Privacy Policy
Last Updated: May 2026
Effective For: Pointer Overflow CTF 2026 (POCTF 2026)
The data controller for the POCTF is Prof. C. R. Johnson, University of Wisconsin – Stevens Point, cjohnson@uwsp.edu.
The Pointer Overflow CTF (“POCTF”, “the contest”) is operated by the Center for Cybersecurity Studies & Advanced Research at the University of Wisconsin–Stevens Point. This Privacy Statement explains how participant information is collected, used, stored, and safeguarded.
Participation constitutes acceptance of this policy.
We collect only the information needed to run the contest fairly, securely, and effectively.
Discord Account Information (Authentication)
POCTF authenticates participants via Discord OAuth using the identify scope.
Discord provides us with your Discord user ID, current Discord username, and avatar URL.
We do not receive your email address, password, or any other Discord profile field through
this scope. We may, in the future, request the guilds.join scope so we can add
you to the official POCTF Discord on your behalf; that scope does not change what personal
data we receive.
Team Registration
- Team name (chosen at registration)
- Bracket: solo, team, or academic
- For academic teams: institution name, country, web domain, and a member’s institutional email address (used to verify academic affiliation)
Policy Agreements
When you accept the Rules, Privacy Policy, and Code of Conduct during registration, we record which policies you accepted, the version in effect at that time, your IP address, and a timestamp. This is a record of consent.
Platform and Usage Data
- IP address and user-agent on every login and registration event
- Login timestamps
- Error logs and security events
- Session cookies (HttpOnly, SameSite=Lax) and CSRF tokens for security
Discord & External Communication
- Visible username and messages in official channels
- Private organizer communication, retained for dispute resolution
Challenge Interaction & Flag System
Each challenge issues a per-team flag derived server-side using HMAC keyed on a secret that is never exposed to participants. When you submit a flag, we record your team ID, user ID, the submitted value, the timestamp, and whether the submission validated. This data is used for solve attribution, first-blood detection, dynamic scoring, and forensic review in the event of suspected cheating.
- Attempt timestamps and submitted values
- Solve times and per-team scoring state
- First Blood records
- Post-solve challenge ratings, if you choose to provide them
GitHub Linking (Optional)
Participants who wish to earn the Gentleman & a Scholar achievement may
optionally link their GitHub account. To verify ownership, you add a short code we issue
to your public GitHub bio; POCTF then makes a single request to
https://api.github.com/users/<username> and checks for the code. On
success we store a Discord-to-GitHub username mapping. We do not retain any other GitHub
profile data. You may unlink at any time from your profile page.
- Contest registration and account management
- Scoring, ranking, and challenge operation
- Security monitoring and rule enforcement
- Infrastructure improvement and debugging
- Prize eligibility, notifications, and delivery
- Anonymized academic/educational reporting
- Ensuring fairness and challenge integrity
We do not sell or license participant data.
Internal University Use
- Contest organizers and admins
- UWSP faculty/staff supporting the event
- University IT personnel when necessary
Prize Fulfillment
Email or name may be shared with UWSP offices for prize processing.
Legal or Security-Related Situations
- If required by law
- To investigate cheating or misuse
- To maintain the integrity of contest systems
We never share information with advertisers or external marketers.
POCTF welcomes participants worldwide. All official challenge materials, rules, hints, and announcements are provided in English to maintain fairness and consistency.
Organizers may rephrase or clarify wording when asked, but all participants receive the same information under the same conditions.
- Registration & scoring data: retained indefinitely as part of the contest's permanent record (Hall of Fame, scoreboard history).
- Flag submissions & security logs: retained for two (2) years for audit, forensic review, and challenge improvement, then deleted.
- Discord correspondence (private): retained for one (1) year unless an open dispute requires longer retention.
- Policy-agreement records: retained for two (2) years as proof of consent.
- GitHub-link mappings: retained while the link is active and for thirty (30) days after you unlink, then deleted.
- Prize distribution data: retained per UWSP financial policy.
You may request deletion of non-essential personal data after the contest concludes; see Participant Rights below.
We implement reasonable administrative, technical, and physical safeguards, including:
- Encrypted communication
- Access controls based on role
- Logging and monitoring for anomalies
- Hardened infrastructure and sanitization practices
No system is entirely risk-free, but we take security seriously and maintain best-effort protections.
In the event of a confirmed data security incident affecting participant personal data, POCTF will notify affected participants as required under Wisconsin law.
Every participant may:
- Access: request a copy of the personal data we hold about you.
- Correct: request correction of inaccurate information.
- Delete: request deletion of non-essential personal data after the event.
- Port: request export of your personal data in a machine-readable format.
- Restrict: ask us to limit how we process your data while a question is being resolved.
- Object: object to specific uses of your data.
- Inquire: ask how your data is used, stored, or protected.
Participants in the European Union, the United Kingdom, or the European Economic Area have these rights under their local data-protection law (GDPR / UK-GDPR) in addition to whatever rights apply under Wisconsin and United States law. To exercise any of these rights, email cjohnson@uwsp.edu.
If you have questions about this privacy policy:
- Email: cjohnson@uwsp.edu
- Discord: message
@CTF-Admin
This Privacy Statement may be updated prior to the start of POCTF 2026. Any significant changes will be announced on the contest website and via Discord. Participants should review this policy before the contest begins to ensure they are familiar with the current version.