CSIRT-Sim

Privacy notice

Version 1.0 of 3 October 2026, effective from the day it is published on the site. This is a translation; if it differs from the Polish version, the Polish version prevails.

In short

  • You do not create an account. We never ask for your name, email or phone number.
  • In the game you only give a nickname. It can be anything.
  • Do not type real personal data into the game, neither yours nor anyone else's. The game is fiction.
  • Some texts you type in the game are assessed by an AI model from Anthropic. We do not attach nicknames, IP addresses or session codes to them.
  • For now finished sessions are not deleted automatically. Deletion is prepared: demo sessions 7 days and group sessions 30 days after they end; we will announce it in a new version of this policy when it is switched on. After a session is deleted, what remains is an anonymous summary of the game and, if you fill it in, the survey.
  • We only use cookies that the game needs to work. No ads, no third-party analytics. We do not sell data.

1. Controller

The controller of personal data processed on https://bsi.ksiezopolski.pl is Bogdan Księżopolski.

For anything about your data, write to contact@ksiezopolski.pl.

The administrator has not appointed a data protection officer, as there is no obligation to do so (Art. 37 GDPR). Anything a data protection officer would handle goes to contact@ksiezopolski.pl.

2. What we process, why and for how long

There are three ways to play: the solo demo (also with a friend invited by link), a group session that a facilitator creates at /host, and classes run by the administrator. Each processing activity is described separately below.

Solo demo and playing with a friend

  • Data: nickname, chosen role, decisions taken and their in-game time, decisions written in your own words, questions to the AI advisor, score and final report. The person who starts the demo does not have to give a nickname; the default is "Guest". A friend invited to the game types their own nickname.
  • Purpose: running the exercise and preparing the report.
  • Legal basis: Art. 6(1)(b) GDPR, i.e. performance of the contract for a service provided by electronic means under the terms of use.
  • Retention: for now no automatic deletion; deletion 7 days after the session ends is prepared. On request we delete a session earlier (section 7). A session ends by itself when nobody has had it open for 60 minutes, and at the latest one hour after the game is due to end.

Group sessions (/host)

  • The facilitator gives no personal data. They choose the scenario, game length, difficulty and number of teams, and get a link to the session panel. The link works like a password: anyone who has it sees what the facilitator sees. We store only a hash of the link, not the link itself.
  • Participants type a nickname when joining (required, but it can be anything) and choose a role. From then on we process the same data as in the demo.
  • Who sees what: team members see each other's nicknames, decisions and the team report. The facilitator sees nicknames by role, the game state, the live score and each team's report. The report is written by AI and may quote questions put to the advisor.
  • Purpose and legal basis: as in the demo.
  • Retention: for now no automatic deletion; deletion 30 days after the session ends is prepared. On request we delete a session earlier (section 7). A session ends by itself at the latest 2 hours after the game is due to end.

If the facilitator uses the results outside the service, e.g. for grading, they become a separate controller of that data and inform the participants themselves.

Classes run by the administrator

The administrator also runs their own classes in the service, in a separate panel. Participants give a nickname and, if the administrator asks for it, their student number. The other data is the same as in the demo. Participants' results can be compiled by student number.

  • Legal basis: Art. 6(1)(e) GDPR. The classes are part of university education, a task carried out in the public interest (Art. 11(1)(1) of the Polish Act of 20 July 2018 on Higher Education and Science). You give your student number only when the instructor asks for it, to match results with the class list. Course grades go into the university's systems, which follow the university's data protection rules.
  • Retention: until the end of the semester in which the classes took place, plus 12 months. This leaves time for appeals against course grades. The administrator gives the details in class.

Post-game survey

  • Data: a rating from 0 to 10, three ratings from 1 to 5, two text fields of up to 500 characters, and who you are (e.g. student, lecturer). The server adds the type of session, role, scenario, language, score band, app version, and date and time. The facilitator of a group session fills in a similar, shorter survey, without role or score.
  • We do not ask for your name or address. Until the session is deleted, the answer is linked to it, and instead of the player identifier we store a hash of it (HMAC with a secret server key), so that one person cannot send the survey twice. After the session is deleted the link is removed.
  • Purpose: improving the exercise. Aggregate survey results may be used in scientific publications about the project.
  • Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in developing the service and researching it. The survey is voluntary.
  • Retention: after the session is deleted we keep the answer, no longer linked to it, for 5 years. That is usually how long preparing and reviewing scientific publications about the project takes. If we notice personal data in a text field, we delete it.

Shareable score card

The score card link (starting with /r/) contains the scenario, role, score, number of deadlines met and the day played. It contains no nickname or session code. Anyone who has the link sees this information.

