Privacy Notice

This notice explains what personal data is processed when you use majorcyber.org, why, and what choices you have. We have designed the site to collect as little as possible.

Who is responsible?

MajorCyber™ is operated by its founder, Major Shubham Sharma. For privacy questions or requests, email majorcyber.ss@gmail.com.

The short version

No analytics, advertising or tracking scripts are used.
Pharosense and GRC Proving Grounds need a free account. It holds your email address, a username you choose, your ways to sign in, your Proving Grounds progress and a record of the Pharosense reports you download — no password. The rest of the site works without one.
Your email address is used only for account emails: a code to confirm it, or to sign in if you lose your passkey. Never marketing.
Cookies are set only if you sign in, and only to keep you signed in. Nothing is set for anyone who doesn’t.
No other forms collect your details, and there is no newsletter sign-up.
Fonts and images are served from this site, not from third-party font or image services, with one exception: YouTube, described below.

What is processed, and why?

Hosting and security logs

The site is served by Cloudflare, which acts as our hosting and content-delivery provider. Delivering any web page requires processing technical data such as your IP address, browser type, the page requested and the time of the request. Cloudflare processes this data to deliver the site and protect it against abuse and attacks. We do not use it to identify or profile visitors. Cloudflare’s handling of this data is described in its own privacy policy and data processing terms.

Purpose: delivering the website securely. Basis: our legitimate interest in operating a secure website, and where Indian law applies, processing that is necessary to provide the service you have requested.

Embedded videos (when present)

Some pages may include MajorCyber™ videos hosted on YouTube. To protect your privacy:

before you press play, the page shows only a preview image loaded from YouTube’s image server (i.ytimg.com). This request reveals your IP address to Google but does not set cookies from our site;
the video player is loaded from YouTube’s privacy-enhanced domain (youtube-nocookie.com) only when you press play. From that point, Google’s terms and privacy policy apply, and YouTube may store data on your device.

Search

Site search runs entirely in your browser using a file downloaded from this site. Your search terms are not sent to us or to anyone else.

What your browser remembers for you

A few features save small notes in your own browser’s storage so they work the way you expect. They are not cookies, and you can remove them at any time by clearing this site’s data in your browser. Apart from GRC Proving Grounds progress, which is also saved to your account (see Accounts), they are never sent to us or to anyone else:

Light or dark theme (mc-theme, local storage): the colour scheme you chose, so it stays chosen.
Welcome message (mc-welcome-seen, session storage): that you have closed the homepage introduction in this tab. It disappears when the tab closes.
Your username (mc-account-user, local storage): so the account menu at the top of the page can show who is signed in. It is removed when you sign out.
Pharosense answers in progress (mc-assess-…, session storage): your answers to a self-assessment, so an accidental refresh doesn’t lose them. They are only ever restored after a refresh, are discarded the next time you open the page afresh, and disappear when the tab closes. They are never uploaded.
GRC Proving Grounds progress (mc-pg-profile and mc-pg-run:…, local storage): your rank, XP, achievements, best scores and any run in progress. Your rank, scores and achievements are also saved to your account; a run in progress stays in the browser where you started it. The “Erase my progress” button on the Proving Grounds page removes it from both.

PDF reports, cheat sheets and completion records are put together by your browser on your own device. A Pharosense report shows your account’s email address, its reference and, if you add one, an organisation name; a record of it is kept in your account (see below). Nothing else you enter — including a name on a completion record — is uploaded.

Accounts

Pharosense and GRC Proving Grounds need a free account. Everything else on the site can be used without one.

What an account holds:

your email address and a username you choose, which is unique to you;
your ways to sign in: for each passkey, its public key, its identifier and when it was added and last used (a passkey’s private key never leaves your device); for each sign-in provider you connect, the identifier that provider gives MajorCyber™ for you and when it was connected and last used; and, if you made one, a one-way scrambled (hashed) copy of your recovery code;
your sessions: a hashed copy of each sign-in token, with when it started and when it ends;
your GRC Proving Grounds progress: rank, XP, best scores, medals, achievements and the number of runs finished;
a record of each Pharosense report you download: its reference, which check it was, the score, the date and the organisation name if you added one — so that a report can be traced to the account that produced it. Your answers are not part of it: they stay in your browser;
when the account was created and last used, and whether your email address has been confirmed.

