Privacy Policy

What we collect

• Account data: when you sign in with Google, we receive your name, email address, profile picture and Google account ID. When you sign in with an emailed code, we receive your email address.
• Content you create: scenarios, exercise sessions, notes, branding you upload (such as a logo), and results.
• Usage data: pages visited, buttons clicked, device and browser type, and approximate location from your IP address, collected with Mixpanel and Google Analytics.
• Billing data: if you buy a plan, payment is handled by Lemon Squeezy, our reseller. We receive your plan, billing status and email, never your full card number.
• Messages you send us through the contact form or by email.

How we use it

To run your account and the service, to generate scenarios with AI when you ask for it, to send service emails (for example a welcome email), to understand and improve how the product is used, to handle billing, and to answer you.

We don't sell personal data and we don't use your exercise content to advertise to you.

AI processing

When you use AI generation or analysis, the text you provide is sent to our AI provider (Anthropic) to produce the result. Don't paste confidential or personal data you aren't allowed to share; use sanitized summaries.

Who processes data for us

Google (sign-in, analytics), WorkOS (email sign-in codes), Railway and Vercel (hosting), MongoDB (database), Anthropic (AI), Mixpanel (analytics), Lemon Squeezy (payments) and Resend (email). They process data on our behalf under their own terms and security measures. Some of them are in the United States.

Participants in live sessions

People who join a live session by link don't need an account. We store what's needed to run the session, such as the decisions recorded during it.

How long we keep it

Account data and content stay while your account is active. You can ask us to delete your account and content at any time; we delete it within 30 days, except billing records we must keep by law.

Your rights

You can ask to see, correct, export or delete your data, or object to analytics, by emailing support@cyberwar24.com. If you are in the EU or UK, you can also complain to your data protection authority.

Cookies and local storage

We use a sign-in cookie and browser storage to keep you logged in, and analytics cookies (Mixpanel, Google Analytics) to understand usage.

Security

Data is sent over HTTPS, sign-in goes through Google or a one-time code from WorkOS, and access to our systems is limited. No system is perfectly secure; if we learn of a breach affecting you, we'll tell you.

Changes

If we change this policy, we'll update the date above and email account holders about important changes.