Privacy policy
Last updated: 2 November 2026
1. The short version
- You can use the app as a guest, with no account and no email.
- Your lesson progress, your code, your notes and the results of the phone checks stay on your phone.
- Something leaves your phone only when you use a feature that needs it, and this page lists every one of them.
- We do not sell your data, we do not use it for advertising profiles, and this website uses no cookies and no analytics.
- You can delete your account and its data from inside the app.
2. Who we are
"We" means Cybersec Protocol, an independent app developer based in Algeria, which is responsible for your personal data as described here (the "controller"). Contact: cybersecprotocol.team@gmail.com.
This policy covers the Cybersec Protocol Android app (package com.cybersec.protocol), this website (cybersecprotocol.app) and our purchase server.
3. What stays on your phone
Stored only on your device, never sent to us:
- Lesson progress, quiz answers, the daily review schedule, your level and streak.
- Code you write in the editor and the playground, and its drafts. Code runs in a sealed part of the app with no internet access.
- Your progress in the houses, the terminal course and the real-protection checklists.
- The results of the phone checks (screen lock, security update date, developer options, USB debugging, VPN). The app reads these settings on the device and never uploads them.
- Your settings, theme, language, saved articles, search history in the news browser and AI chat history.
Uninstalling the app or clearing its storage erases all of it.
4. Your account (optional)
If you create an account, we use Firebase Authentication (Google) to sign you in. It processes:
- Your email address and a password, which Firebase stores as a salted hash (we never see it), or your Google account's name, email address and profile picture if you sign in with Google.
- Technical data needed to secure sign-in, such as your IP address and device information, processed by Google.
Account emails (address confirmation, password reset, account deletion) are sent from our team mailbox through Google Apps Script. They contain only what the email needs.
Recovery phrase. To find an account when you forget its email, the app can show you 12 words. The words are never stored; our database keeps only a one-way SHA-256 fingerprint of them next to your account's email address.
5. What we store in our database
When you are signed in, these are kept in Cloud Firestore (Google) so they survive a new phone:
| Data | Why |
|---|---|
| Coins, freezes, unlocked themes, purchase codes and their expiry, the Supporter badge level, the weekly vault's random seed | To keep what you earned and bought when you change phone |
| Invite code, gifts sent and received (amount, date, the other person's invite code) | Gifts between friends, with daily limits to prevent abuse |
| Weekly league nickname (a generated nickname by default) and weekly score | The optional weekly league |
| Reaction counts on news stories, and which reaction you chose | Showing what the community found useful |
| Recovery-phrase fingerprint and account email | Finding your account when you forget the email |
Guests do not use the database, except that reactions and leagues need an account.
6. Features that send data to other services
Only when you use the feature:
| Feature | What is sent | To whom |
|---|---|---|
| CyberAi coach, AI summaries, AI quiz of the day (only after you agree to cloud AI) | The text you type or the article being summarised, and the lesson or house topic | Google (Gemini API, through Firebase AI Logic or Google AI Studio). On Google's free tier, content may be used by Google to improve its products. Never type passwords, codes or personal data. |
| News and vulnerability feeds, case pictures, site icons | A normal web request (your IP address, device type) | The publishers of the feeds, NVD (NIST), Wikipedia and the news sites |
| Live search in the news browser | The words you search for | NVD and DuckDuckGo |
| Lesson videos | A request to play the video | YouTube (Google), through its privacy-enhanced youtube-nocookie.com player |
| Ads (free version only, never with a plan or the No ads pass) | Advertising ID, IP address, device and app data, ad interactions | Unity Ads, to show and measure ads. You can reset or delete your advertising ID in Android Settings > Privacy > Ads. |
| Redeeming a purchase code | The licence key and an anonymous holder ID (a SHA-256 fingerprint of your account ID, or of a random install ID for guests) | Our purchase server (Cloudflare Workers), which checks the key with Lemon Squeezy |
| Checking for app updates (APK version) | A request for the latest version number | Our purchase server (Cloudflare) |
| App integrity checks | A device integrity token | Google (Firebase App Check with Play Integrity), to keep fake clients away from our database |
| Daily threat brief notification | The same news request as the feeds, once a day, if you keep the brief on | The news publishers |
7. Payments
Purchases on this website are processed by Lemon Squeezy (owned by Stripe), our reseller and merchant of record. They collect your name, email, billing address, payment details and tax information under their own privacy policy, and send you the receipt and licence key. We never receive your card details. We receive from Lemon Squeezy the order and licence details needed to deliver what you bought (product, licence key, status, the email of the order).
