This Privacy Policy (“Policy”) explains how OSMOSIS Institute, LLC, dba OSMOSIS Association (“OSMOSIS,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal information in connection with the online Open-Source Intelligence (OSINT) Capture The Flag (CTF) events hosted at osmosis.ctfd.io (the “Event,” “CTF,” or “Platform”).

This Policy applies specifically to your participation in the CTF and complements OSMOSIS’s general Privacy Policy available at osmosisassociation.org/privacy-policy. By registering for an account, accessing the Platform, or participating in the Event, you acknowledge that you have read and understood this Policy.

1. Data Controller OSMOSIS Institute, LLC 593 Ringwood Avenue Wanaque, NJ 07465 United States For data protection purposes, OSMOSIS is the data controller of personal information collected through the CTF.

2. Information We Collect A. Information You Provide Directly -Account registration details: email address, username, password (stored in hashed form), and any optional profile fields such as affiliation/organization, website, or country.
-Challenge submissions (flags and any associated metadata).
-Communications with organizers (e.g., support requests, Discord messages related to the CTF, or feedback).
-Prize-related information (if you win and claim a prize), such as full name, mailing address, or membership status for eligibility verification.

**B. Information Collected Automatically **

-Technical and usage data: IP address, browser type and version, operating system, device information, referring URLs, pages visited on the Platform, timestamps, and activity logs (including flag submission attempts and solve times).
-Performance and scoring data: challenges solved, points earned, ranking, and related statistics.
-Cookies and similar technologies necessary for platform functionality, session management, and security.

C. Publicly Visible Information Usernames, scores, rankings, and solve statistics are typically displayed on the public scoreboard and may be visible to other participants and visitors. We do not intentionally collect sensitive personal data (e.g., racial or ethnic origin, health data, or biometric data) in connection with the CTF.

3. How We Use Your Information We use the collected information for the following purposes:
-Operating and administering the CTF (account creation, authentication, scoring, and challenge delivery).
-Maintaining the integrity and security of the Platform (fraud detection, abuse prevention, rule enforcement, and investigation of violations).
-Communicating with you about the Event (announcements, technical issues, prize notifications, or responses to inquiries).
-Displaying public scoreboards and recognizing participants.
-Improving the Platform and future events (aggregate analytics, performance research, and bug fixing).
-Complying with legal obligations and enforcing our Terms of Service.
-Verifying eligibility for prizes or membership-related benefits.

We process this information based on:
-Performance of a contract (providing the CTF experience).
-Our legitimate interests (security, event integrity, and community improvement).
-Consent (where required, e.g., for optional marketing communications).
-Legal obligations.

4. How We Share Your Information We do NOT sell your personal information. We may share information in these limited circumstances:
Service Providers: With the CTFd platform provider and other technical vendors necessary to host, secure, and operate the Event (they process data only on our instructions).

Public Scoreboard: Username and performance statistics are publicly visible by design.
Legal and Safety Requirements: When required by law, court order, or to protect the rights, safety, or property of OSMOSIS, participants, or others.

Business Transfers: In the event of a merger, acquisition, or similar transaction (with appropriate safeguards).
With Your Consent: When you explicitly authorize sharing (e.g., for prize fulfillment or public recognition).

Aggregate or de-identified data that cannot reasonably identify you may be used or shared for research, educational, or promotional purposes consistent with OSMOSIS’s mission.

5. Cookies and Tracking Technologies The Platform uses essential cookies and similar technologies for: -Session management and authentication.
-Security and fraud prevention.
-Basic analytics to improve the Event.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Platform properly. We do not use advertising or marketing tracking cookies on the CTF Platform itself.

6. Data Retention We retain personal information only as long as necessary for the purposes described above, including:
-For the duration of the active CTF and a reasonable period afterward for scoring, disputes, and prize administration.
-As required by law or for legitimate security and audit purposes.
-Account data may be retained longer if you remain an active OSMOSIS community member or until you request deletion (subject to legal retention requirements).

After retention periods expire, data is securely deleted or anonymized.

7. Data Security We implement reasonable technical and organizational measures to protect your information against unauthorized access, loss, misuse, or alteration. These include access controls, encryption in transit where applicable, and monitoring.

No method of transmission or storage is 100% secure. You are responsible for keeping your account credentials confidential.

8. Your Rights and Choices Depending on your location, you may have rights to: -Access the personal information we hold about you.
-Correct inaccurate information.
-Request deletion of your data (subject to legitimate retention needs, such as completed challenge records or legal requirements).
-Object to or restrict certain processing.
-Withdraw consent where processing is based on consent.
-Data portability (in applicable jurisdictions).

To exercise these rights, contact us using the details below. We will respond in accordance with applicable law. You may also:
-Update certain account information directly on the Platform.
-Request that your username be changed or that public scoreboard visibility be limited (where technically feasible after the Event).

9. Children’s Privacy The CTF is intended for individuals 18 years of age or older. We do not knowingly collect personal information from children under 18. If we become aware that we have collected such information, we will take steps to delete it.

10. International Data Transfers The Platform and related services are primarily operated in the United States. If you are located outside the United States, your information may be transferred to and processed in the U.S. or other countries that may have different data protection laws. We take appropriate measures to protect your information in accordance with this Policy and applicable law.

11. Third-Party Links and Services The Platform or challenges may contain links to third-party websites or tools. This Policy does not apply to those third parties. We encourage you to review their privacy policies.

12. Changes to This Policy We may update this Privacy Policy from time to time. The “Last Updated” date at the top will reflect changes. Material updates will be posted on the Platform or announced via Discord or email when appropriate. Continued participation after changes constitutes acceptance of the revised Policy.

13. Contact Us For questions about this Privacy Policy, to exercise your rights, or to report privacy concerns related to the CTF:
Preferred method during active events: Official OSMOSIS Discord (CTF or support channels) Formal contact:

OSMOSIS Association 593 Ringwood Avenue Wanaque, NJ 07465 United States Or via the contact methods listed on osmosisassociation.org.