PRIVACY POLICY
NULL//SEC is built to collect as little personal data as possible. This policy explains exactly what we process, why, for how long, and how you control it.
1. Who is responsible
The data controller is Subversive Symmetry. Privacy contact: c-david@hotmail.com.
2. Using NULL//SEC without an account
You can train without creating an account. Your progress, settings, certificates and conversations with NULL are stored only in your browser (IndexedDB). We do not receive them. If you ask NULL a question while signed out and guest AI is enabled, the text of that question is sent to our server and forwarded to our AI provider (see section 5) and is not stored by us.
3. What we process when you create an account
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address, password hash (Argon2id), callsign | Account, sign-in, password reset | Contract (Art. 6(1)(b)) | Until you delete the account; free accounts inactive for 730 days are erased automatically |
| Training statistics (XP, level, courses and challenges completed, streaks) | Sync across devices, your own progress view | Contract | Same as the account |
| XP gain history (amount + time) | Weekly leaderboard, anti-cheat limits | Contract / legitimate interest (fair competition) | 120 days |
| Progress backup (snapshot of your in-browser data, if you enable cloud backup) | Restore on another device | Contract | Same as the account; overwritten on each backup |
| Public callsign and score on the leaderboard | Public ranking | Consent (Art. 6(1)(a)) — opt-in, withdraw any time | Until you withdraw |
| Record of your consent (time and policy version) | Proof of consent | Legal obligation (Art. 7(1)) | Same as the account |
| AI usage counters (action type and time — never the text) | Daily limits, abuse prevention | Legitimate interest | 90 days |
4. PRO purchases
PRO is sold by Gumroad, which acts as merchant of record and processes your payment details — we never see card data. When you activate a license key, we ask Gumroad to verify it and store the key, the purchase email, price and currency, linked to your account. Basis: contract and legal obligations (tax/accounting). If you delete your account, the license record is kept without any link to you, as an anonymised sales record.
5. Processors and international transfers
| Processor | Role | Location / safeguard |
|---|---|---|
| Hostinger | Web hosting and database | EU data centre |
| Gumroad, Inc. | Payments and license keys (PRO only) | USA — EU Standard Contractual Clauses / EU-US Data Privacy Framework where applicable |
| Groq, Inc. | Generates NULL’s online answers | USA — Standard Contractual Clauses. Receives only the question, the current lesson context and your callsign/level; not your email. |
| Our email provider (SMTP) | Sends password-reset and account emails | Configured by the controller; EU where possible |
Don’t type personal or confidential information into NULL. Conversation text is not stored on our server; your local copy lives in your browser and can be cleared in Settings.
6. Cookies and local storage
We use no analytics, advertising or tracking cookies, and no third-party scripts or fonts. We use only strictly necessary storage, which does not require consent under the ePrivacy Directive:
nsec_app— session cookie, set only when you sign in; keeps you logged in (up to 30 days) and protects forms against CSRF.nsec_admin— session cookie for administrators only.- IndexedDB
NULLSEC_DB— your training progress on your device. - localStorage
nsec_notice— remembers that you dismissed the storage notice.
7. Security
HTTPS everywhere, passwords hashed with Argon2id, API keys encrypted at rest, CSRF protection, rate limiting and an audit log of administrative actions. We never store your IP address — rate limits use a keyed hash that rotates daily.
8. Your rights
You have the right to access, rectify, erase, restrict and object to processing, to data portability, and to withdraw consent at any time without affecting earlier processing. Most of this is self-service in the app under Account → Your data:
- Export — download all data we hold about you as JSON (Art. 15 & 20).
- Delete — permanently erase your account and all associated data immediately (Art. 17).
- Leaderboard — switch public listing on or off (withdraw consent).
- Rectify — change your callsign, email or password.
For anything else, write to c-david@hotmail.com; we answer within one month. You may also complain to a supervisory authority — in Portugal, the CNPD.
9. Children
Accounts are intended for people aged 16 or over. Younger learners can use NULL//SEC without an account; nothing leaves their device.
10. Changes
We will update the version number above when this policy changes and, for material changes, notify account holders by email.