Effective 16 August 2026 · Operated by GreyNOC · Contact: [email protected]
The short version: GreyNOC has no accounts — your identity is a cryptographic key
that lives in your browser and never leaves it. Private rooms, direct messages, and calls are
end-to-end encrypted; we cannot read them. The Community Lobby, public rooms, and the feed are
public, and are erased whenever the server restarts. The core messenger sets no cookies;
GreyPath Operations uses functional cookies for authorization and run-resume state. GreyNOC
runs no ads and never sells your data. Anonymous daily visit and enrollment counts are described in section 8. Payments are handled entirely by
Stripe — your card number never touches our servers. California residents: we do not
sell or share your personal information and we honor your CCPA/CPRA rights — see the
California Privacy Notice in section 11.
1. Who we are
GreyNOC operates this service (the Academy campus, Code Lab, training programs, certifications,
DROP advisory board, and the GreyNOC OS arcade) at chat.grey-noc.com. For
anything in this document — questions, data requests, complaints — email
[email protected].
2. No accounts — your identity is a device key
We do not collect names, emails, phone numbers, or passwords to use GreyNOC. Your identity is an
Ed25519 key pair generated in your browser on first use. The private key never leaves your
device; the server only ever sees the public half, which acts as your pseudonymous handle.
Your screen name is whatever you choose — it does not need to be your real name.
Because we hold no account record, losing your device key (for example by clearing browser
storage without a migration code) is unrecoverable by design.
3. What we can never read (end-to-end encrypted)
- Private rooms, 1:1 direct messages, and voice/video calls run peer-to-peer over
WebRTC. The server relays only connection signaling (who is connecting to whom) — the
content flows directly between participants, end-to-end encrypted.
- Code Lab collaboration sessions use the same peer-to-peer channels.
- Offline messages (sent while a buddy is away) are sealed on your device with hybrid
post-quantum encryption (X25519 + ML-KEM-768) to the recipient's key. The server stores only
the ciphertext plus routing metadata (sender and recipient public keys, sender screen name,
timestamps). Sealed messages are deleted on delivery, or after 7 days if never collected.
- Room passwords are never sent to the server — only a salted verifier.
WebRTC connection setup uses Google's public STUN servers and may reveal network metadata,
including IP information, to Google and to the peers you connect with. STUN does not receive
the encrypted room, message, or call content.
4. What is public in the app
The Community Lobby, public rooms, and the home feed are not private: what
you post there is visible to everyone connected and passes through the server in plaintext.
This community content is held in server memory only and is erased whenever the server
restarts. DROP advisories you publish are public by intent and persist until you
delete them or the bounded advisory store prunes the oldest entries (you can delete your own
advisories in-app). Presence — your screen
name, online/away status, and the “where in the app” activity badge — is
broadcast to other users while you are connected; you can blank the activity badge with
Hide my activity in Settings or leave the roster entirely with appear offline.
Presence is never written to disk.
5. What we store, and for how long
Persisted server-side, keyed to your identity key or an opaque vault token your browser holds:
These records survive server restarts. The store has bounded capacity; if a limit is reached,
the service may prune the oldest or least-recently-used records before the retention event
listed below.
- Saved profiles (display preferences you save) — until you delete or wipe them.
- Training progress (BB Academy, Whitehat Foundations, GreyPath), exam records, and
server-graded completions — until you wipe them.
- Written exam reports: complete submitted text, submission identifiers, grading results and
exact-duplicate penalties are stored with your identity, including completed reports from failed exams.
Authorized administrators can review these reports and your Academy account records. Reports remain
until you wipe your Academy data; report capacity limits refuse new submissions rather than deleting
existing reports. Duplicate comparison covers retained submissions only. Do not include real secrets or
personal information in case reports. Administrators can revoke or restore credentials with a recorded
reason; revocation is reflected on the public verification page.
- Exam attempt limits: four failed attempts lock an exam until an administrator approves
a learner review ticket. Lessons remain available. Minimal identity-linked failure counters and
lock identifiers remain after a profile wipe to prevent resetting this limit; written reports and
submission receipts are erased. There is no automatic time-based reset.
- Certificates: the credential record and the certificate name you enter. The name is
permanent once locked and is shown publicly at
/verify to anyone who has
the certificate's unguessable serial. GreyPath operation certificates may use a separate
name you choose for that credential; it is locked when you connect the completion to your
GreyNOC key. Treat sharing a certificate serial as publishing its printed name.
A full wipe removes your certificates and the locked name.
- Buddy list: mutual buddy relationships and pending requests (with sender screen
names), so requests survive while you're offline. Pending requests and results expire after
30 days; mutual relationships remain until removed or capacity-pruned.
