Problem Forge
This notice says what Problem Forge keeps about you, why, for how long, and what you can do about it.
TLDR: We keep as little as we can.
Our commitments
- ** We show no ads, run no trackers, and sell no data.
- ** We send only the minimum amount of e-mail.
When you need a sign-in code, you enter your e-mail address and we send you a sign-on code. The sign-in code is only thing that gets sent. When you want some old data, it's the same process. Just what you asked for, nothing else. No spam, no reminders, no news letters.
- ** No readable e-mail addresses are kept
We never keep your e-mail addresses. For sign-in by e-mail we keep only a fingerprint (a keyed hash), and the address cannot be read back. Thus, if our data were ever stolen, it would hold no e-mail addresses. Even a thief who also obtained our secret key wouldn't have that information. (Yes, they could check whether an address they already have is able to sign in here, but that's it.)
- ** We don't ask for your methods.
If you have a mechanism for solving these problems, it's yours. For the scored problems, we have the solutions already. Sending your answers won't give us anything we didn't already have. The instances here are generated and unique to each player. Knowing someone else's solutions won't help another player either.
The competition is as fair as we can make it.
Who is responsible
Problem Forge is run by Problem Forge, LLC, Washington, USA. It is responsible for your data (the "controller"). Write to admin@problemforge.com.
Guests
You can read every page and try the samples without an account. Guests get no cookie. We keep no log of visits; see Visits and logs.
What we keep about you, and why
- Your sign-in. From Google or GitHub, an id that says it is you, never your name, e-mail or picture. If you sign in by e-mail, a fingerprint of your address (a keyed hash), never the address. Why: to sign you in. Kept until you remove that sign-in or erase your account.
- Your handle, climber number and profile id, and your earlier handles. Why: to show you on the boards and tell you apart. Kept until you erase your account.
- Your climbing: your answers, when you first downloaded and solved each rung, your places on the boards, and the old copies you asked for. Why: to run the game and the boards. Kept until you wipe your data or erase your account.
- Sessions and API tokens, stored as hashes, and when you last signed in. Why: to keep you signed in and let programs climb for you. A session ends after 30 days, or after 14 days unused. A token ends when you revoke it, and after a year at most.
- When you accepted the terms, and which version. Why: to show you agreed. Kept until you erase your account.
- Invite codes you made or used. Why: to run the invite-only beta. Kept; when you erase your account, the link to you is removed.
- A record of changes to your account, such as a new handle or a sign-in added. Why: to protect your account and the site. Kept until you erase your account.
- Bounty claims. None can be sent yet. When answers open, each claim will be kept for good, with your profile id, climber number and sign-ins, even after you erase your account, as the record of the bounty.
Legal basis in the EU and UK: the contract with you (the terms) for running your account and the game; our legitimate interest for the record of changes and for stopping abuse.
We never ask for your name, address, birthday or payment details.
E-mail addresses
- Sign-in by e-mail. We send a six-digit code to your address. While you sign in, your browser holds the address, encrypted, in a cookie for up to 15 minutes. We keep only a fingerprint of the address, so we know it is you next time. The code is kept as a hash for at most ten minutes. A record of how many codes we sent to the fingerprint is kept for about a day, to stop guessing and abuse.
- Old copies. Some old copies take a while to prepare. If you ask for one, we offer to e-mail you a link. Giving an address is optional. It stays in the web server's memory until the one e-mail is sent, then it is gone. It is never written to a database, a log or a file.
- Our mail provider, IONOS, carries these e-mails, so it sees the address and the message.
Visits and logs
- We keep no log of visits. Our web server does not record the network (IP) addresses of requests. If a request fails inside the web server, the error line may include its address; such lines are deleted after 30 days.
- Our services keep technical logs for about eight weeks. They hold internal ids, routes and times, not names, e-mail addresses, answers or cookies.
- To slow down abuse, we count requests, sign-ins and new accounts per network address, per minute or per hour. These counts live only in the server's memory and are gone when it restarts.
Cookies
We use only the cookies that sign-in needs. None tracks you.
__Host-pf_sessionkeeps you signed in: up to 30 days, ending after 14 days unused.__Host-pf_oauthand__Host-pf_authrescarry you through sign-in with Google or GitHub: a few minutes.__Host-pf_codecarries you through sign-in by e-mail code: up to 15 minutes.__Host-pf_signupholds your sign-in while you read the terms the first time: up to 15 minutes.
Guests get no cookie. We set no analytics or advertising cookies and load nothing from other companies' servers. Every cookie is needed for something you asked for, so we show no cookie banner.
Who else sees your data
- Google Cloud (Google LLC) runs our server (region us-west1, United States) and stores our encrypted backups (us-central1, United States).
- IONOS carries our e-mail and registers our domain.
- Google and GitHub, when you sign in with them, learn that you signed in to Problem Forge. They act under their own privacy policies.
We do not sell your data. We share it with nobody else, unless the law requires it (for example a valid court order) or to protect the site from abuse.
Where your data is
Our server and backups are in the United States. If you are in the EU, the UK or Switzerland, your data is processed in the United States.
Backups
- Every night we back up the database. One copy stays on the server for 14 days.
- An encrypted copy goes to Google Cloud Storage and is deleted after 30 days. The operator keeps encrypted weekly copies for up to 28 days.
- When you erase your account, your data leaves the backups within about five weeks.
- If we ever restore a backup, we apply again every erasure and wipe made after it.
What stays after you erase
- Your places on the boards and in Firsts stay, shown as "<anonymous>", so that other people's places do not change. They no longer point to you.
- Counts without names (how many climbers solved a rung, how long it took them) stay.
- Invite codes stay as "used" or "not used", without your id.
- Bounty claims stay, as said above.
Your rights
You can do most things yourself, in Settings:
- see your data on your own pages and through the API;
- change your handle; add or remove a sign-in;
- Wipe my data: delete your answers, times, handle and tokens, and keep your account;
- Erase my account: delete your account and everything tied to it, at once;
- sign out everywhere.
If you live in the EU, the UK or another place with data-protection rights, you may also ask us for a copy of your data, ask us to correct it, object to what we do on our legitimate interest, and complain to your data-protection authority. Write to admin@problemforge.com. We answer within one month. We may ask you to show that the account is yours, for example by signing in and quoting your climber number.
We do not sell or share personal information as California law uses those words.
Children
The site is not directed at children. We do not knowingly keep data about a child under 13. If you believe a child under 13 has an account, tell us at admin@problemforge.com and we will erase it.
Security
Everything travels over HTTPS. Our services talk to each other over mutually authenticated TLS. Tokens and codes are stored as hashes. If a breach affects you, we will tell you on the site and, where we can, directly, as the law requires. To report a security problem, write to admin@problemforge.com.
Changes to this notice
Each version has a number and a date at the top. A change that matters is announced on the site. If it changes what you agreed to, we ask you to tick the box again.