Analytics are your choice.

1 · What this site collects

There are three different paths to keep apart. Cloudflare receives the connection details needed to serve a page. Google Analytics and Microsoft Clarity collect usage data only if you accept analytics. The contact and CTF registration forms collect what you type when you submit them, whatever you decide about analytics.

If you accept analytics, two tools start, and only then. Neither one is loaded, and neither one sets anything, before you say yes:

• Google Analytics 4. Which pages you visit and in what order, roughly how long you stay, how you arrived, whether from a search engine, a link from somewhere else or directly, your rough location worked out from your IP address, which is city level and does not keep the address itself, and general device information: browser, operating system, screen size, language.
• Microsoft Clarity. The same kind of page-level picture, plus heatmaps built by adding many visits together and an anonymised recording of the session. A recording is mouse movement, scrolling, clicks and taps. Clarity is set to hide what you type, so form fields are masked and your name, email address, phone number and message do not appear in a recording.

Both tools set cookies in your browser. The next section names them and says how to be rid of them. Both are run by companies outside India, so this data may be processed and stored outside India, in whichever region each vendor uses.

We ask first, and that is the whole of the arrangement: nothing above happens until you accept it, declining loads neither tool, and the cookie settings link in the footer changes your mind either way, whenever you want.

What we do with it is unglamorous. Work out which pages people actually read, find the place where a form or a schedule loses them, and get a rough sense of how much interest there is before we book a room and count chairs. It is not used to profile you, to advertise at you, or to decide anything about you.

What you send us deliberately is the other half, and all three ways of doing it start with you deciding to:

• The contact form. Your name, your email address, an optional phone number, the subject you picked, and your message. The phone number is optional on purpose, most questions do not need one, and a required field that is rarely used is just a field that collects more than it needs.
• CTF registration. Your name, the handle you want on the scoreboard, your email address, your team's name, the team code if you were given one, roughly how many of you there are, how much capture the flag you have played, whether you already hold a pass, an optional ticket reference, whatever names you typed for the rest of the team, and anything you put in the last box. The handle is a separate field on purpose: a scoreboard is public, and nobody should have to put a legal name on one to compete. Registering is free and none of it is a payment.
• An email. If you write to [email protected] or one of the other addresses, we have whatever your mail client sent, which is your address, your name as you have it configured, and your message.

2 · Cookies and consent

Until you accept analytics, this site sets no cookies at all. Not one, first-party or third-party. Decline and it stays that way, which is what makes declining a real choice here rather than a slower route to the same place.

Accept, and the two tools set their own:

• Google Analytics sets _ga and a companion cookie whose name begins _ga_. Between them they tell it that two page views came from the same browser. Both are first-party cookies, set on this domain.
• Microsoft Clarity sets _clck and _clsk, which do the same job across sessions and within a single session.

Two things stored on your device are not cookies. Your light or dark theme choice lives under the key bsd-theme in localStorage, and your analytics decision lives under bsd-consent. Neither is sent anywhere, neither is an identifier, and clearing site data removes both, after which the panel asks again. The decision is kept there rather than in a cookie for one plain reason: it is what makes the first sentence of this section true. If you never touch the theme toggle and never answer the panel, nothing is written at all.

Turning it off. The cookie settings link in the footer of every page reopens the panel. Turn analytics off there and we tell both tools to stop, expire the cookies listed above, and reload the page so nothing carries on running inside it. One honest limit: a cookie set on a vendor's own domain rather than on ours cannot be deleted by this site, or by any site. Clearing site data in your browser is the only way to be certain of those.

How long each tool keeps what it collected is set in that vendor's own console rather than here, and it is part of the same open question as the retention line in section 5. It gets written down when that number does.

There is no third category. No advertising cookie, no cross-site identifier, and nothing that follows you once you have left this domain.

3 · Why we ask for it

To answer you, or to put your team in a competition. Those are the whole purpose of the two forms and they have no others. What the two analytics tools are for, if you accepted them, is in section 1.

Each field earns its place: the email address is how a reply reaches you, the name is so a volunteer can address you properly, the subject routes the message to whichever organiser handles that area, and the message is the question. The optional phone number exists for the small number of threads where email is the wrong tool, such as a sponsorship call or a village that needs kit on the day.