- Study cohort membership: which study cohorts you joined or an administrator placed you
in, and when, keyed to your identity key. Administrators can add, move or remove members, and
those changes are recorded in an operator audit log. Public cohort listings show only how many
members a cohort has, never who they are. Cohort members and administrators can see its private
profile photo, description, and roster; the member view uses cohort-only pseudonyms rather than
profile names or identity keys. Leaving or being removed also revokes access to its profile,
board, and live meetings. Membership ends when you leave the cohort, when an
administrator removes you or deletes the cohort, when you wipe your data, or 180 days after the
cohort's end date (or after it was stopped, if that was later).
- Cohort board posts: what you post on a cohort's board, the time, and the name it is shown
under (your locked certificate name if you have one, otherwise the name you post under; a name that
reads as GreyNOC, the Academy or its staff is shown as "Learner"), keyed to your identity key. Each
post also shows a short tag that is the same for you across one cohort's board and different on every
other board, so members can tell posters apart; it is derived with a server secret and does not reveal
your key. Only that cohort's members and administrators can read the board. A post is removed when you
delete it (the Cohorts page lists every post you have made, on any board, even after you leave), when
an administrator removes it or deletes the cohort, when you wipe your data, or with the cohort itself
180 days after its end date.
- Arcade & range records: GreyNOC OS CTF solves, FRAGNET match stats, GreyNet
Browser solves, and related handles.
- Promotion records: redeemed promotion codes and the associated entitlement period,
keyed to your identity key.
- Academy support tickets: your identity public key, handle, category, message and any
code you choose to attach, course/app context, replies, status, and timestamps. Tickets remain
until removed on request or capacity-pruned.
- Public key material: your identity public key and any signed ML-KEM public prekey you
publish so other users can address and encrypt offline messages to you.
- Pro billing record — see section 6.
- Sealed offline messages addressed to you — see section 3.
Browser-only state includes your private keys, appearance and
preferences, trust pins for buddies' keys, and cached progress, kept
on this device only. You can wipe it any time (section 10).
6. Payments (Stripe)
GreyNOC Pro checkout happens on Stripe's hosted payment page. Your card details go
directly to Stripe and never touch GreyNOC's servers. We pass Stripe your identity
public key as the purchase reference; Stripe returns and we store: your Pro status, Stripe
customer and subscription IDs, your checkout email, and the renewal date — keyed to
your identity key so your entitlement can be honored and refunds or chargebacks can revoke it.
Subscriptions are cancellable any time under Settings › Full Access & billing (which
opens Stripe's billing portal) or from the receipt Stripe emails you; access continues until the
end of the paid period. Stripe processes your payment data under its own privacy policy.
7. IP addresses & security logs
We use your IP address transiently for rate limiting and abuse defense (connection caps,
attack-pattern scoring, temporary bans). This data lives in server memory with short windows
(roughly 10-minute scoring, 15-minute automatic bans). High-severity security events (for
example, exploit probes) may be written to server console logs with the offending IP.
Operator-imposed manual bans store the IP, reason, and timestamps until they expire or are
lifted, and may be permanent; placing one also disconnects any connection already open from
that address. Bounded administrative-control and GreyPath-deletion audit records also store
the operator's IP. The administrative console can display the connection IP of a live session
alongside the screen name on it, for as long as that connection is open: the pairing is read
from the open connection when an authorised operator loads the page, is never written to disk,
and is never sent to other users — the buddy list and every other client-facing view continue
to carry no address information at all. If an operator then bans or unbans an address, that action is
written to a bounded administrative audit trail that records the address, the operator's own
address, the duration, and the reason they gave — and when the ban was placed from a session,
that reason may name the screen name it was placed for. Those audit entries persist after the
ban itself expires or is lifted, until they age out of the trail.
8. Cookies & local storage
The core messenger sets no cookies and GreyNOC embeds no third-party analytics, ad, or fingerprinting
scripts. GreyPath Operations sets signed, functional HttpOnly cookies: one remembers acceptance
of its authorization statement (normally 30 days), and separate cookies resume in-progress
Black Glass, Quiet Meridian, and Last Light runs (normally 12 hours). They are scoped to the
relevant /greypath routes, use SameSite=Strict, and are marked
Secure in production. Client state such as identity keys, preferences, progress,
the 18+ confirmation, and trust pins are kept in browser local
storage to make the app function. Our edge provider (Cloudflare) may set its own operational
cookies as part of serving the site.
Our own Academy usage counters record visits, free-operation steps, enrollment steps, and confirmed purchases
as daily aggregate totals retained for up to 120 days. Browser events send only a predefined event name;
the counters do not store a visitor identifier, identity key, URL, referrer, user agent, or raw IP address.