We don’t ask for a password, your name, your photo or your contacts.

Confirming your email address comes first. When you sign up, we email a six-digit code to the address you give, and the account is created only once you have entered it (and, signing up with a passkey, made your passkey). Until then, the address and username you typed are held only as part of a one-time key that expires after 15 minutes, or 30 minutes once the code has been entered, and are then deleted. If a sign-in provider has already confirmed the address to us and you keep it unchanged, no code is needed. Changing the address on your account works the same way: the new one takes effect only once you enter the code we email to it.

Signing in with a provider (such as Google, Microsoft, LinkedIn, GitHub, GitLab, Discord or Facebook, where offered): you sign in on the provider’s own page. We ask the provider only for your email address, plus — from GitHub and Discord, whose basic sign-in always includes it — your username there, which we suggest as your username here. You confirm both before an account is created, and if the provider hasn’t confirmed the address to us, or you change it, the code described above comes first. We keep the identifier the provider gives MajorCyber™ for you, so that you can sign in with it again. Facebook’s sign-in always includes your public profile, but we don’t read or keep it. What a provider does when you sign in with it is covered by its own privacy policy.

Emails. Your email address is used only to send you account emails: a six-digit code to confirm the address, or to sign in if you have lost your passkey. They are sent through our email delivery provider, Resend, which processes your address and the message to deliver it. We never send marketing, and never share your address with anyone else.

Cookies. Signing in sets two cookies, used only to keep you signed in on this site: __Host-mc_session (your sign-in token, which your browser keeps out of reach of scripts) and __Host-mc_signed_in (it says only that you are signed in, so pages know to fetch your account). Both last 30 days from when you last used your account and are removed when you sign out. While you sign in with a provider, a third cookie, __Host-mc_oauth, holds a one-time key for up to 15 minutes. These cookies are strictly necessary for a service you have asked for, are never used for tracking and are never shared.

Your IP address is used briefly in memory to slow down repeated sign-in attempts and emails. It is not stored.

Purpose: providing the account and the tools you ask for — including attributing Pharosense reports to the account that produced them — and keeping accounts secure. Basis: providing the service you request when you create an account, and our legitimate interest in keeping accounts secure and reports traceable; where Indian law applies, the personal data you have voluntarily provided for this purpose.

Where it is kept, and for how long. Account data is stored on Cloudflare’s network. It is kept until you delete your account; the record keeps your most recent 500 Pharosense reports. Sessions end after 30 days without use, and an account nobody has used for two years is deleted automatically.

Your controls. On your account page you can see your report records, download everything your account holds as a file, change your email address or username, add or remove ways to sign in, sign out on every device, and delete your account, which erases it straight away.

Age. Accounts are for people aged 18 or over, so Pharosense and GRC Proving Grounds are too.

What happens when you contact us?

If you email us (or message us on LinkedIn), we receive your name, contact details and message. We use them only to reply and to act on corrections, and we keep them only as long as needed for that purpose.

We do not sell or share personal data. Our hosting provider operates a global network, so technical data and account data may be processed in countries other than your own, under the provider’s contractual safeguards. Account emails are delivered by Resend, in the United States, under its data processing terms.

Your rights

Depending on where you live, laws such as India’s Digital Personal Data Protection Act, 2023 and the EU and UK GDPR may give you rights to access, correct or erase your personal data, to object to processing or to complain to a regulator. If you have an account, you can download, correct or erase everything in it yourself on your account page. Without one, we hold almost no personal data about you at all. To make any other request, email majorcyber.ss@gmail.com.

Children

The site is intended for professionals and students and is not directed at children. Accounts — and so Pharosense and GRC Proving Grounds — are for people aged 18 or over.

Changes

If the way the site handles data changes, for example if a newsletter or analytics is ever introduced, this notice will be updated before the change takes effect, and the date below will change.