Privacy Policy & Terms of Service

1. Information We Collect

1.1 Information You Provide

• Account Registration: Username, email address, password, country, skill level, and confirmation that you meet the applicable minimum age (13+ in most jurisdictions, 16+ in the EEA and UK).
• Profile Information (optional): Full name, date of birth, phone number, bio, avatar, profile banner, and social media links (GitHub, LinkedIn).
• Team Information (optional): Team bio, website, and social links (GitHub, LinkedIn, Twitter/X, Discord) when you create or manage a team.
• Business & Partnership Inquiries: Company or organization name, contact name, email, optional phone and website, service type, and message content when you submit a service inquiry on our public site.
• Learning Activity: Answers submitted to courses, labs, and event challenges.
• Communications: Messages sent through team features, direct contact with us, or support and security appeals.
• Bug Bounty Submissions: Vulnerability reports, proof-of-concept details, screenshots, attachments, and related communications you submit through the bug bounty program.
• Event Registrations: Name, email, and country when registering for events (may be collected from non-account holders).
• Job Applications & Recruiter Visibility: If you apply for a role or enable recruiter visibility, verified recruiter companies may view information such as your username, email, skill level, level, SOC XP, total XP, country, member-since date, courses and labs completed, and events participated, together with any additional application materials you choose to provide.
• Entity Workspaces: If an organization gives you an account in its entity workspace, we receive your email address and role from the organization’s invite, and collect the username, name, password, and optional phone, country, and bio you provide, together with your learning progress, assignment results, event participation, and activity in the workspace. We also record when you accept these Terms and this Privacy Policy, with your IP address and browser.
• Purchases & Billing: When you buy HFC packs or subscribe to HackFury Pro, we record purchase and subscription status, amounts, and related identifiers needed to fulfill and support the order. Card and wallet payment details are collected by Stripe on Stripe’s checkout pages, not by us.

1.2 Information We Collect Automatically

• IP Address: Collected at signup, login, and during event challenge submissions for security logging, fraud prevention, and anti-cheat enforcement.
• Country: Collected during account registration. May also be inferred from your IP address for security and anti-fraud purposes.
• User Agent: Browser and device information for security monitoring.
• Session Data: Authentication tokens stored in session cookies.
• Activity Logs: Page visits, feature usage, and action timestamps.
• Device Fingerprint: A hash of IP address and user agent used for security alert correlation. It is not used to build a profile of you and not used for cross-site tracking.
• Sponsorship counting token: A short-lived salted hash of your IP address and browser user agent, held only in temporary server memory for 15 minutes and then discarded. It exists so that refreshing a page is not counted as a second view of a sponsorship, and so the same sponsor stays visible while you move around the site. It is never written to our database, never linked to your account, and never shared with a sponsor.

1.3 Information From Third Parties

• Bot-protection service: We use a third-party CAPTCHA / bot-protection service on login, signup, password reset, and certain public registration forms to prevent automated abuse. The service may process your IP address, browser signals, and interaction data. See the provider’s privacy policy for details.
• IP reputation service: We query a third-party threat-intelligence API at signup, login, and certain security-sensitive actions. Only the IP address is sent.
• Email domain validation service: At signup we may query a third-party service to detect disposable, temporary, or high-risk email domains. Only the email address or domain is sent.
• Stripe (payment processor): We use Stripe to process HFC pack purchases, HackFury Pro subscriptions, and entity workspace subscriptions. Stripe collects payment card or wallet details on its hosted checkout. We receive customer, subscription, invoice, and payment status identifiers and amounts needed to credit HFC, grant Pro or workspace access, handle refunds, and provide receipts. See Stripe’s privacy policy for how Stripe processes payment data.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account, authenticate your identity, and provide the platform services.
• Track learning progress, issue certifications, calculate scores, XP, and leaderboard rankings.
• Administer cybersecurity events and competitions, including scoring, leaderboard management, and prize distribution.
• Detect and prevent cheating, fraud, abuse, and unauthorized access through our anti-cheat and threat detection systems.
• Send transactional emails (account verification, password resets, 2FA codes). Send optional product notifications about events, courses, labs, and messages when enabled in your account settings. Send marketing or newsletter emails only where you have separately opted in (we do not enroll you in marketing solely because you created an account).
• Process payments and manage virtual currency (HFC) balances.
• Facilitate the recruitment feature for users who opt in to recruiter visibility.
• Improve the platform, fix bugs, and conduct internal analytics.
• Comply with legal obligations and respond to lawful requests.

