Privacy & User Agreement

Effective 16 August 2026 · Operated by GreyNOC · Contact: [email protected]

1. Who we are

GreyNOC operates this service (the Academy campus, Code Lab, training programs, certifications, DROP advisory board, and the GreyNOC OS arcade) at chat.grey-noc.com. For anything in this document — questions, data requests, complaints — email [email protected].

2. No accounts — your identity is a device key

We do not collect names, emails, phone numbers, or passwords to use GreyNOC. Your identity is an Ed25519 key pair generated in your browser on first use. The private key never leaves your device; the server only ever sees the public half, which acts as your pseudonymous handle. Your screen name is whatever you choose — it does not need to be your real name. Because we hold no account record, losing your device key (for example by clearing browser storage without a migration code) is unrecoverable by design.

3. What we can never read (end-to-end encrypted)

• Private rooms, 1:1 direct messages, and voice/video calls run peer-to-peer over WebRTC. The server relays only connection signaling (who is connecting to whom) — the content flows directly between participants, end-to-end encrypted.
• Code Lab collaboration sessions use the same peer-to-peer channels.
• Offline messages (sent while a buddy is away) are sealed on your device with hybrid post-quantum encryption (X25519 + ML-KEM-768) to the recipient's key. The server stores only the ciphertext plus routing metadata (sender and recipient public keys, sender screen name, timestamps). Sealed messages are deleted on delivery, or after 7 days if never collected.
• Room passwords are never sent to the server — only a salted verifier.

WebRTC connection setup uses Google's public STUN servers and may reveal network metadata, including IP information, to Google and to the peers you connect with. STUN does not receive the encrypted room, message, or call content.

4. What is public in the app

The Community Lobby, public rooms, and the home feed are not private: what you post there is visible to everyone connected and passes through the server in plaintext. This community content is held in server memory only and is erased whenever the server restarts. DROP advisories you publish are public by intent and persist until you delete them or the bounded advisory store prunes the oldest entries (you can delete your own advisories in-app). Presence — your screen name, online/away status, and the “where in the app” activity badge — is broadcast to other users while you are connected; you can blank the activity badge with Hide my activity in Settings or leave the roster entirely with appear offline. Presence is never written to disk.

5. What we store, and for how long

Persisted server-side, keyed to your identity key or an opaque vault token your browser holds:

These records survive server restarts. The store has bounded capacity; if a limit is reached, the service may prune the oldest or least-recently-used records before the retention event listed below.

• Saved profiles (display preferences you save) — until you delete or wipe them.
• Training progress (BB Academy, Whitehat Foundations, GreyPath), exam records, and server-graded completions — until you wipe them.
• Written exam reports: complete submitted text, submission identifiers, grading results and exact-duplicate penalties are stored with your identity, including completed reports from failed exams. Authorized administrators can review these reports and your Academy account records. Reports remain until you wipe your Academy data; report capacity limits refuse new submissions rather than deleting existing reports. Duplicate comparison covers retained submissions only. Do not include real secrets or personal information in case reports. Administrators can revoke or restore credentials with a recorded reason; revocation is reflected on the public verification page.
• Exam attempt limits: four failed attempts lock an exam until an administrator approves a learner review ticket. Lessons remain available. Minimal identity-linked failure counters and lock identifiers remain after a profile wipe to prevent resetting this limit; written reports and submission receipts are erased. There is no automatic time-based reset.
• Certificates: the credential record and the certificate name you enter. The name is permanent once locked and is shown publicly at /verify to anyone who has the certificate's unguessable serial. GreyPath operation certificates may use a separate name you choose for that credential; it is locked when you connect the completion to your GreyNOC key. Treat sharing a certificate serial as publishing its printed name. A full wipe removes your certificates and the locked name.
• Buddy list: mutual buddy relationships and pending requests (with sender screen names), so requests survive while you're offline. Pending requests and results expire after 30 days; mutual relationships remain until removed or capacity-pruned.
• Arcade & range records: GreyNOC OS CTF solves, FRAGNET match stats, GreyNet Browser solves, and related handles.
• Promotion records: redeemed promotion codes and the associated entitlement period, keyed to your identity key.
• Academy support tickets: your identity public key, handle, category, message and any code you choose to attach, course/app context, replies, status, and timestamps. Tickets remain until removed on request or capacity-pruned.
• Public key material: your identity public key and any signed ML-KEM public prekey you publish so other users can address and encrypt offline messages to you.
• Pro billing record — see section 6.
• Sealed offline messages addressed to you — see section 3.

