Privacy Policy

Version 2026-09-07.v5

PacketDojo is operated by Optimesh Technologies. For service, billing, privacy, or policy questions, contact contact@optimesh.ai.

What we store

We store account identifiers, email, profile preferences, submitted configurations, terminal commands, timestamps, scores, skill estimates, study paths, private rehearsal reports, accepted policy versions, billing authorizations, subscriptions, AI usage records, and product events. Guest practice uses an essential cookie with a 30-day lifetime. Account sessions also use essential authentication cookies.

Trial-abuse prevention

For Pro trials, we check verified account details and payment-method characteristics supplied by Stripe. We store keyed, non-reversible hashes of the verified email and Stripe’s card fingerprint to help detect repeated claims. We do not store card numbers or security codes. Trial identity markers can be retained for up to 365 days, including after account deletion; the account link and Stripe identifiers are removed on deletion. An account’s prior-trial flag remains while that account exists. IP-derived rate-limit keys have short expiration windows. These controls reduce abuse but do not establish someone’s legal identity.

Referral invitations and rewards

When you choose to create or accept an invitation, we store its account relationship, accepted referral terms, qualification dates and credit ledger. We check current subscription, payment, refund and dispute status with Stripe. Keyed email and card-fingerprint hashes help detect self-referrals, reused billing identities and repeated claims; we do not store full card numbers or security codes. Common Gmail aliases are treated as the same inbox for this offer. These markers may remain for up to 365 days after the invitation, including after deletion; account links and payment-provider identifiers are removed on deletion. Referral records are removed on the next maintenance run after that window. Stripe retains its financial ledger under its own policies.

Referrers see aggregate invitation and reward counts, not another user’s email, payment details or rejection reason. We do not access contacts or send invitations automatically. The dismissible in-app referral offer uses your browser’s local storage to remember a dismissal for 30 days; it uses no third-party advertising tracker. Referral eligibility and accounting are necessary to provide the offer you requested, independent of optional product analytics.

Why we use it

This information lets us authenticate you, resume labs, grade submissions, track progress, apply access limits, process subscriptions, and understand which incidents need improvement. IP-derived identifiers support request limits; they are not shown in public profiles.

Platform monitoring and optional product analytics

We keep operational records to run and score labs, resume your work, process payments, enforce limits, investigate abuse, and monitor service reliability. These records can be linked to your PacketDojo account; they are not anonymous. Essential financial, security, and reliability totals are used regardless of the optional analytics choice.

Product-improvement analytics is optional and off by default. During account setup or in Settings, you can choose to include new activity such as incident starts, submissions, completions, investigative hints, answer-key views, study-path selections, rehearsals, and subscription events. Declining or withdrawing does not remove any learning feature. Only activity after your latest opt-in is included, and withdrawing excludes your activity from subsequent product reports.

The administrator usage dashboard shows aggregate counts and trends for 7-, 30-, or 90-day periods. It does not return names, email addresses, account identifiers, IP addresses, terminal commands, configurations, AI questions, or written answers. Small groups of fewer than five engineers are suppressed to reduce individual inference. Aggregation is a privacy safeguard, not a claim that underlying account records are anonymous.

We do not use session-replay software, advertising trackers, or sell these usage records. Access to underlying service records is restricted to authorized operational support and administration; the usage dashboard has no individual-user drill-down. We record the version, time, and value of your optional analytics choice so it can be audited.

Service providers

AWS hosts PacketDojo account data and provides email/password authentication through Amazon Cognito. If you choose Google or GitHub sign-in, that provider verifies your identity and shares your account identifier, name, and verified email address with us. We do not request access to your repositories, contacts, or files. Provider tokens are used on our server to verify sign-in and are not retained for social accounts. Stripe handles payment details. When you request AI assistance, the configured AI provider receives your question, a limited command history, and the authorized hint. We do not send your payment details to the AI provider. AI is optional and is not used to grade network correctness. PacketDojo’s AWS deployment uses Amazon Bedrock with Amazon Nova; inference can run in Northern Virginia, Ohio, or Oregon. We do not enable model prompt/response logging to CloudWatch or S3. For Pro reasoning feedback, the provider also receives your submitted explanation and the simulator’s recorded checks.

Public sharing

Engineer profiles are private by default. You can make a profile public or hide your leaderboard identity in Settings. A result link is created only when you choose to share a completed lab. Anyone with that link can view its score and challenge summary.

Export and deletion

You can export your records and delete your account in Settings. Deletion removes PacketDojo progress, configurations, AI records, and public shares and cancels active subscriptions. Payment providers may retain financial records under their own retention requirements. Operational backups expire on the deployment's configured retention schedule.

Deletion does not immediately erase the limited fraud-prevention hashes described above. Your export includes consent history and trial status, but never full payment details or operational security keys. Rehearsal reports are private unless you independently print or distribute them.

Retention

Registered practice history is retained while the account is active. Expired guest accounts are eligible for cleanup after 30 days. Contact us to request access, correction, or help with a deletion that did not complete.

Event-level analytics and simulation telemetry have a 90-day retention window; older records are removed on the next scheduled maintenance run. Your lab history and scores remain while your registered account is active so you can review your work; financial and limited fraud-prevention records follow the separate periods described above. Account deletion removes linked PacketDojo analytics and privacy-choice history. Deployment backup-retention periods and the maintenance schedule must be confirmed before public launch.

Cookies and choices

The current application uses essential authentication and guest-session cookies. Social sign-in uses an additional essential cookie and a single-use security record that expire after ten minutes. Registered sessions expire after seven days and can be ended by signing out. Deleting your PacketDojo account does not delete your Google or GitHub account. Product analytics are recorded on our server; the application does not currently embed advertising or third-party behavioral tracking scripts. Do not submit real network credentials or personal information in terminal commands or AI questions. You can use the simulator without requesting AI assistance.

Your requests and service locations

Contact the operator to request access, correction, deletion, or help exercising privacy choices available where you live. Export and account deletion are also available in Settings. Hosting, authentication, payment, and AI providers may process information in locations different from yours. Production provider selection, transfer arrangements, and backup-retention settings must be finalized before launch; this policy will be updated to reflect that deployment.