The link works indefinitely, also after the session is deleted. We cannot switch it off, because the data is stored in the link itself. The card page asks search engines not to index it. You decide whether to pass the link on. The LinkedIn button takes you to LinkedIn, which processes data under its own rules.

Server logs

  • Data: the IP address with its end cut off (IPv4 without the last number, e.g. 203.0.113.0; IPv6 only the first three groups), time, address of the page visited (may contain a session code), response code, the page you came from and browser type. Facilitator links are masked. Rare entries about serious server failures may contain the full IP address.
  • Purpose: security of the service, detecting attacks and fixing failures.
  • Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in the security and continuity of the service.
  • Retention: the oldest entries are deleted automatically once a service's logs exceed 50 MB. How soon that happens depends on traffic.

The full IP address (for IPv6, the first four groups — the /64 network) is also processed in the server's memory as requests come in, to limit abuse: the number of requests (per second; per minute for starting a demo or creating a group session), the number of demos and group sessions run at once and started within an hour from one address, the cost of AI calls from one address within a day, the number of surveys sent from one address within a day, session codes entered that don't exist, and failed sign-ins to the instructor panel. It is not written to disk or to the database and is gone after a day at the latest, or when the server restarts.

Anonymous statistics

  • Counters: we count clicks per day, e.g. on the link to the article or on copying a demo invitation. No IP address, cookie or identifier is stored with them.
  • Session summaries: before a session is deleted we store its summary: scenario and its version, type of session, difficulty, the date the game started, the language it was created in, roles, number of players, game length, catalogue decisions with their in-game time, deadlines, final indicators, score, and the versions of the app and AI model. A decision written in your own words is stored only as "own decision", without its text. Teams from one facilitator link share a random class identifier in their summaries, so that classes can be counted. The summary contains no nicknames and no typed texts.

We create summaries under Art. 6(1)(f) GDPR; our interest is service statistics and scientific research. Finished summaries and counters cannot be used to tell who played, so they are not personal data. We use them in service statistics and in scientific publications about the project.

Email

  • Data: your email address, the content of the message and whatever you include in it.
  • Purpose: replying to your message, handling data requests and security reports.
  • Legal basis: Art. 6(1)(f) GDPR, i.e. our legitimate interest in corresponding with you. For data requests: Art. 6(1)(c) GDPR, i.e. a legal obligation.
  • Retention: until the matter is closed, then 12 months, unless the message is needed to defend against claims.

3. Artificial intelligence

The AI model is used in five places. Each time it receives the scenario description and the game state: roles, indicators and event titles. In addition:

  • Assessing a decision written in your own words: it receives the text of the decision (12 to 600 characters). The text is sent even when the model finds the decision impossible and we do not store it.
  • Advisor: it receives the text of your question (12 to 500 characters).
  • Final report: it receives the course of the session, the decisions taken and the questions put to the advisor.
  • Escalations, i.e. events added by AI in group sessions and in the administrator's classes: it receives only the game state, without players' texts.
  • Event requested by the administrator (only in their classes): it receives the administrator's hint and the titles of previous events.

We do not attach nicknames, IP addresses, cookies or session codes to this data. However, whatever you type into a decision or question reaches the model. The score is calculated by a fixed algorithm and AI does not change it. Decisions from the list always have the same effects; the effects of a decision typed in your own words are proposed by AI, within the limits described on the AI page. More on the page How CSIRT-Sim uses AI.

The AI model is provided by Anthropic Ireland, Limited. It is our processor, i.e. a company that processes data only on our instructions (Art. 28 GDPR). Under Anthropic's terms:

  • Anthropic does not train models on data from our account.
  • Anthropic automatically deletes the texts sent and the responses within 30 days. The exceptions are content it finds in breach of its usage policies (kept for up to 2 years) and cases where the law requires longer retention.

We will update this notice before changing the AI provider.

4. Who has access to data

  • Server provider: cyber_Folks S.A., Poznań (Poland), Hekko VPS service. Hosts the server and database as our processor, under a data processing agreement.
  • Anthropic Ireland, Limited (6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland) together with Anthropic, PBC (USA): process the texts described in section 3 as our processor and its sub-processor, under Anthropic's data processing addendum.
  • Email provider for contact@ksiezopolski.pl: cyber_Folks S.A., Poznań (Poland), as our processor.
  • Other session participants and the facilitator: to the extent described in section 2.
  • The administrator has technical access to all sessions through a password-protected panel. They look at sessions only to deal with failures, abuse and data requests.
  • Public authorities: only when the law requires it.

We do not sell data and do not use it for advertising.

5. Transfers outside the European Economic Area

Texts sent to the AI model are also processed in the United States, by Anthropic, PBC. Anthropic does not participate in the EU–US Data Privacy Framework. The transfer relies on the standard contractual clauses adopted by the European Commission (Implementing Decision 2021/914), incorporated into Anthropic's data processing addendum (Art. 46(2)(c) GDPR). You can get a copy of these safeguards by writing to contact@ksiezopolski.pl.