Browser-only state includes your private keys, theme and preferences, trust pins for buddies' keys, and cached progress, kept on this device only. You can wipe it any time (section 10).

6. Payments (Stripe)

GreyNOC Pro checkout happens on Stripe's hosted payment page. Your card details go directly to Stripe and never touch GreyNOC's servers. We pass Stripe your identity public key as the purchase reference; Stripe returns and we store: your Pro status, Stripe customer and subscription IDs, your checkout email, and the renewal date — keyed to your identity key so your entitlement can be honored and refunds or chargebacks can revoke it. Subscriptions are cancellable any time from the receipt Stripe emails you. Stripe processes your payment data under its own privacy policy.

7. IP addresses & security logs

We use your IP address transiently for rate limiting and abuse defense (connection caps, attack-pattern scoring, temporary bans). This data lives in server memory with short windows (roughly 10-minute scoring, 15-minute automatic bans). High-severity security events (for example, exploit probes) may be written to server console logs with the offending IP. Operator-imposed manual bans store the IP, reason, and timestamps until they expire or are lifted, and may be permanent; placing one also disconnects any connection already open from that address. Bounded administrative-control and GreyPath-deletion audit records also store the operator's IP. The administrative console can display the connection IP of a live session alongside the screen name on it, for as long as that connection is open: the pairing is read from the open connection when an authorised operator loads the page, is never written to disk, and is never sent to other users — the buddy list and every other client-facing view continue to carry no address information at all. If an operator then bans or unbans an address, that action is written to a bounded administrative audit trail that records the address, the operator's own address, the duration, and the reason they gave — and when the ban was placed from a session, that reason may name the screen name it was placed for. Those audit entries persist after the ban itself expires or is lifted, until they age out of the trail.

8. Cookies & local storage

The core messenger sets no cookies and GreyNOC embeds no third-party analytics, ad, or fingerprinting scripts. GreyPath Operations sets signed, functional HttpOnly cookies: one remembers acceptance of its authorization statement (normally 30 days), and separate cookies resume in-progress Black Glass, Quiet Meridian, and Last Light runs (normally 12 hours). They are scoped to the relevant /greypath routes, use SameSite=Strict, and are marked Secure in production. Client state such as identity keys, preferences, progress, the 18+ confirmation, and trust pins are kept in browser local storage to make the app function. Our edge provider (Cloudflare) may set its own operational cookies as part of serving the site.

We count visits and enrollment steps from the age gate onward using our own daily aggregate counters, retained for up to 120 days. These counters store event names and totals, not identity keys, names, URLs, referrers, user agents, raw IP addresses, lesson answers, or code. Ordinary request rate limits and our edge provider still process connection information. Browser-local receipts prevent duplicate counts: dated receipts are pruned after 35 days when updated, while the first-dashboard receipt remains until browser storage is cleared.

9. Service providers

• Stripe (payments) — receives what you enter at checkout; sends us the billing record described in section 6.
• Cloudflare (edge proxy/CDN) — all traffic to chat.grey-noc.com transits Cloudflare, which sees client IPs and request metadata and keeps edge logs under its own policy.
• Google public STUN (WebRTC connectivity) — browsers contact stun.l.google.com and stun1.l.google.com, which can receive IP and connection metadata but not encrypted room, message, or call content.
• Self-hosted origin — the server and its data store are operated by GreyNOC, not a third-party database service.