Requests still pass through normal IP-based rate limiting and our edge provider. Browser-only receipts
prevent the same event from being counted repeatedly in one day and are pruned after 35 days when updated.
The counters start on your first public page view, before any confirmation or profile exists, and do
not submit lesson answers or code.
We count visits and enrollment steps from your first public page view onward (the age and policy
confirmation comes later, at the campus door) using our own daily
aggregate counters, retained for up to 120 days. These counters store event names and
totals, not identity keys, names, URLs, referrers, user agents, raw IP addresses,
lesson answers, or code. Ordinary request rate limits and our edge provider still
process connection information. Browser-local receipts prevent duplicate counts:
dated receipts are pruned after 35 days when updated, while the first-dashboard
receipt remains until browser storage is cleared.
9. Service providers
- Stripe (payments) — receives what you enter at checkout; sends us the billing
record described in section 6.
- Cloudflare (edge proxy/CDN) — all traffic to
chat.grey-noc.com
transits Cloudflare, which sees client IPs and request metadata and keeps edge logs under its
own policy.
- Google public STUN (WebRTC connectivity) — browsers contact
stun.l.google.com and stun1.l.google.com, which can receive IP and
connection metadata but not encrypted room, message, or call content.
- Self-hosted origin — the server and its data store are operated by GreyNOC,
not a third-party database service.
We do not sell personal information, and we do not share it for advertising. Ever.
10. Your choices & rights
The KEEP / WIPE switch in Settings' Danger Zone erases your local identity and settings,
and deletes your server-side saved profiles, training progress, exam records, and certificates
(including the locked certificate name). Because of how the system is built, a wipe does
not remove: your Pro billing record (including the checkout email), sealed offline
messages queued for you, buddy-list entries, published encryption prekeys,
GreyNOC OS, FRAGNET, and GreyNet Browser records, promotion records, Academy support
tickets, minimal exam-attempt counters and locks, security/ban/audit records, or DROP advisories you published (delete those in-app first).
To have those residuals removed
— or to request a copy of the data we hold against your identity key — email
[email protected]. We verify such requests by
asking you to prove control of the identity key (and, for billing records, the checkout email),
since that key is the only thing that ties data to you.
If you are in the EU/UK (GDPR) or California (CCPA/CPRA), the rights to access, correct,
delete, and port your data apply as described above; we honor them regardless of where you
live. California residents: section 11 is your full California Privacy Notice, including
the categories we collect, how to exercise each right, and our response times. We cannot
produce end-to-end encrypted content in response to any request — we do not hold the
keys. We process the little personal data we have to provide the service you request
(contract), and to keep the service secure (legitimate interest).
11. California Privacy Notice (CCPA/CPRA)
This section is the notice California residents are entitled to under the California Consumer
Privacy Act as amended by the CPRA. GreyNOC is available to California residents. We
honor everything below regardless of whether the CCPA's business-size thresholds actually
apply to us — we would rather meet the standard than argue about it.
11.1 Notice at collection — what we collect and why
You see a short version of this notice on the age & policy confirmation, which we show before
a first-time visitor creates a learner profile or enters the community campus. Loading the public
page still means your request reaches our edge provider and server, which see your IP address,
and the limited aggregate counters and browser receipt described in section 8 begin with that
public-page visit. The real-time service connection and locally generated identity keypair are
deferred until the campus boots — when you ask to enter, return as an onboarded visitor, or
open a campus deep link. The private key remains on your device; the public identity is used by
campus services as described in sections 3, 7, and 9.
Sections 3–9 above are the long version; the statutory categories map onto them like
this:
- Identifiers — your identity public key (a pseudonymous handle, not a name),
the screen name you choose, your IP address, and, if you buy Pro, the checkout email Stripe
returns to us. Purpose: operate the service, deliver your entitlement, defend
against abuse.
- Commercial information — your Pro status, Stripe customer/subscription IDs,
renewal date, and any promotion code you redeem (section 6). Purpose: honor and
bill the subscription, apply refunds and chargebacks.
- Internet or other electronic network activity — training progress, exam
records, certificates and the name you lock to them, buddy-list relationships, arcade and
range records, Academy support tickets, and short-lived security/rate-limit records
(sections 5 and 7). Purpose: provide the training and community features you use,
and keep the service secure.
- Communications content — public rooms, the Community Lobby, and the feed pass
through our server in plaintext and are erased on restart; private rooms, direct messages,
and calls are end-to-end encrypted and we cannot read them; offline messages sit as
ciphertext we cannot open (section 3). Purpose: relay your messages, which is what
a chat service does.