2.1 Email & Marketing Communications

• Transactional email (verification, password reset, security alerts, purchase receipts) is sent as part of providing the service and does not require separate marketing consent.
• Product notifications about events, courses, labs, or messages are controlled by the notification preferences in your account settings. You may disable each category at any time.
• Marketing and newsletter email is not sent solely because you created an account. Where we send promotional campaigns, they respect your notification preferences, include an unsubscribe link, and, where required by law, are sent only after you have provided affirmative opt-in consent.

2.2 Entity Workspaces

• If you use HackFury through an entity workspace, the organization that runs it decides who has access and how the workspace is used. For the workspace data it manages, the organization is the controller and we process that data on its behalf under the Entity Agreement.
• Administrators and managers of your workspace can see your workspace profile, group, learning progress, assignment completion, scores, event results, and activity and sign-in times. They can also assign you work and remove your access.
• For requests about workspace data (access, correction, or deletion), contact your organization first. If you contact us, we will pass the request to your organization and help it respond.
• We still process some workspace data as controller for our own purposes, namely security, fraud prevention, anti-cheat, billing, and legal compliance, as described in this policy.

3. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

Legitimate interest and your right to object: Where we rely on legitimate interest (for example security monitoring, anti-cheat, fraud prevention, or bot protection), we balance our interests against your rights. You may object to processing based on legitimate interest by contacting legal@hackfury.com. If you object to security or anti-cheat processing that is necessary to protect the platform and other users, we may be unable to continue providing competitions, scoring, or your account may be limited or closed where no reasonable alternative exists.

4. Cookies & Session Data

HackFury uses first-party session cookies for authentication and a third-party bot-protection service on certain public forms. The bot-protection service may set cookies or use browser storage as described by its provider. We do not set advertising, analytics, or cross-site behavioral tracking cookies ourselves. First-party sponsorship placements set no cookies at all. A placement that shows an ad network unit runs it inside an isolated frame, and the ad network may set cookies on its own domain there; see section 5. Ad network units are shown whether or not your browser sends a Global Privacy Control or similar opt-out signal; HackFury Pro members see none.

All HF_* session cookies are HttpOnly and Secure (HTTPS only). Portal (HF_PORTAL) uses SameSite=Lax so return trips from Stripe Checkout and similar top-level redirects keep you signed in; other panel sessions use SameSite=Strict. They end after about 24 hours of inactivity (sliding window). The bot-protection service is loaded from the provider’s domain; see the provider’s privacy policy for current cookie names and retention.

5. Third-Party Service Providers

We share limited personal information with service providers only where needed to host, secure, operate, communicate, or support the platform. We do not sell your personal information and do not use third-party analytics trackers on the platform. Where we send platform announcements or marketing communications, they are sent by us for our own services and not on behalf of unrelated third parties. We show paid sponsorship placements. Most are first-party: we host the sponsor's image and text ourselves and no sponsor code runs. Some placements show an ad network unit supplied by a sponsor. That unit runs only inside an isolated frame on our domain, never inside our pages. When it loads, the ad network receives your IP address and browser information and may set cookies on its own domain, and it may use them for advertising on other sites. California law can treat that as sharing for cross-context behavioral advertising. Ad network units fund the free platform, so they are shown to every visitor who sees sponsorship placements, including visitors whose browser sends the Global Privacy Control signal; we do not treat that signal as an opt-out from them. HackFury Pro members see no sponsorship placements. We disclose no account information to sponsors or ad networks, and a sponsor receives only aggregate daily view and click totals for its own placement.

The table below lists our primary subprocessors (service providers that process personal data on our behalf). We require them to protect your data under contract and only use it for the purposes described.

We review this subprocessor list at least annually and when we add or replace a material provider. A current summary is maintained on this page.

If you apply for a job or opt in to recruiter visibility, certain profile and application information may be disclosed to verified recruiter organizations that use corporate email domains and are contractually required to handle candidate information in accordance with applicable law, their agreement with us, these Terms, and this Privacy Policy. Those organizations are responsible for their own handling of the data they receive for recruitment purposes.

We do not automatically disclose your private bug bounty submissions or private program communications to third-party program owners unless a specific program flow expressly says so or disclosure is required by law. If you choose to communicate with a program owner through a provided channel, that communication is governed by the applicable program rules and the recipient's own obligations.

