Privacy Policy
Version 1.1 · Effective from date
We built Cyber Framework to collect as little data as possible. The game has no accounts, we never ask for your real name or contact details, and we designed the gameplay data we collect so that we cannot tell who you are. This policy explains what we do process, why, and what rights you have under the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Czech Act No. 110/2019 Coll., on personal data processing.
1. Who is the controller
The controller of your personal data is:
Václav Bílý (xprees), sole trader, ID No. (IČO): 22056475, with registered address at E. Košťála 1009, Pardubice 530 12, Czech Republic ("we", "us").
Contact for all privacy matters: [email protected]. We have not appointed a Data Protection Officer because we are not required to.
2. What this policy covers
- the website cyber-framework.net (the "Website"), and
- the browser game at play.cyber-framework.net (the "Game").
When a school, company, or other organization uses the Game under a separate written contract, the processing of its players' data may be governed by that contract and a data processing agreement (Art. 28 GDPR). In that case the organization may be the controller, and we may act as its processor.
3. What data we process and why
3.1 Playing the Game
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Random session identifier, newly generated each time you start the Game and kept only in memory while you play (never saved to your browser storage) | Linking events within a single game session | Legitimate interest in operating and improving the Game (Art. 6(1)(f) GDPR) | 24 months from collection |
| In-game events: actions (e.g. "email opened", "link clicked"), choices, scores, reaction times, movement and viewing direction within the game world, and time since the session started | Running the Game, showing aggregated statistics, improving scenarios, and statistical and research evaluation of training effectiveness | Legitimate interest (Art. 6(1)(f) GDPR); research with safeguards under Art. 89 GDPR | Detailed movement data: 6 months, then converted into aggregated heatmaps. Other events: 24 months from collection, then irreversibly anonymised or aggregated |
What we do not collect. Your nickname stays in your browser and is never sent to our server. We never record what you type into simulated forms in the Game, such as fake login pages, only that you submitted them. We do not store your IP address or device data with gameplay data. We do not use your device's webcam or microphone: "viewing direction" means where you look inside the game world.
Why we rely on legitimate interest. Our legitimate interest is understanding how people respond to simulated cyber threats, so that we can improve the training and evaluate whether it works. Because the data cannot be linked to you and you can switch it off at any time, we consider the impact on you to be minimal.
Safeguards for research. We analyse gameplay data, including with process mining software, only in pseudonymised form. Before data leaves our servers for analysis, we remove anything that could link it back to a session stored with us. We never try to identify players or recognise them by their gameplay patterns. In the Game, we show only aggregated statistics, and only once at least 10 players have answered. We may publish results in academic work, including a thesis at University. Publications contain only aggregated or anonymised results.
We still treat this data as personal data. We designed it so that we cannot tell who you are, but within a single session the events are linked by the session identifier. We therefore treat it as pseudonymous personal data and protect it under GDPR.
Opting out: when you first start the Game, the Privacy & data (GDPR) panel tells you about data sharing and you can turn it off straight away. You can turn off usage analytics and crash reports separately, and you can change your choice at any time in the Game's settings. If you turn off usage analytics during a session, we also delete the data from that session.
Do you have to give us data? No. If you turn off data sharing, you can still play the whole Game. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22 GDPR).
3.2 Error monitoring (Website and Game)
When the Website or the Game crashes or throws an error, we send an error report to our self-hosted GlitchTip instance. A report may contain your IP address, browser and operating system type (user agent), the page address, and technical details of the error. It does not contain your nickname, gameplay data, or anything you type. In the Game, you can turn off crash reports in the Privacy & data (GDPR) settings.
- Purpose: finding and fixing bugs, and protecting the security of the service.
- Legal basis: legitimate interest in a functional and secure service (Art. 6 (1)(f) GDPR).
- Retention: 90 days.
3.3 Analytics (Website and Game)
We measure visits and engagement with self-hosted Plausible Analytics. Plausible uses no cookies and does not store your IP address or any identifier. It uses your IP address and user agent only briefly, to compute a daily-rotating anonymous hash that is never stored together with the IP address. We see only aggregated statistics, such as the number of visits, pages viewed, referring sites, country, and device type.
- Legal basis: legitimate interest in understanding how the Website and the Game are used (Art. 6 (1)(f) GDPR).
- Retention: we keep only aggregated statistics, for as long as we operate the Website and the Game.
3.4 Contacting us
If you email us at [email protected] or contact us another way, we process your email address, name (if you give it), and the content of your message, so that we can reply.
- Legal basis: legitimate interest in communicating with you (Art. 6 (1)(f) GDPR), or steps taken at your request before entering into a contract (Art. 6 (1)(b) GDPR).
