Lab privacy notice

By default, almost nothing

You play anonymously. A random id is kept in your browser so your progress follows you on this device. The server stores, tied to that id: which challenges you solved, your attempt counts, any nickname you set, and any solution you choose to share. Your messages to the models are not stored unless you opt in below.

If you opt in to research

On the lab page you can tick "Contribute my attempts to AI security research". While that is on, the text you send to a challenge (your attack messages, agent payloads, defence prompts) is stored with its outcome, so the lab's owner can study how AI attacks and defences work and build teaching material and detection datasets.

• What's stored: the text you submitted, which challenge, the outcome, and a timestamp, linked to your random id.
• What's not: your IP address, your name, your email, or anything your browser doesn't send as part of the attempt.
• Please don't type real personal data or real secrets into the challenges. They're sandboxes.

Fair-use limits

To stop one visitor from using up the lab's daily model budget for everyone, each challenge message counts against a daily allowance per connection. The lab never stores your IP address for this: it stores a keyed hash of it that changes every day and can't be reversed or linked across days without the server's secret. These counters are deleted the next day. The legal basis is the lab's legitimate interest in keeping the service available and its costs bounded.

Legal basis, retention, sharing

• Basis (GDPR): your consent, for research attempts. You can withdraw it at any time by unticking the box; that stops new storage.
• Retention: research attempts are deleted automatically after 12 months; fair-use counters after one day.
• Sharing: stored attempts are private to the owner. Aggregated or anonymised findings and datasets derived from them may be published; shared solutions you post are shown to other players who solved the same challenge.
• Processor: the lab runs on Cloudflare (Workers, D1, Workers AI). Model prompts are processed by Cloudflare Workers AI to generate replies.

Your choices

On the lab page you can turn research off, and use Delete all my lab data to erase everything tied to your id: progress, shared solutions and research attempts. For any question, contact joseph@manzambi.com.