If you choose to visit our public social media pages through links we publish, those platforms may collect data under their own privacy notices. We do not use social media or ad-tech partners for cross-context behavioral advertising on HackFury.

6. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

When your account is deleted, we anonymize or remove personal data from the categories above except where retention is required by law, needed to resolve disputes, or necessary for security and fraud-prevention records. Deleted data may also remain in restricted-access backups for a limited period until normal backup rotation and overwrite cycles complete.

7. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All connections use TLS 1.2 or higher. Database connections are encrypted with mutual TLS.
• Encryption at rest: Sensitive settings and API keys are encrypted with AES-256-GCM.
• Password hashing: Passwords are hashed using bcrypt with unique salts. We never store plaintext passwords.
• Access controls: Role-based access (learner, author, partner, recruiter, admin) with separate session scopes per panel.
• CSRF protection: Token-based cross-site request forgery protection on all forms and state-changing actions.
• Input validation: Server-side sanitization of all user input; parameterized database queries to prevent SQL injection.
• Two-factor authentication: Optional TOTP-based 2FA for all user accounts.
• Audit logging: Security-sensitive actions are logged with IP address, user agent, and timestamp.

We may also use automated systems to detect suspicious activity, abuse, fraud, anti-cheat violations, and security anomalies in order to protect the platform and its users. No system is 100% secure. If you discover a vulnerability, please report it through our in-platform bug bounty program or contact us at bugbounty@hackfury.com (or security@cyndrion.com).

7.1 Automated Security Review & Anti-Cheat Decisions

To protect the integrity of the platform, events, labs, and community rankings, we may analyze account, submission, and activity data using automated tools designed to detect cheating, abuse, fraud, multi-account misuse, and other security anomalies. We do not publicly disclose the specific signals, thresholds, or logic used by these systems because doing so could undermine their effectiveness.

Where reasonably practicable, significant adverse actions such as score nullification, disqualification, suspension, or account bans are reviewed and confirmed by our security team and/or the relevant decision makers, such as event organizers, platform administrators, or designated staff, before final enforcement. You may appeal by emailing contact@hackfury.com or through our official Discord at https://discord.gg/EKAtgfKKCM. We aim to acknowledge appeals within 5 business days and provide an outcome within 30 days, subject to complexity and lawful exceptions.

7.2 Data Breach Notification

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities without undue delay and, where feasible, within 72 hours of becoming aware, as required by applicable law (including GDPR). Where the breach is likely to result in a high risk to you, we will also notify affected users without undue delay using email, an in-platform notice, or both, and describe the nature of the breach, likely consequences, and measures we are taking. We maintain internal procedures to detect, investigate, and respond to security incidents, and we will comply with applicable state breach-notification timelines where they apply.

8. Your Rights

8.1 GDPR Rights (EEA & UK Residents)

Under the General Data Protection Regulation, you have the right to:

To protect your account and the privacy of others, we may request reasonable identity verification before fulfilling a request. We generally respond to GDPR requests within one month, subject to lawful extensions and applicable exceptions.

• Access - Request a copy of the personal data we hold about you. You can download your data at any time from your account Settings > Security page using the Export data button.
• Rectification - Correct inaccurate or incomplete personal data. You can update your profile information at any time through your account settings.
• Erasure ("Right to be Forgotten") - Delete your account and personal data at any time from your account Settings > Security page, or by contacting us at legal@hackfury.com. We will process any manual requests within 30 days.
• Data Portability - Export your data in a machine-readable format (JSON) directly from your account Settings > Security page. The export includes your profile, scores, purchases, and activity history. You may also contact us at legal@hackfury.com for assistance.
• Restrict Processing - Request that we limit how we use your data in certain circumstances.
• Object - Object to processing based on legitimate interest, including security monitoring and anti-cheat analysis. You can opt out of non-essential product notifications in your account settings. To object to other legitimate-interest processing, contact legal@hackfury.com. See Section 3 for consequences where objection conflicts with platform security requirements.
• Withdraw Consent - Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Marketing and newsletter emails include an unsubscribe link; you may also manage product notification preferences in account settings.
• Lodge a Complaint - You may lodge a complaint with your local data protection authority if you believe our processing of your personal data violates applicable law.