Our purchase server stores only a SHA-256 fingerprint of each licence key with the anonymous holder IDs that redeemed it, and a pending claim for at most 30 days, so a key cannot be used more often than it allows.
8. Permissions the app asks for
- Internet and network state: feeds, AI, sign-in, purchases, the VPN check.
- Notifications (Android 13 and newer asks you): the daily threat brief and reminders. You can refuse.
- Install unknown apps (APK version only, not the Google Play version): to install an update of this same app, after checking its fingerprint and signature. Android asks you every time.
The app does not ask for your location, contacts, camera, microphone, photos, call log or SMS.
9. This website
This website sets no cookies, runs no analytics, ads or third-party scripts, and loads no external fonts. It is hosted on GitHub Pages; like every web host, GitHub's servers process your IP address to deliver the pages and protect them, and may keep it briefly in security logs. Links to Discord, Google Play or Lemon Squeezy take you to their own services and policies.
10. Why we may use your data (legal bases)
- To provide the app and your account (contract): sign-in, syncing your wallet, delivering purchases.
- Your consent: cloud AI, notifications, personalised ads where the law asks for consent. You can withdraw it at any time in the app.
- Legitimate interests: keeping the service secure, preventing fraud and abuse of gifts and licence keys, fixing problems.
- Legal obligations: tax and accounting records kept by Lemon Squeezy.
11. How long we keep it
- Account and database data: until you delete your account.
- Licence-key fingerprints: as long as the licence can be used, then deleted.
- Pending purchase claims: at most 30 days.
- Data on your phone: until you delete it, clear the app's storage or uninstall.
- Data held by Google, Unity and Lemon Squeezy: under their own retention rules.
12. Who we share it with
Only the service providers named above, each for its own task: Google (Firebase Authentication, Cloud Firestore, App Check, Gemini, Apps Script, YouTube), Cloudflare (purchase server), Lemon Squeezy and Stripe (payments), Unity (ads in the free version) and GitHub (website hosting). We do not sell or rent personal data, and we share it with authorities only when the law requires it.
These providers may process data outside your country, including in the United States and the European Union, under their own safeguards such as standard contractual clauses.
13. Your rights
Depending on where you live, including under Algerian Law No. 18-07 on the protection of personal data and the EU General Data Protection Regulation, you can ask to:
- access the personal data we hold about you and get a copy of it;
- correct it, or delete it (also from the app: Settings > Account > Delete account);
- object to or restrict its use, and withdraw consent at any time;
- complain to your data-protection authority (in Algeria, the ANPDP).
Write to cybersecprotocol.team@gmail.com. We answer within 30 days and may ask you to prove the account is yours.
14. Children
The app is for people aged 13 and over. Where the law sets a higher age for consenting to online services (for example 16 in some EU countries), a parent or guardian must agree. We do not knowingly collect data from children under 13; if you believe a child has created an account, write to us and we will delete it.
15. Security
All traffic uses HTTPS. Passwords are handled by Firebase, recovery phrases and licence keys are stored only as one-way fingerprints, the database refuses access to other people's data, and code you write runs in a sandbox with no internet access. No system is perfect: if you find a problem, please report it.
The phone checks and real-protection steps are guidance, not an antivirus, and cannot guarantee that a phone is safe.
16. Changes to this policy
We update this page when the app or the law changes, and change the date at the top. For important changes, we tell you in the app before they apply.