We do not collect Social Security or government ID numbers, financial account numbers
(Stripe holds those, not us), biometric information, precise device geolocation from the app,
education records as defined by FERPA, or inferences drawn to build a profile about you. We
run no ads, no third-party analytics, and no fingerprinting.
11.2 Retention
We keep each category only as long as section 5 describes: pending buddy requests and results
expire after 30 days, uncollected sealed messages after 7 days, IP scoring within roughly
10–15 minutes (longer only for manual bans and audit records), and community content
until the next server restart. Saved profiles, training progress, exam records, and
certificates persist until you wipe them. Records a wipe does not reach — your Pro
billing record and checkout email, promotion records, buddy-list entries, published prekeys,
arcade and range records, support tickets, and the rest of the section 10
list — persist until you ask us to remove them; security, ban, and audit records are kept
for as long as they serve that purpose, and an operator-imposed ban may be permanent
(section 7). The store has bounded capacity, so the oldest or least-recently-used records may
be pruned sooner. We do not keep personal information for longer than needed for these
purposes.
11.3 We do not sell or share your personal information
We have not sold personal information, and we have not shared it for cross-context
behavioral advertising, in the preceding 12 months — nor will we. We do not sell or
share the personal information of anyone, including minors under 16. Because there is nothing
to opt out of, GreyNOC does not run a “Do Not Sell or Share My Personal Information”
link; if that ever changes, this section changes with it and the link appears. The service
providers in section 9 (Stripe, Cloudflare) process data on our behalf under contract, which
is not a sale or a share.
11.4 Sensitive personal information
We do not use or disclose sensitive personal information for any purpose beyond what is
necessary to provide the service you asked for. We do not use it to infer characteristics
about you. Your identity private key — the credential that would unlock
everything — never leaves your device, so we never hold it. Because we make no use of
sensitive personal information that the CPRA lets you limit, the “Limit the Use of My
Sensitive Personal Information” right would not change how we handle your data; you can
exercise it anyway and we will confirm it in writing.
11.5 Your California rights
- Right to know — the categories and specific pieces of personal information we
hold about you, the sources, our purposes, and the categories of recipients.
- Right to delete — deletion of personal information we hold, subject to the
statutory exceptions (for example, records we must keep to complete a transaction, to
detect security incidents, or to comply with law).
- Right to correct — correction of inaccurate personal information.
- Right to portability — a copy of what we hold in a readily usable format.
- Right to opt out of sale/sharing — we do not sell or share, so there is
nothing to opt out of (11.3).
- Right to limit use of sensitive personal information — see 11.4.
- Right to non-discrimination — we will not deny you service, charge you a
different price, or give you a lower level of service for exercising any of these rights.
GreyNOC Pro is a paid tier open to everyone on the same terms and has nothing to do with
privacy choices.
11.6 How to exercise them
Most of it you can do yourself, instantly, without asking us: the KEEP / WIPE switch in
Settings' Danger Zone deletes your local identity and your server-side profiles, progress,
exam records, and certificates. For anything the wipe leaves behind (section 10), email
[email protected] with the request
you are making. That mailbox is the designated method for all California requests.
How we verify you. GreyNOC has no accounts, so the only thing that ties data to you is
your identity key: we ask you to prove control of it by signing a challenge we send (and, for
billing records, to confirm the checkout email). We cannot honor a request we cannot verify to
this standard, and the law does not require us to re-identify data we hold in a form that
cannot be linked to a real person — but we will always tell you which of the two it was
rather than going quiet. An authorized agent may submit a request for you with your
written permission; we will still need the key-control proof.
Timing. We confirm receipt within 10 business days and respond within 45 calendar days.
If we need more time we will tell you before the 45 days are up and take at most another 45
(90 total). We do not charge a fee to handle these requests, unless one is manifestly
unfounded or excessive, in which case we will explain before doing anything.
What we cannot produce. End-to-end encrypted content — private rooms, direct
messages, calls, and sealed offline mail — is not something we can hand over, correct,
or read on request. We do not hold the keys. That is a design property of the service, not a
refusal.
11.7 Shine the Light (Cal. Civ. Code § 1798.83)
We do not disclose personal information to third parties for those parties' own direct
marketing purposes. If you want that confirmed in writing, email us and we will send it.
11.8 California users under 18 (Cal. Bus. & Prof. Code § 22581)
GreyNOC is an 18+ service (section 12) and is not directed to minors. If content was
nonetheless posted here by someone under 18, that person — or a parent or guardian
— may email us to have it removed. Removal takes the post out of public view; it may not
erase copies other users already saw, and public community content is erased on server restart
in any event.