8.2 Automated Decision-Making (GDPR Art. 22)

We may use automated processing, including profiling, to detect cheating, fraud, abuse, and security anomalies. Decisions that produce legal or similarly significant effects on you may include score nullification, event disqualification, reward forfeiture, suspension, or permanent account bans.

Where GDPR applies, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects, except where permitted by law (for example, where necessary for a contract, authorized by law, or based on your explicit consent). Significant enforcement actions are, where reasonably practicable, reviewed by a human before final application, as described in Section 7.1 and Terms of Service Section 8.

You may request human review, express your point of view, and contest an automated or automated-assisted decision by contacting legal@hackfury.com or appealing via the channels in Section 7.1. We aim to acknowledge such requests within 5 business days and respond within 30 days, subject to lawful extensions.

8.3 Privacy Contact & Data Protection Officer

Cyndrion LLC has not appointed a Data Protection Officer or an EU/UK representative under GDPR Article 27 based on our current scale and processing activities. For any privacy request or question, contact us at legal@hackfury.com or privacy@cyndrion.com. If our processing activities change materially, we will reassess whether such appointments are required and update this policy.

9. International Data Transfers

Cyndrion LLC is based in the United States. If you access the platform from outside the US, your data will be transferred to and processed in the United States. Our service providers may also process data in their respective locations. Where required, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to protect data transferred outside of the EEA/UK.

10. Children's Privacy

HackFury is not directed at children. We require users to be at least 13 years old to create an account in the United States and most jurisdictions. In the EEA and United Kingdom, you must be at least 16 years old to create an account unless verifiable parental or guardian consent is obtained where permitted by applicable law. If local law requires parental or guardian consent for a minor below the applicable minimum age, that consent must be obtained before use. We do not knowingly collect personal information from children below the applicable minimum age. If we become aware that such an account was created, we will promptly delete the account and associated data. If you believe a child has registered, please contact us at legal@hackfury.com.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) provides you with additional rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected, the sources, business purposes, and the categories of third parties or service providers to whom it was disclosed. You can download much of this information directly from your account Settings > Security page using the Export data button.
• Right to Delete: You may delete your account directly from your Settings > Security page, or request that we delete the personal information we have collected from you, subject to legal and operational exceptions.
• Right to Correct: You may request correction of inaccurate personal information and may update most profile data from your account settings.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information. Some sponsorship placements show an ad network unit; when it loads, the ad network receives your IP address and browser information, which may count as sharing for cross-context behavioral advertising. Ad network units fund the free platform and are shown regardless of the Global Privacy Control (GPC) signal. To use the platform without them, subscribe to HackFury Pro, which shows no sponsorship placements. First-party placements are not targeted using personal information: selection uses the page being viewed and, where our network provides it, the country of the request. We do not run ad-targeting analytics.
• Right to Limit the Use of Sensitive Personal Information: We do not use or disclose sensitive personal information to infer characteristics about you or for advertising, including for sponsorship selection. Where sensitive or security-related data is processed, it is used only to provide, secure, and administer the service.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.
• Authorized Agent Requests: You may designate an authorized agent to submit a request on your behalf. We may require signed authorization and/or direct identity verification before completing the request.

Categories of personal information collected: identifiers (username, email, IP address), internet or network activity (login history, submissions, scores, and activity logs), geolocation approximations (country and country inferred from IP), education or training records (learning progress, certifications, and event participation), and professional information (career data and job applications if you use recruitment features).

Categories disclosed in the last 12 months for business purposes: transactional email provider; CDN and security provider (including bot protection); IP reputation and threat-intelligence provider; email domain validation provider; customer review platform (Trustpilot); community messaging platform (optional webhooks); production infrastructure operated in the United States; and Stripe as payment processor for HFC pack purchases, HackFury Pro subscriptions, and entity workspace subscriptions.

Policy review: We review this Privacy Policy and our subprocessor disclosures at least annually and update the effective date when we make changes. The categories-above disclosure reflects our practices during the 12 months before the effective date shown at the top of this page.

To exercise your California privacy rights, use the self-service tools in your account Settings > Security page where available, or contact us at legal@hackfury.com. Requests are reviewed by our privacy and security leadership, including the CEO and Cybersecurity Assurance Manager, we verify identity before fulfillment, and we respond within 45 days unless a lawful extension applies.

