Privacy Policy

This policy explains what LabYard collects when you use LabYard (labyard.in), why, and what control you have over it. We collect the minimum needed to run a training platform — we do not sell your data or use it for advertising.

1. What we collect

When you register: your username, email address and password. The password is stored only as a salted hash — we never store or can read your actual password. You may optionally add an affiliation and a profile picture.

As you learn: which challenges you solve, flags you submit, quiz attempts and scores, lab progress, points and ranking, and — if your trainer enrols you — your batch and name within it.

Automatically, for security: your IP address is recorded alongside flag submissions and failed login attempts. This is used to detect brute-force attempts and abuse, nothing else.

If you buy a course: the order reference, plan, course and payment status. We never receive or store your card, UPI or bank details — those go directly to our payment provider and never touch our servers.

Staff actions: if you hold an admin, manager or trainer role, actions you take on other accounts are recorded in an audit log.

2. Why we use it

• To give you an account, track your progress and show scoreboards.
• To verify your email address and let you reset a forgotten password.
• To grant and enforce paid course access.
• To let trainers and managers see the progress of students in their own batches.
• To protect the platform against abuse, fraud and unauthorised access.

We send transactional email only — verification codes, password resets and essential service notices. We do not send marketing email unless you ask us to.

3. Who we share it with

We use three service providers, and only for the purposes below:

• Razorpay — payment processing. They handle your payment details directly under their own privacy policy.
• Brevo — delivery of verification and password-reset emails. They receive your email address and the message content.
• Fly.io — hosting. Your data is stored on servers in Singapore.

We do not sell, rent or trade your personal data. We disclose it otherwise only where the law requires it.

4. What is visible to others

Your username, points, rank and solved-challenge count appear on the public scoreboard and on your public profile. Your email address, batch details and payment history are never public — they are visible only to you and to authorised staff. If you upload a profile picture it is shown alongside your username.

5. Cookies and local storage

We use a single essential session cookie to keep you logged in. It is HttpOnly, Secure and SameSite-restricted, and it carries no tracking data. Your light/dark theme preference is kept in your browser's local storage and never sent to us. We use no advertising or third-party analytics cookies.

6. Security

Passwords are hashed, all traffic is served over HTTPS, session cookies are restricted, and login attempts are rate-limited. Only one session may be active per account, so a new login ends the others. No system is perfectly secure, but we treat the platform's own security separately from the intentionally vulnerable training labs, which are isolated and contain no real user data.

7. How long we keep it

We keep your account data for as long as your account exists. Security logs such as login attempts are short-lived. Payment records are retained as long as tax and accounting law requires, even after an account is deleted.

8. Your choices

You can view and change your username, email and password, and add or remove your profile picture, from your account page at any time. To request a copy of your data or deletion of your account, email learnctflab@gmail.com from your registered address. Deleting an account removes your personal details and progress; anonymised records required for accounting are retained.

9. Children

LabYard is not intended for children under 13. If you believe a child has registered, contact us and we will remove the account.

10. Changes and contact

We will update this policy as the platform changes; the date above shows the latest version. Questions or requests: learnctflab@gmail.com, or see the contact page.