Legal

Privacy policy

This privacy policy describes, in accordance with the General Data Protection Regulation (GDPR, article 13), the personal data processing carried out when you use the Espilon Learn platform (learn.espilon.net).

Data controller

The data controller is the Association Espilon (French "association loi 1901"), 11 allée des Romarins, 78180 Montigny-le-Bretonneux, France, reachable for any question about your data at eun0us@espilon.net. The association has not designated a separate Data Protection Officer (DPO) at this stage; the same address serves as the contact point. Designating a DPO is not mandatory under article 37 of the GDPR, given the association's size and activity. See the legal notice for the publisher's full identity.

Minimum age

Creating an account is reserved to individuals aged 15 or older, the digital age of consent set by French law (GDPR article 8 and the "loi Informatique et Libertés"). Individuals under 15 may not create an account on the platform.

Data collected

Creating an account and using the platform results in the collection of the following data:

  • Account (CTFd core): username, email address, password (stored hashed) and, optionally, affiliation, country and website.
  • IP address: logged by CTFd on flag submissions and activity tracking, for security and anti-abuse purposes.
  • Learning progress (Learn plugin): quiz results, completed lessons, experience points (XP) and prestige level, course bonuses earned, challenge solve credits.
  • Email verification status and last-activity timestamp.
  • Single-use tokens: email verification (valid 48 hours) and password reset (valid 1 hour), deleted or expired automatically after use.
  • Discord ID and username, only if the account is voluntarily linked to a Discord account.

Purposes

  • Create and manage the user account.
  • Verify the email address before beta access.
  • Allow password resets.
  • Track learning progress and compute XP and prestige level.
  • Display a public leaderboard showing username, level and XP.
  • Keep the platform secure and prevent fraudulent use.

Legal basis, per purpose

  • Account creation and authentication: performance of the contract binding you to the platform (terms of use).
  • Email verification and password reset: performance of the contract and legitimate interest (account security).
  • Learning progress, quiz results, XP and prestige level: performance of the contract (article 6(1)(b)).
  • Public leaderboard (username, level and XP shown publicly): the association's legitimate interest in animating the learning community; only game data and a user-chosen display name are shown.
  • Platform security and fraud prevention (IP-address and technical-log retention): legitimate interest (article 6(1)(f)).
  • Optional Discord account link: consent.

Retention period

  • Account and learning progress data: kept while the account is active; erased within 30 days after account deletion.
  • Email verification tokens: 48 hours, then automatic expiry.
  • Password reset tokens: 1 hour, then automatic expiry.
  • Technical logs (IP addresses, server logs): kept for 12 months.

Recipients

Data is accessible to the administrators of the Espilon association and to the platform's host to the extent strictly necessary to operate it (see the legal notice). The host processes data on the association's behalf as a processor ("sous-traitant") within the meaning of GDPR article 28, under a data-processing agreement. No data is sold or shared with third parties for commercial purposes.

International data transfers

All processing takes place within the European Union / European Economic Area. The host (Hostinger) is established in Cyprus (EU), and outgoing emails (email verification, password reset) are delivered through Hostinger's SMTP server, also located in the EU. No personal data is transferred outside the EU/EEA.

Automated decision-making

No fully automated decision producing legal effects or similarly significantly affecting you is carried out. Experience points (XP) and prestige level are pedagogical gamification only and have no legal consequence.

Your rights

Under the GDPR, you have the right to access, rectify, erase, port, object to, and restrict the processing of your data. You may also withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal, for processing that relies on it (for example the Discord account link). To exercise these rights, contact eun0us@espilon.net. You also have the right to lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.

Post-mortem data directives

Under article 85 of the French "loi Informatique et Libertés", you may define directives on the retention, erasure and disclosure of your data after your death by contacting the association at eun0us@espilon.net.

Cookies

The platform only uses strictly functional cookies:

  • Language preference (espilon_lang): remembers the EN/FR choice, lifetime 1 year.
  • Authentication session and CSRF token: issued by CTFd, required to stay signed in and to secure forms.

As of the last review of this page, the platform uses no analytics or advertising-tracking cookie: only the two strictly functional cookies described above (language preference, authentication and anti-CSRF session) are set. Cookies strictly necessary for the service to function do not require a consent banner.

Last updated: July 25, 2026.