California residents may also designate an authorized agent to submit a privacy request on their behalf by contacting legal@hackfury.com. We may require written proof of the agent's authority and verification of the consumer's identity before completing the request.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We review it at least annually and whenever we add a material subprocessor, change how we use personal data, or expand into new regions or features. Non-material changes may take effect when posted on this page. If we make a material change that affects your rights, how we use personal data, or the operation of the service, we will provide reasonable advance notice through the platform, by email where appropriate, or both. We encourage you to review this page periodically. The “Effective Date” at the top indicates when the policy was last revised, and your continued use of the platform after the revised effective date constitutes acceptance of the updated Privacy Policy where permitted by law.

1. Acceptance of Terms

By creating an account or accessing HackFury, you confirm that you have read, understood, and agree to these Terms and our Privacy Policy. If you do not agree, you may not use the platform. Continued use after any modification to these Terms constitutes acceptance of the revised Terms.

2. Eligibility

You must be at least 13 years old to use HackFury in the United States and most jurisdictions, and at least 16 years old in the EEA and United Kingdom unless verifiable parental or guardian consent is obtained where permitted by law. By creating an account, you represent that you meet the applicable age requirement. If you are under 18, you must obtain parental or guardian consent where required by applicable law.

3. Account Registration

• You must provide accurate and complete information during registration and keep your account information current.
• You must confirm at signup that you meet the applicable minimum age requirement stated in Section 2 (Eligibility).
• You are responsible for maintaining the confidentiality of your password and for all activity under your account.
• You may not share your account credentials or allow others to access your account.
• You must notify us immediately at contact@hackfury.com if you suspect unauthorized access to your account.
• We strongly recommend enabling two-factor authentication (2FA) for additional security.
• One account per person. Creating multiple accounts may result in suspension or ban.

4. Platform Services

HackFury provides cybersecurity education and competition services, including but not limited to:

• Courses & Learning Paths: Structured cybersecurity courses with questions and assessments.
• Labs: Hands-on practical labs with guided and freestyle challenges.
• Events & Competitions: CTF-style cybersecurity events, both individual and team-based.
• Certifications: Digital certificates issued upon completing courses, labs, or learning paths.
• Teams: Create or join teams for collaborative competition.
• Recruitment: Opt-in talent discovery where recruiters can search for skilled users.
• Bug Bounty: Report security vulnerabilities in exchange for HFC rewards.
• Author Portal: Approved authors may create and publish courses, labs, and challenges for the community.
• Partner Portal: Organizational partners (companies, universities, clubs, and other entities) may co-host events and access partner-specific features.
• Entity Workspaces: Organizations may run a private workspace for their members, with groups, learning assignments, internal events, jobs, and reports, under the Entity Agreement below.
• Marketplace & HackFury Pro: Purchase HFC packs and subscribe to HackFury Pro for paid catalog access and other Pro benefits described in the product.

We reserve the right to modify, suspend, or discontinue any part of the platform at any time with or without notice.

4.1 Lab, Event & Download Safety Notice

Some labs, event challenges, attachments, downloadable files, binaries, scripts, packet captures, exploit demonstrations, or other training materials made available through HackFury may be risky, unstable, system-altering, or intentionally malicious for educational purposes. You must handle all such materials only in a properly isolated environment such as a virtual machine, sandbox, or disposable test system that you are authorized to control.

You must not run such materials on production systems, employer devices, school networks, personal devices containing important data, or any environment that you cannot safely restore. By downloading or using these materials, you assume all risk of damage, data loss, interruption, compromise, misuse, or legal consequences arising from execution or handling outside the intended authorized environment.

4.2 Recruitment & Third-Party Programs

Recruiter access is limited to verified organizations using corporate email domains and subject to a recruiter agreement. We make reasonable efforts to limit recruitment posting access to such verified companies, but Cyndrion LLC does not guarantee job offers, interview outcomes, or the authenticity of any off-platform communications. You are responsible for performing your own diligence before sharing personal information, sending documents, or engaging outside the platform. If a bug bounty, event, challenge, or other program is run by or on behalf of another organization, you must comply with both these Terms and any program-specific rules, scopes, and restrictions.

4.3 Entity Workspaces

If you use HackFury through an entity workspace, these Terms and the Privacy Policy apply to you, and you accept them before you first use the workspace and again when they change materially. The organization’s own use of the workspace, including its pricing and billing, is governed by the Entity Agreement. The organization’s administrators can see your workspace activity and results, assign you work, and remove your access. Jobs, internal events, bug bounty programs, and messages published in a workspace are the responsibility of the organization that publishes them.