- Retention: as long as needed to deal with your request, normally no longer than 3 years after the conversation ends (the general limitation period under Czech law).
3.5 Server logs
When you access the Website or the Game, our web server automatically processes technical data such as your IP address, the time of the request, and the requested address. We need this to deliver the content and to protect the service against attacks. We do not store IP addresses together with gameplay data. Legal basis: legitimate interest (Art. 6 (1)(f) GDPR). Retention: no longer than 90 days.
4. Cookies and browser storage
We set no cookies of our own, neither on the Website nor in the Game. The Game keeps the following data in your browser:
| Data | Type | Purpose | Duration |
|---|---|---|---|
| Nickname, game progress, privacy settings, and whether you have seen the privacy panel | localStorage (Game) | Lets the Game work and remember your progress and choices | Until you clear your browser data |
| Session identifier | Memory only | Links events within one game session | Deleted when you close the Game |
This storage is technically necessary for the Game to work, so it does not require consent under Section 89 (3) of Czech Act No. 127/2005 Coll., on electronic communications. We use no advertising or tracking cookies. You can delete the stored data at any time in your browser settings.
Embedded YouTube videos
Some pages contain YouTube videos (Google Ireland Limited). We host the video preview images on our own servers. The YouTube player loads from youtube-nocookie.com only after you click "Play video". Until then, nothing is sent to Google. By clicking, you consent to YouTube receiving your IP address and possibly storing cookies on your device (Art. 6 (1)(a) GDPR; Section 89 (3) of Act No. 127/2005 Coll.). You can withdraw your consent at any time by deleting YouTube cookies in your browser. We are joint controllers with Google for loading the player (Art. 26 GDPR). Google is responsible for any further processing under the Google Privacy Policy. Google may transfer data outside the EU on the basis of the EU–US Data Privacy Framework.
Links to other services
The Website links to Discord, LinkedIn, Instagram, and GitHub. Nothing is sent to these services until you click a link. Once you do, their own privacy policies apply.
5. Recipients and processors
We do not sell your data and we do not share it for marketing. Your data may be accessed by:
- Hetzner Online GmbH (Germany), our hosting provider. The Website, the Game backend, Plausible, and GlitchTip all run on servers we operate in Hetzner's data centres within the EU. Hetzner acts as our processor under a data processing agreement.
- Cloudflare, Inc. (USA), which provides our DNS and forwards emails sent to [email protected]. Cloudflare acts as our processor under a data processing agreement.
- Google (EU), which hosts our mailbox, as our processor.
- public authorities, where the law requires it.
Cloudflare and Google (YouTube, see Section 4) are based in the USA. Transfers to them rely on the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. We do not transfer personal data outside the European Economic Area in any other case.
6. Children
The Game is designed for players aged 15 and over. Because children merit specific protection (Recital 38 GDPR), children under 15 should play only with the knowledge and supervision of a parent, legal guardian, or teacher. We cannot verify age, because we do not collect names or contact details. That is also why we designed the gameplay data so that no one can be identified from it. Teachers using the Game in class should remind pupils to make up any nickname, password, or email address they type in the Game. They can also turn off data sharing in the Privacy & data (GDPR) settings on each device.
7. Your rights
Under GDPR you have the right to:
- access your personal data (Art. 15),
- rectification of inaccurate data (Art. 16),
- erasure (Art. 17),
- restriction of processing (Art. 18),
- object to processing based on legitimate interest (Art. 21). You can also do this in the Game's Privacy & data (GDPR) settings,
- data portability, where it applies (Art. 20). It does not apply to gameplay data, which we process on the basis of legitimate interest, and
- lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz.
To exercise your rights, email [email protected].
Gameplay data: the session identifier changes every time you play and we do not store your nickname, so once a session ends we cannot tell which records are yours. The Privacy & data (GDPR) panel shows your current session identifier. If you copy it and send it to us, we will delete the data from that session. Without it, we cannot act on access, erasure, or similar requests for gameplay data (Art. 11 GDPR). The quickest way to stop further processing is to turn off usage analytics in the Game.
Other data (for example, emails you sent us): we will handle your request in the usual way.
We will reply within one month.
8. Security
All traffic is encrypted (HTTPS). Data is stored on servers we operate within the EU, and only the operator has access to it. Gameplay data is stored separately from IP addresses, and data exported for analysis is stripped of anything that could link it back to our servers.
9. Changes to this policy
We may update this policy, for example when we add new features or B2B services. We will publish the current version on this page with a new effective date. If the change is significant, the Game will show you the privacy panel again and we will also announce the change on the Website.
This policy is published in Czech and English. If the two versions differ, the Czech version prevails.