The registration form is longer, because a competition needs more from you than a reply does. The handle is what the scoreboard prints. The team name and the code are how up to four separate submissions become one team, and the code exists because a site made of static files has nothing that could invent one at the moment you press the button, so a captain is emailed one instead. The experience question decides how many entry-level challenges get written and how many volunteers stand on the floor to help, which makes it the one answer that changes what we do before the day. The pass question is how a room for the final gets booked against a real number rather than a hope. None of it is scored and none of it puts you in a bracket.

Your message is not used for anything else. It is not added to a mailing list, it is not used to profile you, it is not used to advertise at you, and it is not the basis of any automated decision. If we ever wanted to send you conference news, we would have to ask you separately and you would have to say yes.

4 · Who can see it

A form submission is handled by a Cloudflare Pages Function, then sent through Resend to an organising-team mailbox. The site's code does not save a separate submission list. Organisers with access to the recipient mailbox can read the message. Our email-delivery provider also processes its contents to send it; section 7 names that provider.

The exception is the capture the flag. The online round runs on LevelUpCTF, our CTF partner, so what a scoreboard needs from your registration goes to them: your handle, your team name, and an email address to attach the account to. What you told us about experience, about access, and anything you wrote in the last box does not, because a scoreboard has no use for any of it. Section 7 names the company and says what that means.

A message about conduct is different, and deliberately so. Please write to [email protected] rather than using the general form. That address is read by the founding team and team leads, rather than by the wider group receiving form submissions. It also avoids the form's Cloudflare-to-Resend delivery path. The form has no "code of conduct" subject option for that reason. The code of conduct says what happens next.

Analytics is the one thing that sentence does not cover. If you accepted it, Google and Microsoft hold what they collected on their own systems, and what we see is their dashboards: page lists, charts, heatmaps, and session recordings we cannot tie to a name. Section 7 names them both and says what that means.

We do not sell, rent, share or trade any of it. No sponsor gets it, in any tier, at any price. That is written into the terms as well as here.

5 · How long we keep it

To be confirmed

A retention period has not been set, and we are not going to write "as long as necessary" here and call that an answer. The purposes are narrow: answering your message and running a competition. Once a thread is finished, or the competition has ended, we need a clear schedule for reviewing and deleting the data involved.

That means choosing a specific period and a workable process for the team mailbox and any relevant service-provider records. We have not confirmed either yet.

You do not have to wait for us to settle it. Ask us to delete your message and we will respond with what we can remove and any limits. See your rights below.

6 · What we still do not do

The pages use HTML, CSS and a little JavaScript. Google Analytics and Microsoft Clarity are the only third-party scripts loaded by the browser, and only after consent. Form delivery happens separately on the server. Here is what else the site does not do:

• No advertising. No ad script, no ad cookie, no remarketing list, nothing sold on this site or through it. Google Analytics can be wired into Google's advertising products, and this one deliberately is not: advertising features and Google Signals are switched off in the code that starts it, and the site's content security policy does not allow the ad domains they would need.
• No selling or sharing. Nothing collected here is sold, rented or traded, and no sponsor gets any of it, in any tier, at any price.
• No profiling and no automated decisions. Nothing here builds a picture of you as a person, scores you, or decides anything about you. The analytics we read is about pages, not about people.
• No other third-party scripts. The two analytics tags are the only ones. There is no tag manager container that somebody could quietly add a third tool to later, no embedded video, no social widget, no chat bubble and no A/B testing tool.
• No third-party fonts. The site serves its own fonts rather than fetching them from a font CDN.
• No fingerprinting. We do not measure your device, your canvas or your installed fonts to identify you. What the two tools record about your browser is listed in section 1, and it is not that.
• No referer leakage past the origin. Outbound links send only bsidesdehradun.com, never the page you were on.

7 · Third parties

Five services are involved in the current site and CTF flow. Google and Microsoft receive analytics data only if you accept it. Cloudflare serves the site, Resend delivers form emails, and LevelUpCTF runs the online competition.