We do not sell personal information, and we do not share it for advertising. Ever.

10. Your choices & rights

The KEEP / WIPE switch in Settings' Danger Zone erases your local identity and settings, and deletes your server-side saved profiles, training progress, exam records, and certificates (including the locked certificate name). Because of how the system is built, a wipe does not remove: your Pro billing record (including the checkout email), sealed offline messages queued for you, buddy-list entries, published encryption prekeys, GreyNOC OS, FRAGNET, and GreyNet Browser records, promotion records, Academy support tickets, minimal exam-attempt counters and locks, security/ban/audit records, or DROP advisories you published (delete those in-app first). To have those residuals removed — or to request a copy of the data we hold against your identity key — email [email protected]. We verify such requests by asking you to prove control of the identity key (and, for billing records, the checkout email), since that key is the only thing that ties data to you.

If you are in the EU/UK (GDPR) or California (CCPA/CPRA), the rights to access, correct, delete, and port your data apply as described above; we honor them regardless of where you live. California residents: section 11 is your full California Privacy Notice, including the categories we collect, how to exercise each right, and our response times. We cannot produce end-to-end encrypted content in response to any request — we do not hold the keys. We process the little personal data we have to provide the service you request (contract), and to keep the service secure (legitimate interest).

11. California Privacy Notice (CCPA/CPRA)

This section is the notice California residents are entitled to under the California Consumer Privacy Act as amended by the CPRA. GreyNOC is available to California residents. We honor everything below regardless of whether the CCPA's business-size thresholds actually apply to us — we would rather meet the standard than argue about it.

11.1 Notice at collection — what we collect and why

You see a short version of this notice on the age & policy gate, before any record is written against your identity key. To be exact about what the gate cannot come before: loading the page at all means your request reaches our edge provider and our server, which see your IP address; the app opens its service connection as the script loads; and your browser generates your identity keypair locally at that same moment (sections 7 and 9). That transport-level collection is how the page arrives on your screen, so it cannot wait behind a gate the page itself renders, and the keypair is created on your device before it is ever sent anywhere. Everything else does wait. Sections 3–9 above are the long version; the statutory categories map onto them like this:

• Identifiers — your identity public key (a pseudonymous handle, not a name), the screen name you choose, your IP address, and, if you buy Pro, the checkout email Stripe returns to us. Purpose: operate the service, deliver your entitlement, defend against abuse.
• Commercial information — your Pro status, Stripe customer/subscription IDs, renewal date, and any promotion code you redeem (section 6). Purpose: honor and bill the subscription, apply refunds and chargebacks.
• Internet or other electronic network activity — training progress, exam records, certificates and the name you lock to them, buddy-list relationships, arcade and range records, Academy support tickets, and short-lived security/rate-limit records (sections 5 and 7). Purpose: provide the training and community features you use, and keep the service secure.
• Communications content — public rooms, the Community Lobby, and the feed pass through our server in plaintext and are erased on restart; private rooms, direct messages, and calls are end-to-end encrypted and we cannot read them; offline messages sit as ciphertext we cannot open (section 3). Purpose: relay your messages, which is what a chat service does.

We do not collect Social Security or government ID numbers, financial account numbers (Stripe holds those, not us), biometric information, precise device geolocation from the app, education records as defined by FERPA, or inferences drawn to build a profile about you. We run no ads, no third-party analytics, and no fingerprinting.

11.2 Retention

We keep each category only as long as section 5 describes: pending buddy requests and results expire after 30 days, uncollected sealed messages after 7 days, IP scoring within roughly 10–15 minutes (longer only for manual bans and audit records), and community content until the next server restart. Saved profiles, training progress, exam records, and certificates persist until you wipe them. Records a wipe does not reach — your Pro billing record and checkout email, promotion records, buddy-list entries, published prekeys, arcade and range records, support tickets, and the rest of the section 10 list — persist until you ask us to remove them; security, ban, and audit records are kept for as long as they serve that purpose, and an operator-imposed ban may be permanent (section 7). The store has bounded capacity, so the oldest or least-recently-used records may be pruned sooner. We do not keep personal information for longer than needed for these purposes.

