institution (school, university or company), county, city, experience level, how you heard about the event;
• the time you accepted these terms and the use of your data.

What the platform records while you play: the events you join and their status, your answers (we keep their length and whether they were correct, not the answer text), solved tasks and points, the reports you upload, and technical logs (pages visited, login attempts, IP address) used for security and to resolve disputes.

Why we use it:

• to run the events: check-in, the scoreboard, contacting you about the event, diplomas;
• your phone number is used only to contact the winners;
• for aggregated statistics about participants (for example how many students or which counties), which do not identify anyone;
• for security and to enforce the rules.

The legal basis is your consent, given at registration, and our legitimate interest in running the competition safely.

Who sees it:

• The public scoreboard shows only your nickname, points and ranking. Final rankings of past events stay visible in the archive, with nicknames only.
• Organizers of an event you join see your registration details, to check you in and contact you.
• Diplomas use your full name.
• Service providers that process data for us: Cloudflare (hosting of the platform), Google (the email service that sends our messages), and OpenAI, which grades the PDF reports you upload for report tasks. Reports are sent to OpenAI only to be graded. Do not put personal data you do not want to share in a report.
• Some of these providers are based in the United States, so your data may be processed outside the EEA under appropriate safeguards (such as the EU-US Data Privacy Framework or Standard Contractual Clauses).

How long we keep it: after each event, we delete your email, phone number and all other personal data within 30 days. We keep only aggregated statistics and the final results with nicknames. Participants under 16 are deleted completely after the event, including from the archive.

Your rights: you can ask to see, correct or delete your data, to restrict its use, or withdraw your consent, by emailing [email protected]. Withdrawing consent does not affect processing done before the withdrawal. You can also complain to the Romanian data protection authority (ANSPDCP, www.dataprotection.ro).

Cookies: the platform uses one session cookie, needed to keep you logged in. No advertising or tracking cookies.

Last updated: 28.10.2026.