Privacy policy
Breach City is a free cybersecurity simulation and learning resource at breachcity.io and app.breachcity.io, run by Innovmode CH. This page explains what we collect, why, and how to remove it. We don't sell personal data or use it for advertising.
If you play without an account
Your progress (academy, phishing range, campaign saves) is kept in your own browser. We also keep a random browser id in a cookie (stored by us only as a one-way hash) so share links and anonymous daily counters, such as how many people shared or reached Day 3, count each browser once. These counters contain no names or emails.
If you sign in
You can sign in with Google or with a sign-in link sent by email. Sign-in is handled by Supabase, our authentication provider. When you sign in we receive your email address, your name and, with Google, your profile picture address. We then keep, linked to your account:
- your progress: academy, phishing range, campaign saves, unlocks and league score (if you join the league);
- teams you create or join, your role in them, and what you add to a team (exercises, evidence, completions). Team admins and owners can see members' names, emails and completions in their team.
We use this only to run your account, keep your progress on every device you sign in on, and run teams.
If you join the waitlist
On breachcity.io you can get full access by sharing Breach City and leaving your email. We keep your email, the link to your post, the date, and whether you asked for updates. We only email you about new cities and lessons if you ticked that box. Your network address is hashed (one-way) for a day to limit repeated sign-ups, then discarded.
Who processes data for us
- Cloudflare hosts the sites and stores accounts, progress, teams and the waitlist (Cloudflare Workers and D1).
- Supabase runs sign-in (authentication).
- Google, if you choose “Continue with Google”, confirms who you are. The sites also load fonts from Google Fonts, which receives your network address.
Cookies and storage
We use a few strictly necessary cookies and browser storage: a random browser id, your sign-in session, your waitlist access, your settings (theme, hints, tours) and your local progress. There are no advertising or third-party tracking cookies.
Keeping and deleting your data
- Account: open your account menu and choose Delete my account. Your progress, league row and team memberships are deleted straight away.
- Waitlist: use “Remove my details” on breachcity.io after joining, or contact us.
- Without an account: clear this site's data in your browser.
We keep account and waitlist data until you delete it or ask us to. Anonymous daily counters are kept as totals.
Your rights
Depending on where you live (for example under the UK or EU GDPR), you can ask to access, correct, export or delete your data, or object to how we use it. Contact us at hello@breachcity.io. You can also complain to your data protection authority.
Children
Breach City isn't intended for children under 13, and we don't knowingly collect their data. If you think a child has given us data, contact us and we'll delete it.
Changes
If we change this policy we'll update the date above, and for significant changes we'll say so on the site.