Privacy Policy

This policy applies to SimulatedCyber and covers the public website, account setup, dashboard, Career Hub, simulated learning workspaces, and optional online Multiplayer access.

Your SimulatedCyber account uses Google sign-in or a verified email address and password. We store an account identifier, display name, sign-in identifiers, and session records. Your profile can include an optional photo and experience level. Existing username accounts remain supported and can add a verified email address.

As you use the simulations, you may create analyst notes, case summaries, reports, decisions, and other exercise responses. Please use synthetic or authorized information and do not enter passwords, private keys, employer secrets, or another person’s sensitive information.

SimulatedCyber records learning activity needed to operate the experience, such as completed scenarios, progress, tools used, actions and decisions, difficulty, timestamps, feedback, and skill evidence. It also stores preferences such as theme, reduced motion, learning hints, notification sounds, and compact layout.

This information personalizes the dashboard, suggests a next activity, and displays your completed practice. Your profile and completed solo history are saved to your account. Unfinished independent shifts and tool drafts remain on this browser, with recovery for seven days after saving. Guided training restarts when left.

Cloudflare Workers and D1 store your account profile and completed practice history, including saved incident notes and reports. A browser cache supports saving and recovery. Theme and accessibility preferences, unfinished shifts, and tool drafts remain device-local. Previous browser-only practice is imported only when you choose to import it.

Account switching keeps practice caches separate in the interface, but browser storage is not encrypted against someone who controls your device or browser profile. Signing out does not erase every cached copy. Clear site data on a shared computer after use, and keep exported reports private.

One individual account is used for solo practice and Multiplayer. Password credentials use salted scrypt hashes and a server-held pepper; plaintext passwords are not stored as account credentials. Google sign-in uses a verified Google identity. We request basic name, email, and identity information only, not access to Gmail, Drive, contacts, or other Google content.

Signed-in laptop and desktop users can create or join SOC Multiplayer without completing training first. Authentication, room membership, and role availability are checked separately. A local profile identifier or display name cannot grant account or room access.

Use a unique password of at least 15 characters. Email registration and password recovery use a browser-bound, one-use code that expires after ten minutes and permits at most five attempts. Resend delivers these messages and processes the destination address and email content. Codes and mail requests are rate-limited; verification email is not marketing enrollment.

Existing username accounts retain their account IDs and team history. Adding email or Google sign-in requires explicit ownership verification; matching names or email text do not automatically merge accounts. Archived passkey-era identities are not automatically claimed or merged.

Online rooms use Cloudflare Workers, Durable Objects, and D1 to process membership, display names, assigned responsibilities, presence, task ownership, exercise evidence, queries, decisions, notes, actions, timestamps, and team results. The server validates actions and progress. Room members can see shared task activity, submitted evidence and notes, and the team debrief; these are not private offline notes.

Team chat messages, their senders, and timestamps are shared with room members and stored for reconnects and session history. Teammates can also open a read-only view of your current simulator tool, submitted search, and selected evidence. This does not capture your screen, other applications, or unsent drafts.

Shared team results can include participants’ display names and contributions. Do not enter real credentials, confidential employer material, or another person’s sensitive information. Room codes are invitations, not a substitute for authentication and room authorization.

Cloudflare delivers and protects the production website and provides cookie-free Web Analytics and performance measurement. When your browser requests the site, Cloudflare may process ordinary request and security information such as the requested page, date and time, IP address, browser or user-agent information, network and security signals, and website performance measurements.

The Cloudflare Web Analytics beacon reports page views, route changes, and performance measurements. Cloudflare states that this beacon does not use cookies or access localStorage, sessionStorage, or IndexedDB. SimulatedCyber uses the resulting aggregate information to understand whether the public site is available and performing properly; it is not used for targeted advertising.

If you email simulatedcyber@gmail.com, the message and the information you include are processed through the email services used by you and SimulatedCyber. If you choose to visit Instagram or an external learning reference, that destination receives the normal technical information associated with visiting its site and applies its own privacy terms.

SimulatedCyber does not currently provide payment processing, advertising profiles, marketing email enrollment, or a remote AI service within the public application.

Your saved account profile and completed practice history remain until you delete your account. Device caches, preferences, unfinished work, and exported backup files can remain until you clear or remove them. Browser storage can also be removed by the browser. Clearing site data does not delete your server account.

Authentication sessions last up to seven days unless ended sooner. Email and Google sign-in flow records expire after ten minutes. Daily cleanup removes expired authentication, verification, and rate-limit records. Rooms have bounded lifetimes, and shared team results are removed by daily cleanup after their 90-day retention period from completion.

Team chat and live simulator-view state are retained within the room lifetime and removed when the expired room is cleaned up. Completed rooms remain available for up to 24 hours. Chat messages are not included in the separately retained historical team debrief.

Delete account requires typed DELETE confirmation, current-password verification or a recent Google sign-in, and leaving active team sessions first. It removes your sign-in identities, sessions, saved profile, and private practice history, along with this browser’s account cache. Exported files, previous unclaimed browser-only practice, and caches on other devices need separate removal. Shared historical team results may remain until their existing retention period ends.

Cloudflare controls retention of the infrastructure and aggregate analytics information it processes under its own documentation and privacy policy. Email providers store messages according to the sender’s and recipient’s account settings and their own policies.

SimulatedCyber uses HTTPS and browser and hosting security controls intended to protect the public site. No website or local storage system can guarantee absolute security, and local data is only as protected as the device and browser profile where it is stored.

You can edit your profile, change or reset an email password, connect a verified sign-in method, export completed practice, delete your account, and clear browser storage. Depending on where you live, additional privacy rights may apply. Contact simulatedcyber@gmail.com with a privacy question or request.