Last updated 4 November 2026
Who we are
Phish or Legit ("we", "us") runs this website, a free training tool that helps people recognise phishing and fake recruiter scams. For anything in this policy, contact us at privacy@phishorlegit.example.
What we collect
When you take the quiz
Your quiz progress is kept in your browser's session storage so a refresh does not lose it, and your last score is kept in local storage so you can compare on a retake. When you finish, we store an anonymous summary (track, score, and which scenarios were answered correctly) with no name, email, IP address, or identifier, so we can see which scenarios are too easy or too hard.
When you create an account
You need a free account to use the quiz, learning rooms, and Breach Night. We store:
- your email address and display name, and a randomly generated handle shown on leaderboards;
- a salted scrypt hash of your password (never the password itself);
- your time zone, so streaks and the activity heatmap match your local days;
- what you complete (quiz scenarios, room questions, games) with the date and points earned, and your room progress;
- for each signed-in session, a hash of the session token, its expiry, and your browser's user agent string.
Your display name, handle, and score appear on the leaderboard and to other players in Breach Night hotspats you join. Hotspats and their chat are deleted automatically about a week after the last activity. You can delete your account from Settings. That removes your account, progress, and sessions straight away, and replaces your name in any hotspats you took part in.
When you contact us
If you use the contact form, we store:
- your name and email address, so we can reply;
- the topic and message you write;
- the date and time, and your browser's user agent string, to help us fight spam.
Cookies
We set a strictly necessary cookie to remember your cookie choice and, if you log in, a strictly necessary session cookie that keeps you signed in. Optional analytics cookies are only used if you allow them. See the cookie policy for the full list.
Server logs
Our hosting provider keeps short-lived technical logs (such as IP address, requested page, and time) to keep the service secure and running. We use them only for security and debugging.
Why we use it
- To reply to you when you contact us (our legitimate interest in answering your message, and your consent).
- To improve the training, for example turning a scam you report into a new, anonymised scenario.
- To provide your account: scoring, streaks, room progress, and multiplayer games (performing our service for you).
- To keep the site safe, including rate limiting and spam prevention.
- To understand usage, only if you opt in to analytics cookies.
We do not sell your data, use it for advertising, or build profiles about you.
Who we share it with
We use a small number of service providers to run the site, and they only process data on our behalf:
- Hosting: PipeOps, which runs the application.
- Database: MongoDB, which stores accounts, progress, game rooms, contact form messages, and anonymous quiz results.
- AI model provider: when Breach Night bots are switched on, the game state and the day chat of a game that has bots (display names and messages, never emails) are sent to Google Gemini or DeepSeek so the bots can reply.
We may disclose information if the law requires it, or to protect the safety of our users and service.
How long we keep it
Contact messages are kept for up to 12 months after our last reply, then deleted. If a message becomes a training scenario, it is rewritten with fictional details and no longer contains your personal data. Your cookie choice is remembered for 180 days.
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- ask us to correct or delete it;
- object to or restrict how we use it;
- withdraw consent at any time, including for cookies, from the Cookie settings link in the footer;
- complain to your local data protection authority.
To make a request, email privacy@phishorlegit.example or choose "Privacy request" on the contact form. We will respond within 30 days.
Security
Data is sent over HTTPS and stored with access limited to the people who need it. No system is perfectly secure, so please do not send passwords, private keys, or other secrets through the contact form.
Children
The site is intended for people aged 13 and over. We do not knowingly collect personal data from children.
Changes to this policy
If we make meaningful changes, we will update the date at the top of this page and, where appropriate, ask for your consent again.