4.4 Sponsored Content

Parts of the signed-in portal carry paid sponsorship placements, and some labs, courses, learning paths, blog posts, FurySOC scenarios and events are sponsored content made with or for a sponsor. Every placement is labelled as sponsored, and sponsored content is labelled “Sponsored by” with the sponsor’s name. We sell them directly. Most placements are first-party: we host the sponsor’s image and text ourselves, and they run no third-party code and set no cookies. Some placements show an ad network unit supplied by a sponsor. It runs inside an isolated frame on our domain, may set cookies on the network’s own domain, and is shown whether or not your browser sends a Global Privacy Control or similar opt-out signal. Seeing sponsorship placements, including ad network units, is a condition of using the free tier. HackFury Pro members see no sponsorship placements. A new account sees none for its first 7 days or until it has solved 3 labs, whichever comes first, and placements never appear inside labs, courses, exams, FurySOC investigations or account, support and profile pages.

A sponsorship is advertising, not a recommendation. Cyndrion LLC does not endorse, verify, test, or guarantee any sponsor, sponsor product, offer, price, claim, or security assertion. If you follow a sponsored link you leave the platform, and anything that happens afterwards - including any purchase, trial, account, download, or disclosure of your information - is between you and that sponsor, governed by their terms and privacy policy, not ours. Carry out your own diligence before acting on a sponsored offer, exactly as you would with any other vendor.

Some placements show ads from a third-party ad network. The network, not HackFury, chooses those ads and their advertisers. We do not review, endorse or guarantee them, and anything you do after clicking one is between you and that advertiser. To report an ad that is offensive, misleading or harmful, email contact@hackfury.com with the page and a screenshot. We can remove the placement or stop using the network.

Where a sponsor is named on an event, challenge, or track, that naming does not transfer any ownership of, or control over, your submissions, scores, or account, and it does not give the sponsor access to your personal information. What sponsors receive is described in the Privacy Policy: aggregate view and click totals for their own placement, and nothing that identifies you.

5. Virtual Currency (HFC)

• HackFury Coins (HFC) are a virtual currency used within the platform for purchasing hints, unlocking premium content, and rewarding participation.
• HFC may be earned through platform activities such as course completion, lab completion, daily login rewards, weekly streaks, event participation, bug bounty rewards, and other approved actions, and may also be purchased with money as HFC packs via Stripe checkout in the Marketplace.
• HFC have no real-world monetary value, are non-transferable between users, and cannot be exchanged for cash or redeemed for off-platform compensation. Event organizers may award HFC as gifts or rewards for approved activities, but such awards remain subject to these Terms.
• HFC may be redeemed only for eligible features, content, or benefits offered within HackFury.
• We reserve the right to adjust, reset, or modify HFC balances, pricing, redemption options, and reward rates at our discretion.
• Abuse of reward systems (e.g., creating multiple accounts to farm HFC) will result in forfeiture of HFC and possible account termination.

6. Payments & Subscriptions

• HackFury processes paid features through Stripe, including HFC pack purchases and HackFury Pro subscriptions. Checkout is hosted by Stripe. We do not store your full credit card or payment card details on our servers. Stripe’s terms and privacy policy also apply to payment processing.
• HackFury Pro renews automatically at the then-current price each month or year until you cancel. It may be canceled in-app at any time (Settings → Billing); access continues until the end of the paid period. Partial refunds are not provided by default. A full refund may be issued for a verified charge error or when paid access was never granted within a short window after payment (typically 24–48 hours).
• Entity workspace subscriptions are priced per organization and billed under the Entity Agreement, which also explains how price and plan changes are announced and when they apply.
• Prices are displayed in US Dollars (USD) unless otherwise stated. You are responsible for any applicable taxes, duties, or currency conversion fees.
• Unless otherwise stated at the point of purchase or required by applicable law, digital purchases, unlocks, credits, HFC purchases, and other delivered digital benefits are final and non-refundable once access has been granted. Refunds may be granted where a verified technical issue prevented delivery or access, and we may also issue discretionary refunds on a case-by-case basis.

