RatCTF

Platform

Terms & Privacy

Plain English, no lawyer-speak. If anything here is unclear, ask — info@thexssrat.com.

Five promises. No asterisks.

  1. I will NEVER use the emails in the ratctf.com database for marketing purposes. No newsletters, no product launches, no "just this once".
  2. I will NEVER use any of your data or submissions to train AI pentesting models on. Not your walkthroughs, not your hints, not your flag submissions, not your Pwnbox sessions, not your pentest reports, not your scores. Not by me, and not by anyone I hand data to. This is not a "unless we update this policy" promise.
  3. I will NEVER sell any of that data to third parties — for any reason. Not for marketing, not for AI model training, not for anything else. No. This data is kept securely and exists for two purposes only: resetting your password, and sending you a course if you get one from the Course Fund / Credit Bank.
  4. There is no catch. Some of you say "when the product is free, you become the product". Not here. The only thing I do with what you give me is show your submissions to other players so they can learn from them.
  5. I do not even use your email to send updates about the platform itself. That is what your inbox on the site is for. I know some of you want platform news by email — I refuse. It would also cost me a lot of money to send that volume of mail.

So what does actually arrive in your inbox by email? Exactly three things, and nothing else:

  • Your email verification code when you sign up or change your address.
  • A password reset link, when you ask for one.
  • The result of a Course Fund or Credit Bank application — because if the community just funded you a course, you need the coupon code.

Everything else — machine releases, event announcements, walkthrough and hint review results, badges, season news — goes to your on-site inbox. Never to your email.

RatCTF is separate from The XSS Rat course platform

ratctf.com is completely separate from thexssrat.com and the course webshop. They are different systems with different databases. Signing up here does not sign you up there, and your RatCTF email address is never copied across.

To be straight with you: on the courses platform I do send marketing email — that is a shop, and that is how a shop works. If you are on that list it is because you signed up there, and you can unsubscribe in one click using the purple link at the bottom of any of those emails. None of that touches your RatCTF account.

What we actually collect

Everything on this list exists because the platform cannot work without it.

  • Account: your username, your email address, and a bcrypt hash of your password. We never store your password itself and cannot recover it. If you sign in with Google, we store the Google account id instead of a password.
  • Progress: which machines you've owned, flags you've submitted, points, badges, streaks and leaderboard position.
  • Things you submit: walkthroughs, hints, machine and quest suggestions, and pentest reports — plus the review decision and any note a reviewer wrote back to you.
  • Membership status: whether you're Premium, when it expires, and which provider granted it.
  • Session cookie: one httpOnly cookie so you stay logged in. It expires after 14 days.

Payments

Card payments are processed by Stripe and PayPal; courses are sold through Podia. Your card number never touches our servers and we never see it. We only ever store the fact that a payment succeeded and what it entitled you to.

Analytics

We run Google Analytics on this site to see which pages get used. That is a third-party tracker and we'd rather tell you than pretend otherwise. It measures page traffic — it is not joined to your challenge progress or your submissions, and it is not used for advertising to you.

Email delivery

Transactional email is sent through Resend, which necessarily sees the address it is delivering to. Nothing else is shared with them.

Your submissions stay yours

You keep ownership of every walkthrough, hint and machine idea you submit. By submitting one you give us permission to publish it on RatCTF, credited to your username, so other players can learn from it — and to edit it lightly for formatting or to remove a spoiler that shouldn't be public.

That permission covers publishing on RatCTF. It does not extend to training machine-learning models, and it does not extend to selling your work or licensing it to a third party. Ask us to take your submission down and we will.

Your rights over your data

  • See it. Ask and we'll send you everything we hold on your account.
  • Correct it. Change your username or email from Settings.
  • Delete it. Ask and we'll delete your account, your email address and your progress. Published walkthroughs can be removed or anonymised — say which you'd prefer.
  • Take it with you. We'll export your data in a machine-readable format on request.

One address for all of it: info@thexssrat.com.

Using the platform

  • Attack the challenge machines all you like — that's what they're for. The boundaries are set out in full in the Rules & Acceptable Use page, which forms part of these terms.
  • The portal itself, other players' accounts, and our underlying infrastructure are not targets.
  • Don't post flags, full solutions or spoilers outside the walkthrough system.
  • One account per person. Don't share credentials.
  • Skills you learn here are for systems you own or are authorised to test. What you do elsewhere is on you.

We can suspend an account that breaks these rules. If it's a genuine mistake, talk to us — we'd rather fix it than ban you.

No warranty

RatCTF is a training platform provided as-is. Machines get rebuilt, reset and retired; a lab may be unavailable when you want it. Keep your own notes — we can't guarantee any lab state survives a restart, and we don't accept liability for lost progress.

Changes to these terms

If we change anything material we'll say so on the platform. The three promises at the top are not up for quiet revision — weakening any of them would require asking you first, and asking properly.

Last updated: 13 September 2026 · RatCTF is operated by The XSS Rat · Questions: info@thexssrat.com