• Google, for Google Analytics 4. Only if you accepted analytics. Google receives the page-level data listed in section 1 and handles it under its own terms, on its own systems, which are not in India. Advertising features and Google Signals are off, so none of it feeds an advertising profile. Turn analytics off and the tag stops sending.
• Microsoft, for Clarity. Only if you accepted analytics. Microsoft receives the same page-level data plus the anonymised session recording, with what you type masked, again under its own terms and on its own systems. The project id is not a secret, it is in the page source, and it identifies this site rather than you.
• Cloudflare, for hosting and form handling. Cloudflare Pages serves this site and receives the connection and request information needed to do so, such as your IP address and the page requested. Its Pages Functions receive the contact and CTF form submissions and pass them to our email-delivery service.
• Resend, for form email delivery. When you submit either form, a Cloudflare Pages Function sends the submitted fields, including your email address, to Resend so it can deliver a message to the organising team. Your browser submits to this site; the server makes the request to Resend. Its privacy policy explains its handling of data.
• LevelUpCTF, for the online CTF round. The capture the flag qualifier runs on their platform, which is what makes them a partner rather than a vendor we bought a licence from: they generate the base challenges, our own team modifies and tunes every one of them, and their scoreboard is the one you play against. A registration is passed to them so that your team exists on it, which means your handle, your team name and an email address for the account. Not your experience answer, not your access notes, not the free-text box. Ask us to withdraw before the round opens and nothing is passed on at all.

That is the current site and form-service list. Ticket registration, when it opens, will involve KonfHub as explained in section 8. We do not add form messages to a marketing list or share them with sponsors. If the service list changes, we will update this page.

Outbound links to X, Instagram, LinkedIn, YouTube, Google Maps, bsides.org and the CFP platform are links, not embeds. Nothing loads from those domains until you click, and once you do you are on their site under their policy.

8 · Registration and tickets

Ticket registration for 0x03 is not open yet. When it opens it will run through KonfHub, which means they collect your details and take your payment under their own privacy policy. Read it at that point, because it will govern more of your data than this page does. Card details never reach us in any form.

What we expect to receive from them is an attendee list: name, email address, ticket tier, and whatever you tell us about accessibility or dietary needs. That list is used to run the event, checking you in at the desk, emailing you a schedule change, counting chairs. It is not shared with sponsors and it is not sold. The terms say the same thing in the sponsorship section, because that is where somebody would think to ask.

A badge photograph, a CCTV camera at the venue, and a sign-in register at the gate would be the venue's arrangements rather than ours. Whatever the venue requires of visitors on the day is theirs to disclose, and we will point at their policy from the joining email once it exists.

9 · Your rights

You can ask us what personal data of yours we hold, ask us to correct it, ask us to delete it, or withdraw analytics consent. We will handle those requests for contact and CTF submissions, and for 0x03 attendee records once registration opens. A legal review of this policy and the applicable statutory process is still pending.

Withdrawing analytics consent needs no email at all. The cookie settings link in the footer does it the moment you click, and section 2 says exactly what that stops and what it clears. Anything Google or Microsoft already holds is governed by their own policies from that point on, and we will point you at the right one if you ask.

In practice this is one email. Write to [email protected] and say what you want done. There is no form to fill in, no identity-verification gauntlet beyond replying from the address the data is about, and no fee. We will do it and tell you what we did. We aim to respond within days.

Two honest limits. We cannot delete something from a mailbox we do not control, so if you emailed a personal address rather than a project one, tell us which. And if a message has already been acted on, a village agreed or a sponsorship taken forward, it may leave a trace in notes about the event itself; we will tell you plainly if that is the case rather than claiming a clean erase.

10 · Questions and complaints

To be confirmed

We have not yet decided which organiser will be the named data contact. We will not publish a name or a privacy@ address until someone has agreed to hold the role and the mailbox works.

Until it is settled, everything on this page goes to [email protected], which is read by the founding team and the team leads and is a working address today. It will be answered. What is missing is the name rather than the mailbox, so the chip stays until an organiser has agreed both to hold the role and to have their name on this page. When that happens the name and the address appear here and the chip goes.

If we get it wrong or you are not satisfied with our response, write to the same address again so the founding team can review it.

11 · About this document

Version 0.11, last updated 3 October 2026. It is versioned separately from the terms, because the two change for different reasons and it should be possible to see which one moved. Version 0.11 corrects the hosting and form-delivery description and clarifies the distinction between analytics and ordinary page requests.

It was written by the organising team, not by a lawyer, and nobody qualified has read it yet. An advocate should review it before 0x03 ticket registration opens, and the reviewed text should replace this page rather than sit beside it. That matters more now than it did: asking for consent and handing data to two companies outside India carries real obligations, and a page describing them is not the same as a practice that meets them. Nothing here is legal advice, and nobody organising this conference is in a position to give any.

If a claim on this page is wrong, that is worth more to us than a polite correction to the prose. Tell us and we will fix the page or fix the practice. Use the contact form, or the address above.