11.3 We do not sell or share your personal information

We have not sold personal information, and we have not shared it for cross-context behavioral advertising, in the preceding 12 months — nor will we. We do not sell or share the personal information of anyone, including minors under 16. Because there is nothing to opt out of, GreyNOC does not run a “Do Not Sell or Share My Personal Information” link; if that ever changes, this section changes with it and the link appears. The service providers in section 9 (Stripe, Cloudflare) process data on our behalf under contract, which is not a sale or a share.

11.4 Sensitive personal information

We do not use or disclose sensitive personal information for any purpose beyond what is necessary to provide the service you asked for. We do not use it to infer characteristics about you. Your identity private key — the credential that would unlock everything — never leaves your device, so we never hold it. Because we make no use of sensitive personal information that the CPRA lets you limit, the “Limit the Use of My Sensitive Personal Information” right would not change how we handle your data; you can exercise it anyway and we will confirm it in writing.

11.5 Your California rights

• Right to know — the categories and specific pieces of personal information we hold about you, the sources, our purposes, and the categories of recipients.
• Right to delete — deletion of personal information we hold, subject to the statutory exceptions (for example, records we must keep to complete a transaction, to detect security incidents, or to comply with law).
• Right to correct — correction of inaccurate personal information.
• Right to portability — a copy of what we hold in a readily usable format.
• Right to opt out of sale/sharing — we do not sell or share, so there is nothing to opt out of (11.3).
• Right to limit use of sensitive personal information — see 11.4.
• Right to non-discrimination — we will not deny you service, charge you a different price, or give you a lower level of service for exercising any of these rights. GreyNOC Pro is a paid tier open to everyone on the same terms and has nothing to do with privacy choices.

11.6 How to exercise them

Most of it you can do yourself, instantly, without asking us: the KEEP / WIPE switch in Settings' Danger Zone deletes your local identity and your server-side profiles, progress, exam records, and certificates. For anything the wipe leaves behind (section 10), email [email protected] with the request you are making. That mailbox is the designated method for all California requests.

How we verify you. GreyNOC has no accounts, so the only thing that ties data to you is your identity key: we ask you to prove control of it by signing a challenge we send (and, for billing records, to confirm the checkout email). We cannot honor a request we cannot verify to this standard, and the law does not require us to re-identify data we hold in a form that cannot be linked to a real person — but we will always tell you which of the two it was rather than going quiet. An authorized agent may submit a request for you with your written permission; we will still need the key-control proof.

Timing. We confirm receipt within 10 business days and respond within 45 calendar days. If we need more time we will tell you before the 45 days are up and take at most another 45 (90 total). We do not charge a fee to handle these requests, unless one is manifestly unfounded or excessive, in which case we will explain before doing anything.

What we cannot produce. End-to-end encrypted content — private rooms, direct messages, calls, and sealed offline mail — is not something we can hand over, correct, or read on request. We do not hold the keys. That is a design property of the service, not a refusal.

11.7 Shine the Light (Cal. Civ. Code § 1798.83)

We do not disclose personal information to third parties for those parties' own direct marketing purposes. If you want that confirmed in writing, email us and we will send it.

11.8 California users under 18 (Cal. Bus. & Prof. Code § 22581)

GreyNOC is an 18+ service (section 12) and is not directed to minors. If content was nonetheless posted here by someone under 18, that person — or a parent or guardian — may email us to have it removed. Removal takes the post out of public view; it may not erase copies other users already saw, and public community content is erased on server restart in any event.

11.9 Consumer complaints (Cal. Civ. Code § 1789.3)

GreyNOC's free features cost nothing; GreyNOC Pro's current price is shown on the Go Pro page before you check out. To file a complaint about the service, email [email protected]. California residents may also contact the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs in writing at 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.

