Privacy Policy
Last updated: 2 November 2026
This page explains what personal data the Bluecamp CTF at ctf.bluecamp.ch processes, why, and for how long. In short: we collect only what is needed to run the competition, have it hosted and processed by Microsoft within the EU Data Boundary, keep logs for 90 days, and you can delete your account whenever you want.
Who is responsible
Bluecamp, Nicola Suter, Switzerland, is responsible for processing your data (controller under the Swiss Federal Act on Data Protection, FADP, and, where applicable, the EU GDPR).
Contact for all privacy requests: hi [at] nicolasuter.ch
What data we process and why
| Data | Required? | Purpose |
|---|---|---|
| Email address | Yes | Sign-in, account recovery, important event messages |
| Username (nickname) | Yes | Your identity on the platform and the public scoreboard |
| First name, last name, country | Optional | Shown only if you choose to provide them; country may be used for statistics |
| Sign-in data (login times, IP address, device and browser information) | Yes | Secure authentication and protection against abuse |
| Platform activity (challenge attempts, flag submissions, solves, points) | Yes | Running the competition and calculating scores |
| Request logs (queries to the platform, IP address, timestamps) | Yes | Operation, troubleshooting, and detecting cheating or attacks |
We process this data to provide the CTF you signed up for, to keep it fair and secure, and to answer your requests. We do not sell your data, use it for advertising, or build profiles.
Public scoreboard
Your username, points and leaderboard position are publicly visible on the scoreboard. Your email address and optional name fields are never shown publicly. If you do not want to be identifiable, choose a username that does not reveal your real name.
Service providers and where your data is stored
All services are hosted and all data is processed by Microsoft within the Microsoft EU Data Boundary, which covers the EU and EFTA countries, including Switzerland.
- Microsoft Entra External ID handles sign-up and sign-in.
- Azure Container Apps hosts the CTF platform, which is based on the open-source software CTFd, together with its database and logs.
Microsoft acts as our processor. For details on how Microsoft stores, protects and transfers data, see the Microsoft Trust Center: Where your data is located.
Cookies and tracking
We use only technically necessary cookies to keep you signed in and to protect forms against misuse. We do not use Google Analytics, advertising cookies, or any other tracking or analytics tools.
How long we keep your data
- Your account (email address, username, optional profile fields and platform activity) is kept for as long as your account exists. It is not deleted automatically.
- Logs (request and sign-in logs, including IP addresses) are kept for 90 days and then deleted.
You can delete your account yourself at any time. This removes your account data and your entries on the scoreboard. If you need help, use the contact details above.
Changes
We may update this page if the platform changes. The date at the top shows the current version.