Privacy Policy

1. Who we are and platform scope

UCFYX is an interactive technical training platform dedicated to computer networking, offensive/defensive cybersecurity, and hardware/IoT engineering. Our hands-on learning environments include:

• CCNA & Enterprise Networking: Virtual Cisco IOS-like terminal simulations, 68 guided networking labs across 14 topics, IPv4 subnetting trainer, scenario troubleshooting, and timed exam practice.
• Cyber Defense Forge & Academy: 12 structured courses with 120 learning modules, MITRE ATT&CK tactical mapping, and 12 hands-on Security Forge labs ranging from real-time file integrity monitoring to container auditing and firmware analysis.
• Raspberry Pi & IoT Workspace: Interactive browser-based hardware emulation simulating Linux ARM environments, GPIO pin interaction, 43 electronic components, and virtual sensor networks.
• This policy details what data we collect, how it is used to deliver hands-on simulation state and track your learning progress, and your choices regarding your account.

2. Information you provide

When you create an account or update your profile, we store:

• Account credentials: your email address and username, required to establish your account and isolate your learning progress.
• Passwords: if you register with a local password, we store only a salted, computationally hardened PBKDF2-HMAC-SHA256 password hash. Plaintext passwords are never logged, stored, or readable by anyone.
• Optional profile information: first name, last name, a short bio, and avatar image. These fields are strictly voluntary and controlled directly from your profile settings.
• Third-party sign-in: if you sign in using an external provider such as Google, we receive only your provider account identifier, email address, display name, and avatar URL. We never receive or access your third-party account password.

3. Information generated during hands-on training

As you interact with our virtual devices and labs, the platform maintains state and records performance metrics scoped strictly to your user account:

• Networking simulations: lab configurations, terminal command execution transcripts, hints requested, objective completion times, and validation results.
• Subnetting & diagnostic drills: answers submitted, calculation response times, streaks, and scoring metrics.
• Cybersecurity labs & challenges: triage decisions, evidence artifacts captured, scenario run history, and MITRE ATT&CK technique coverage marks.
• Exam simulations: timed test sessions, terminal configuration snapshots, challenge scores, and topic-readiness evaluations.
• Hardware simulations: virtual circuit configurations, GPIO pin state logs, and guided project milestones.

4. Technical logs and browser storage

To safeguard our infrastructure, maintain active sessions, and prevent brute-force attacks, our servers maintain operational request logs containing your IP address, user-agent header, request timestamps, and HTTP response codes.

In the browser, UCFYX utilizes modern web storage mechanisms (localStorage and sessionStorage) rather than advertising cookies to maintain your authenticated session token, active lab/drill states, and UI theme preferences. Key client storage identifiers include ucfyx_token (JWT authentication token), ucfyx_user (cached user identity), ucfyx_theme (visual appearance preference), and ucfyx_post_login_redirect (safe destination path). Detailed breakdown is provided in our Cookie Policy.

We do not engage in third-party cross-site advertising, behavioral tracking, or data-broker profiling.

5. How we use your information

• Authenticating your identity and maintaining secure session boundaries.
• Provisioning virtual network devices, CLI simulators, and sandboxed lab exercises.
• Persisting your personal progress, course completion, and skill-readiness metrics.
• Sending critical transactional communications (such as password resets and account security notices).
• Monitoring operational reliability, preventing denial-of-service or abusive terminal execution, and enforcing rate limits.

6. Information sharing and third parties

UCFYX does not sell, rent, or trade your personal information. We disclose data solely to infrastructure providers strictly necessary to operate the platform:

• Authentication identity providers (e.g. Google Sign-In) only if explicitly chosen by you.
• Transactional email providers for sending system-generated password resets or verification links.
• Payment processing: when commercial billing is activated, payment details will be collected directly by a PCI-DSS certified payment gateway (Stripe/Paddle). UCFYX servers do not process or store credit card numbers.
• Legal compliance: when strictly mandated by valid legal process or regulatory obligations.

7. Data retention and account deletion

Your learning progress and account credentials are retained as long as your account remains active. Ephemeral session tokens and simulation workspaces expire automatically via time-to-live (TTL) limits.

You have the right to request deletion of your account at any time through account settings or by contacting support. Upon account deletion, your personal credentials and linked learning records are permanently purged from active databases.

8. Statutory disclosures and legal review notice

Depending on your jurisdiction (such as the GDPR in the European Economic Area or CCPA/CPRA in California), you may have statutory rights to access, rectify, port, or erase your personal data.

Notice: Specific corporate registration details, registered business agent addresses, and regional statutory compliance appointments remain subject to final verification and review by the platform operator and qualified legal counsel prior to commercial release.

9. Contact

For privacy inquiries, data subject requests, or questions regarding this policy, reach out to our team at support@ucfyx.com.