11.9 Consumer complaints (Cal. Civ. Code § 1789.3)
GreyNOC's free features cost nothing; the current Full Access price is shown on the Full Access page
before you check out. To file a complaint about the service, email
[email protected]. California
residents may also contact the Complaint Assistance Unit of the Division of Consumer Services
of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite
N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.
12. Age requirement
Creating a learner profile and using the community campus require you to be
18 or older, self-attested on the age & policy confirmation shown before either one
(that confirmation is the only place we ask). Public course information, the free operation,
pricing and the playbook library are open to read without it. The service is not directed to
children, and we do not knowingly collect personal information from anyone under 18 —
if you believe we hold such data, email us and we will delete it promptly.
13. Security & incidents
Beyond end-to-end encryption, the service uses signed identities, post-quantum sealing for
offline mail, a hardened content-security policy, and active abuse monitoring. No system is
perfect: if a breach affects personal data we hold, we will notify affected users where
feasible and any supervisory authority as required by law (including within 72 hours where
GDPR applies). Security researchers: responsible disclosure is welcome — see the
project's security policy before testing anything.
14. Changes to this policy
We may update this document as the service evolves. Material changes will be posted here with
a new effective date; continuing to use GreyNOC after a change takes effect means you accept
the updated version.
User Agreement
a. Acceptance & eligibility
By using GreyNOC you agree to this User Agreement and the Privacy Policy above. You must be at
least 18 years old.
b. California residents
GreyNOC is offered to California residents on the same terms as everyone else. Section
11 of the Privacy Policy is your California Privacy Notice: it lists what we collect, states
that we neither sell nor share personal information, and explains how to exercise your
CCPA/CPRA rights. We will not deny service, change your price, or degrade your experience
because you exercised those rights. Nothing in this agreement waives a right California
law gives you, and where any term here conflicts with California law as it applies to you,
California law controls and the rest of this agreement stays in effect.
c. Your identity key is your responsibility
Access, entitlements, and credentials are bound to your device identity key. Keep your device
and browser storage safe. If you lose the key without a Pro migration code, we cannot restore
what was bound to it — there is no account-recovery back door, on purpose.
d. Acceptable use
- Use GreyNOC only lawfully. No harassment, threats, doxxing, child sexual abuse material,
malware distribution, spam, or impersonation.
- Public spaces are lightly moderated. We may remove content, revoke certificates obtained
dishonestly, and ban identities, devices, or IPs at our discretion to protect the community.
- Security-training terms: the skills taught in BB Academy, Whitehat Foundations, GreyPath, and
GreyNOC OS are for systems you own or are explicitly authorized to test. The in-app ranges
and arcade targets are the only systems this service authorizes you to attack.
Attacking the service itself outside the responsible-disclosure process is prohibited.
e. Your content
You keep ownership of what you post. You grant GreyNOC the limited license needed to display
and relay it to other users (that is what a chat service does). Public posts are public;
community content is ephemeral and vanishes on server restart, so keep your own copies of
anything you care about.
f. GreyNOC Pro
- Pro is billed by Stripe as a subscription (or one-time purchase where offered) and unlocks
the features listed on the Full Access page. Prices may change; changes apply from your next
renewal, never retroactively.
- The entitlement is bound to your identity key. A few browsers may be signed in to one plan:
sign in on another browser with your checkout email and a migration code generated on a
browser that already has Full Access, and generate one before wiping a browser — it is
the only way to carry Pro across.
- Cancel any time under Settings › Full Access & billing or from Stripe's receipt
email; access continues until the paid period ends and nothing further is charged. Refunds or
chargebacks may result in revocation.
g. Certifications
Certificates are earned by passing open-book, server-graded exams and are issued under the name you
lock, verifiable by anyone holding the certificate serial. Cheating, sharing exam content, or
gaming the grader voids the credential.
h. Disclaimers
The service, including all training content, is provided “as is”, without
warranty of any kind. Educational material is not professional, legal, or career advice.
We do not guarantee uptime — community data does not survive restarts, and the service
may change or end at any time.
i. Limitation of liability
To the maximum extent permitted by law, GreyNOC's total liability for any claim arising from
the service is limited to the amount you paid us in the twelve months before the claim, and we
are not liable for indirect, incidental, or consequential damages.
j. Termination
You can stop using GreyNOC at any time (see section 10 for erasure). We may suspend or
terminate access for violations of this agreement.
k. Governing law
This agreement is governed by the laws of the United States. If any provision is found
unenforceable, the rest remains in effect.
l. Contact
Questions about this agreement or your data: [email protected].
GreyNOC
