Privacy

What the site stores

The PHP application uses a temporary session cookie to keep the selected scenario or challenge’s authoritative state, evidence and decision progress, enabled controls, recent synthetic events, rate-limit counters, and a CSRF token. The cookie is HttpOnly and SameSite=Lax; it is marked Secure when the site is served over HTTPS. Session retention is controlled by the hosting provider’s normal PHP configuration.

What the site does not collect

• No name, email address, login, profile, payment, or uploaded content.
• No analytics identifiers, advertising pixels, fingerprinting, or cross-site tracking.
• No raw headset pose, controller pose, hand joints, gaze, voice, microphone, camera, room map, or geolocation.
• No server-side learner score, public rank, behavioral profile, or long-term performance history.
• No real target data, coordinates, operational plans, or external-system credentials.

External dependency request

The immersive renderer loads the pinned Three.js module from jsDelivr when available. That network request is governed by the CDN’s own policies. When the module cannot be loaded, the site automatically uses its local Canvas 2D fallback. No simulation state is sent to the CDN.

Server logs

The hosting provider may create ordinary HTTP access, error, security, or infrastructure logs. Their contents and retention are controlled by the deployment environment, not by the application code. A production operator should document those practices and minimize IP and user-agent retention where feasible.

Browser-local progress and deletion

After a completed daily challenge, the browser may store the challenge code, completion date, model label, and overall educational assessment in localStorage. This optional record never leaves the device in this release. The homepage includes a Clear local record control; browser settings can also remove all site data. Closing the browser normally ends the session cookie. Reset returns the active synthetic challenge to its first phase but does not erase the separate local completion record or control host-level logs.

Sharing

Result cards are generated in the browser. A share action occurs only after the visitor activates it and may use the browser’s native sharing or clipboard interface. Shared challenge links contain only an allowlisted challenge identifier and deterministic seed; they do not contain the sender’s answer, score, name, IP address, or XR telemetry.

Evidence Atlas view URLs

The Evidence Atlas does not create a server-side saved-view record. Its current filters, selected public records, comparison references, timeline position, and optional search text can appear in the browser address through history.replaceState(). Copying a view happens only after the visitor activates Share current view.

Because an Atlas view is an ordinary URL, its query string may be retained in browser history, copied into messages, included in referrer handling, or written to ordinary hosting logs when another person requests it. Do not enter names, private notes, credentials, classified terms, or other sensitive information in the Atlas search field. The application does not use that text to contact another system, create a record, or build a profile.

Future features

Accounts, multiuser sessions, voice, gaze, telemetry, scenario uploads, crowdsourced Atlas submissions, AI-generated content, or cyber-range integrations would materially change this policy and should not be enabled without a new privacy review, consent model, retention schedule, access controls, and release update.

Privacy questions may be sent to editor@killchains.com.