7. User Content & Conduct

7.1 Acceptable Use

You agree to use HackFury only for lawful purposes and in compliance with these Terms. You must not:

• Attempt to gain unauthorized access to accounts, systems, or data that do not belong to you, except within authorized lab or event environments.
• Use knowledge or tools obtained on the platform to attack real-world systems without explicit authorization.
• Upload malware, viruses, or other harmful code to the platform, unless it is part of an authorized lab, challenge, or course exercise. Even in those cases, you must use an isolated environment and follow all safety instructions provided. You are solely responsible for any consequences of mishandling malicious files.
• Harass, threaten, impersonate, or intimidate other users.
• Post or transmit content that is illegal, hateful, discriminatory, sexually explicit, or otherwise objectionable.
• Scrape, crawl, or use automated tools to extract data from the platform without our written permission.
• Interfere with or disrupt the platform's infrastructure, services, or other users' experience.
• Use the platform to facilitate any illegal activity, including unauthorized computer access under applicable law (e.g., CFAA, Computer Misuse Act).
• Engage in phishing, social engineering, credential stuffing, spam, cryptocurrency mining, malware hosting, or similar abuse through or in connection with the platform outside expressly authorized training content.
• Access or use the platform in violation of applicable export control, trade sanctions, embargo, or similar laws.

7.2 Authorized Security Research & Bug Bounty Safe Harbor

Good-faith security research is authorized only when it is conducted strictly within assets, environments, or scopes that Cyndrion LLC or the relevant program owner has explicitly identified as in scope through the applicable bug bounty or program rules. If you follow the published scope, submission requirements, these Terms, and our Privacy Policy, we will treat that in-scope testing as authorized under the applicable program unless explicitly stated otherwise. This safe-harbor language does not authorize testing outside published scope or any illegal, disruptive, destructive, or privacy-invasive activity.

• You must promptly and privately report vulnerabilities through the designated in-platform bug bounty reporting channel or, if specifically directed, by email at bugbounty@hackfury.com (or security@cyndrion.com), and provide enough detail for reproduction.
• You must not use social engineering, phishing, spam, physical intrusion, credential stuffing, denial-of-service techniques, extortion, or destructive testing.
• You must not exfiltrate, retain, or disclose data beyond what is reasonably necessary to demonstrate a vulnerability, and you must stop testing once a vulnerability is confirmed.
• You must not establish persistence, pivot to third-party systems, interfere with other users, or test assets that are out of scope for the applicable program.
• Where a bug bounty program is operated by another organization, that program's specific rules, scope limitations, and reward conditions also apply in addition to HackFury's Terms and Privacy Policy.

7.3 User-Generated Content

You retain ownership of content you create (e.g., team bios, bug bounty reports, profile information). By submitting content, you grant Cyndrion LLC a non-exclusive, worldwide, royalty-free license to display and use that content as part of platform operations. We may remove content that violates these Terms.

7.4 Author-Created Content

Authors approved through the Author Portal retain intellectual property rights over their original course materials, lab scenarios, and challenge content. By publishing content on HackFury, authors grant Cyndrion LLC a non-exclusive, worldwide, royalty-free license to host, display, and distribute that content to platform users. Authors are responsible for ensuring their content does not infringe on third-party intellectual property rights. Cyndrion LLC reserves the right to review, remove, or unpublish author content at any time for quality, safety, or legal reasons.

8. Anti-Cheat & Fair Play

Integrity is fundamental to HackFury competitions. We employ automated detection systems that continuously monitor for suspicious activity, including but not limited to unusual submission patterns, abnormal timing, collaboration where individual work is required, and other indicators of unfair play.

The specifics of our detection methods and algorithms are confidential and will not be disclosed. Evidence and proofs generated by the detection systems cannot be shared with users, in order to preserve the integrity and effectiveness of our anti-cheat measures.

If a violation is detected, consequences may include one or more of the following, at our sole discretion:

• Nullification of scores or challenge completions.
• Disqualification from current or future events.
• Forfeiture of HFC, XP, and other rewards.
• Temporary suspension of your account.
• Permanent account ban.

Potential anti-cheat findings are reviewed by the appropriate human decision makers, which may include our security team, event organizers, platform administrators, or designated staff, before final enforcement where reasonably practicable. All anti-cheat actions are logged, and you may appeal a decision by contacting us at contact@hackfury.com or through our official Discord at https://discord.gg/EKAtgfKKCM.