All other data is stored in the European Economic Area: the server and the mailbox are in Poland.

6. Cookies and browser storage

We store in your browser only what is strictly necessary to provide the game you asked for. Such storage does not require consent (Art. 399(3)(2) of the Polish Electronic Communications Law), which is why the service shows no banner. Each item is described below, as Art. 6(2) of the Polish Act on Providing Services by Electronic Means requires. We use no analytics, advertising or third-party cookies.

Cookies:

  • csirt_player links your browser to your place in the session. It holds the session and player identifiers with a cryptographic signature. Expires after 2 days.
  • csirt_locale remembers your language. It is set when you click the PL/EN switch or open an English address of the site (starting with /en). Expires after one year.
  • csirt_style remembers the page style you picked (Map, Signal, Terminal or Dossier). It is set only when you pick a style in the style menu (on the game screen: “View”). Expires after one year.
  • csirt_theme remembers the mode you picked: light, dark or like the system. It is set only when you pick a mode in the same menu. Expires after one year.
  • csirt_layout remembers the game-screen layout you picked (Panel or Mail). It is set only when you pick a layout in the “View” menu. Expires after one year.
  • csirt_narrow remembers that the screen is narrower than a laptop (a phone, a tablet, a small window), so the game shows the one-column layout straight away. The game screen sets it after checking the window width. Expires after one year.
  • csirt_demo_banner remembers that you closed the bar explaining the demo (“You are playing…”). It is set only when you click “Close”. Expires after one year.
  • csirt_feedback_sent remembers that the survey for a session has been sent. It holds the session identifier. Expires after 30 days.
  • csirt_host_feedback_sent does the same for the facilitator survey. Expires after 30 days.
  • csirt_host lets the facilitator return to the session panel. It holds the facilitator link. Expires after 24 hours.

Browser storage (localStorage):

  • csirt-tour-v2 remembers that the game tutorial has been shown.
  • csirt-inbox-read:… remembers which messages in the game inbox you have read. The name contains the session code and player identifier.

Browser storage entries stay until you delete them. You can clear cookies and browser storage in your browser settings. You will then lose access to a session in progress; its data stays on the server until the session is deleted.

7. Your rights

You have the right to:

  • access your data and get a copy of it (Art. 15 GDPR),
  • rectification (Art. 16 GDPR),
  • erasure (Art. 17 GDPR),
  • restriction of processing (Art. 18 GDPR),
  • portability of data we process under the contract (Art. 20 GDPR).

Right to object. You may object at any time to processing we base on our legitimate interest: logs, the survey, summaries and email (Art. 21 GDPR). We will then stop, unless we demonstrate compelling legitimate grounds or need the data to defend against claims.

How to make a request. The service has no accounts, so we cannot tell by ourselves which data is yours. In that situation the rights under Arts. 15–20 GDPR apply once you provide information that lets us identify you (Art. 11(2) GDPR). Write to contact@ksiezopolski.pl with the session code, your nickname and your role. The session code is shown in the game page address and on the game screen. The whole team knows the code, nicknames and roles, so we may ask you to confirm, e.g. with the text of one of your decisions. If we still cannot find your data, we will tell you.

We reply without undue delay and within one month at the latest. For complex requests we may extend this by two months; we will tell you if we do. Exercising your rights is free of charge.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl), or with the supervisory authority where you live or work.

8. Do you have to give data

A nickname is needed to join a session, but it does not have to be your real name. Everything else you type is voluntary. Without the csirt_player cookie the game does not work, because the server cannot recognise your place in the session.

9. Automated decisions

We do not take decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The score is calculated by an algorithm and is a teaching aid, not a formal assessment. In the administrator's classes results can be compiled by student number, but the grade for the class is always decided by the teacher, not the system.

10. Security

  • The service runs over HTTPS. HTTP connections are redirected to HTTPS, and browsers remember this for a year (HSTS).
  • The player cookie carries a cryptographic signature. The server rejects altered or forged cookies.
  • Facilitator links are stored only as hashes.
  • Keys to AI services are encrypted in the database.
  • The administrator panel is password-protected, and the server limits request rates.
  • We do not make separate backups of the database. The only exception: before each application update we make a one-off copy of the database. It is deleted automatically once the update succeeds, usually within minutes. If an update fails, the copy is kept only until the problem is fixed. Data leaves the service at the times described in section 2.

Report security vulnerabilities as described in the reporting policy.

11. Age

The service is intended for people aged 16 and over.

12. Changes to this notice

Changes are published on this page, with a new version number and date. All previous versions are in the public source code repository of the service (https://github.com/U55-BK/csirt), in the legal folder.