12. Age requirement

GreyNOC is intended for adults and requires you to be 18 or older, confirmed by the age gate on first run (self-attested). The service is not directed to children, and we do not knowingly collect personal information from anyone under 18 — if you believe we hold such data, email us and we will delete it promptly.

13. Security & incidents

Beyond end-to-end encryption, the service uses signed identities, post-quantum sealing for offline mail, a hardened content-security policy, and active abuse monitoring. No system is perfect: if a breach affects personal data we hold, we will notify affected users where feasible and any supervisory authority as required by law (including within 72 hours where GDPR applies). Security researchers: responsible disclosure is welcome — see the project's security policy before testing anything.

14. Changes to this policy

We may update this document as the service evolves. Material changes will be posted here with a new effective date; continuing to use GreyNOC after a change takes effect means you accept the updated version.

a. Acceptance & eligibility

By using GreyNOC you agree to this User Agreement and the Privacy Policy above. You must be at least 18 years old.

b. California residents

GreyNOC is offered to California residents on the same terms as everyone else. Section 12 of the Privacy Policy is your California Privacy Notice: it lists what we collect, states that we neither sell nor share personal information, and explains how to exercise your CCPA/CPRA rights. We will not deny service, change your price, or degrade your experience because you exercised those rights. Nothing in this agreement waives a right California law gives you, and where any term here conflicts with California law as it applies to you, California law controls and the rest of this agreement stays in effect.

c. Your identity key is your responsibility

Access, entitlements, and credentials are bound to your device identity key. Keep your device and browser storage safe. If you lose the key without a Pro migration code, we cannot restore what was bound to it — there is no account-recovery back door, on purpose.

d. Acceptable use

• Use GreyNOC only lawfully. No harassment, threats, doxxing, child sexual abuse material, malware distribution, spam, or impersonation.
• Public spaces are lightly moderated. We may remove content, revoke certificates obtained dishonestly, and ban identities, devices, or IPs at our discretion to protect the community.
• Security-training terms: the skills taught in BB Academy, Whitehat Foundations, GreyPath, and GreyNOC OS are for systems you own or are explicitly authorized to test. The in-app ranges and arcade targets are the only systems this service authorizes you to attack. Attacking the service itself outside the responsible-disclosure process is prohibited.

e. Your content

You keep ownership of what you post. You grant GreyNOC the limited license needed to display and relay it to other users (that is what a chat service does). Public posts are public; community content is ephemeral and vanishes on server restart, so keep your own copies of anything you care about.

f. GreyNOC Pro

• Pro is billed by Stripe as a subscription (or one-time purchase where offered) and unlocks the features listed on the Go Pro page. Prices may change; changes apply from your next renewal, never retroactively.
• The entitlement is bound to your identity key. Generate a migration code before moving devices or wiping your browser — it is the only way to carry Pro across.
• Cancel any time from Stripe's receipt email; access continues until the paid period ends. Refunds or chargebacks may result in revocation.

g. Certifications

Certificates are earned by passing open-book, server-graded exams and are issued under the name you lock, verifiable by anyone holding the certificate serial. Cheating, sharing exam content, or gaming the grader voids the credential.

h. Disclaimers

The service, including all training content, is provided “as is”, without warranty of any kind. Educational material is not professional, legal, or career advice. We do not guarantee uptime — community data does not survive restarts, and the service may change or end at any time.

i. Limitation of liability

To the maximum extent permitted by law, GreyNOC's total liability for any claim arising from the service is limited to the amount you paid us in the twelve months before the claim, and we are not liable for indirect, incidental, or consequential damages.

j. Termination

You can stop using GreyNOC at any time (see section 10 for erasure). We may suspend or terminate access for violations of this agreement.

k. Governing law

This agreement is governed by the laws of the United States. If any provision is found unenforceable, the rest remains in effect.

l. Contact

Questions about this agreement or your data: [email protected].