9. Intellectual Property

• The HackFury name, logo, design, software, layout, course content, lab environments, challenge materials, and related platform content are the copyrighted property of Cyndrion LLC and/or its licensors or approved content authors, and are protected by intellectual property laws.
• You may not copy, mirror, scrape, redistribute, republish, sell, license, or create derivative works from platform content without explicit written permission.
• Course, lab, and event challenge questions, answers, solutions, and proprietary challenge logic are confidential. Sharing them publicly (e.g., on write-up sites, social media, forums, or competing platforms) is prohibited unless the content author or event organizer explicitly permits it.
• Certifications issued by HackFury are for personal use and may be shared on professional profiles (e.g., LinkedIn) to represent your achievement. Certificates include a unique verification ID that can be validated on our platform.
• If we reasonably believe content on or through the platform copies, steals, or infringes our intellectual property or the rights of another party, we may remove it immediately, disable access, terminate repeat offenders, and pursue civil, contractual, or other legal remedies.

To report copyright or intellectual property infringement, contact us at legal@hackfury.com with sufficient detail to identify the protected work, the allegedly infringing material, the relevant URL or location, your contact information, and your basis for the complaint. Where appropriate, we may request a good-faith statement and a statement that you are authorized to act on behalf of the rights holder.

We may remove or disable access to allegedly infringing or otherwise unlawful material while we investigate, may request additional information from the reporting party or uploader, and may restore content if we determine the complaint was mistaken or insufficient. Users who repeatedly upload infringing, unlawful, abusive, or otherwise prohibited content may be suspended or permanently terminated as repeat infringers or repeat violators.

10. Limitation of Liability

To the maximum extent permitted by applicable law:

• HackFury is provided "as is" and "as available" without warranties of any kind, whether express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement.
• Cyndrion LLC shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of the platform.
• Our total liability for any claim related to the platform shall not exceed the amount you have paid us in the 12 months preceding the claim, or $100 USD, whichever is greater.
• We are not responsible for the actions of other users, third-party services, or content provided by authors, recruiters, or partners.
• We are not liable for damage, data loss, service interruption, compromise, or other harm arising from your download, execution, or misuse of labs, attachments, sample files, scripts, binaries, or other training materials outside a properly isolated and authorized environment.
• Cybersecurity skills learned on the platform are for educational purposes. We are not liable for how you apply those skills outside the platform.

10.1 Indemnification

To the maximum extent permitted by law, you agree to defend, indemnify, and hold harmless Cyndrion LLC, its affiliates, personnel, contractors, and partners from and against claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or related to your content, your use or misuse of the platform, your breach of these Terms, your unlawful or unauthorized testing or hacking activity, your misuse of labs or downloadable materials, your infringement of third-party rights, or your violation of applicable law, sanctions, or program-specific rules.

11. Termination

• By You: You may delete your account at any time from your Settings > Security page, or by contacting us at contact@hackfury.com. Upon deletion, your personal data will be processed in accordance with our data retention policy above.
• By Us: We may suspend or terminate your account at any time for violation of these Terms, suspected fraud, abuse, or any other reason at our discretion. We will make reasonable efforts to notify you before or at the time of termination using your registered email address or other appropriate contact method.
• Effect: Upon termination, your right to use the platform ceases immediately. Any HFC balance, progress, or certifications may be forfeited at our discretion in cases of Terms violations. Provisions regarding intellectual property, limitation of liability, and governing law survive termination.
• Inactive Accounts: Accounts with no login activity for 5 years may be deleted after a 30-day advance notice sent to your registered email.

12. Governing Law & Disputes

These Terms are governed by the laws of the State of Wyoming, United States, without regard to its conflict-of-law principles.

• Any disputes arising from or relating to these Terms or the platform shall first be resolved through good-faith negotiation.
• If negotiation fails, disputes shall be brought in the state or federal courts located in or serving Sheridan County, Wyoming, unless applicable law requires a different forum.
• You agree to resolve disputes on an individual basis. Class actions and representative actions are waived to the maximum extent permitted by law.
• Nothing in these Terms prevents either party from seeking injunctive or equitable relief in a court of competent jurisdiction for urgent matters (e.g., intellectual property infringement, data breaches).

13. Changes to These Terms

We may revise these Terms from time to time. Non-material changes may take effect when posted on this page. If we make a material change affecting your rights, obligations, payments, dispute process, or use of the service, we will provide reasonable advance notice through the platform, by email where appropriate, or both. Your continued use of the platform after the revised effective date constitutes acceptance of the updated Terms where permitted by law.

14. Contact Us

If you have questions about these Terms, our Privacy Policy, or wish to exercise your data rights, contact us at: