Privacy policy

1. What this covers

This policy describes how TryHackThisBitch.com ("we", "our", "the site") handles information when you visit and use the site. It applies to the public site, challenges, dailies, the learning agent, the survey, and the help desk.

2. The entire privacy model in one sentence

Almost everything about you lives in your browser's local storage and is never sent to us at all: solved challenges, streaks, badges, leaderboard entries, themes, survey answers, help-desk tickets, and suggestions. The one thing that can leave your browser is what you explicitly push — see "Accounts" below.

3. Data we do NOT collect

• No analytics scripts, no pixels, no third-party trackers, no fingerprinting, no session replay. There are zero network calls to analytics providers from our pages.
• No advertising profiles built from your behavior.
• No cross-site tracking.

3b. Accounts — the one exception

Since 2026-09 the site has a voluntary account system so your grind can follow you across devices. If you create an account you give us exactly three things:

• Username — chosen by you, public-ish (used for sign-in).
• Email — optional, used for nothing right now (recovery ships later), stored as-is.
• Password hash — your password is never stored. It is hashed with PBKDF2-HMAC-SHA256 and only the hash is kept.

If you sign in, you can push your browser's progress (solves, streak, badges) to the cloud and pull it back on another device. Saves are stored as the raw progress object on an interim D1 (SQLite) store — not Postgres+RLS, which is the production target — scoped to your user ID. Everything is explicit: push or pull, nothing merges silently. You can erase your account (user, sessions, cloud progress) from the account page; it deletes server-side immediately. Your local browser data is only ever deleted by you.

4. What could technically be seen by our hosting provider

The site is served over HTTPS by a static-file host. Like every website on the internet, that host's servers see the standard connection metadata required to serve a page: your IP address, the time of the request, the page requested. This is used only for normal operations and abuse prevention (e.g. rate limiting, serving 404s), is not combined with your local data, and is not sold or shared.

5. Browser storage we use

• thtb-progress — legacy progress record.
• thtb-gamestate — solved challenges, streaks, badges, leaderboard.
• thtb-theme — your theme choice.
• thtb-forge-unlocked — unlock flag for the challenge forge.
• thtb-pro — pro-tier preview flag.
• thtb-survey — survey answers, used on-device by the learning agent.
• thtb-engine — the learning agent's generated challenge vault and history.
• thtb-seed — the agent's deterministic seed.
• thtb-tickets / thtb-suggestions — help-desk records you create.
• thtb-cookie-consent — a record of your cookie-consent choice (see the cookie policy).

All of this is deletable at any time from your browser's site-data settings. Clearing it resets local progress — that's the trade-off. Account data is handled separately — see "Accounts" above and erase it from the account page.

6. Cookies

We set a consent cookie (thtb-cookie-consent) and, only when you're signed in, the backend sets a session cookie (__Host-thtb_sid) on the flag-check API host. That session cookie is HttpOnly (not readable by scripts), Secure, 30 days, and revoked the moment you sign out or erase your account. Full detail in the cookie policy.

7. Emails you voluntarily provide

The optional email you give at signup sits with your account and is used for nothing today (recovery ships later). Optional email fields on the survey and help forms are stored only in your local thtb-survey / thtb-tickets / thtb-suggestions records — they are not transmitted, unless you paste them into a real email yourself. If you want to send us something for real, use the contact email at the bottom of this page — normal email rules apply.

8. Your rights (GDPR / CCPA)

• Your browser data is yours — view, edit, or delete it any time via dev tools or site-data settings. No account needed.
• Account data (username, optional email, password hash, cloud progress) can be erased from the account page — that deletes it server-side immediately, with nothing left behind.
• Right to opt out of "sale"/"sharing": we do not sell or share personal information, because there is none to sell.
• California / EU residents: nothing changes for you. Read the sections above and enjoy the site.

9. Children

The site is a crude-words education product aimed at adults (16+). We do not knowingly collect personal information from children. The account system requires no age gate today (planned before any paid tier); in the meantime, if you're under 16, skip the signup — the site works fine without an account.

10. Security

The site is served over HTTPS with strict transport security and a content-security policy that blocks inline scripts. Passwords are PBKDF2-HMAC-SHA256 hashed (never stored raw), logins are rate-limited and timing-equalized, and session cookies are HttpOnly and revoked on sign-out. See SECURITY.md for the full posture and the disclosure process if you find a real bug.

11. Third-party links

The site may link to external resources (e.g. the GitHub repo). Once you leave the site, our policy stops and theirs begins.

12. Changes to this policy

If we change anything material, we'll bump the date below. Accounts make it possible to email signups about privacy changes someday; until that mail service exists, check back or read it once and trust the "we don't track you" sentence, which will outlive any smaller changes.

Last updated: September 2026.
Contact: privacy@tryhackthisbitch.com (this mailbox exists to receive your questions; see our public repo for the human behind it).