com.rocketgod.defcon34ctf · DEF CON 34 · Las Vegas

We're not the enemy

This is a CTF. You came here to get pwned by puzzles, not by us. Here's exactly what happens with your data — no legalese, no lies, no dark patterns.

Discord Telemetry — The Honest Part

When game events happen, DC34 CTF sends a message to a private Discord webhook visible only to the developer (RocketGod) and trusted mods. Your Game Center display name (alias, not your real name) is included. This is how RocketGod knows pirates are actually playing.

On first GameKit auth → "🏴‍☠️ New pirate aboard: [your alias]"
On each flag capture → "🚩 [alias] captured [NODE] · N/14 channels lit"
On finishing all 14 + NFC → "🏆 [alias] scanned the hand and PLUNDERED IT ALL — finisher #N"
On triple-tap DC34 logo → "🔎 [alias] is searching for clues."
On finding the backdoor → "🕳️ [alias] breached the backdoor."

That's the full payload. No device fingerprints. No IP addresses. No location. No additional identifiers beyond your Game Center alias — the same one that appears on Apple's public leaderboards anyway.

The webhook URL is embedded in the app binary. A motivated person can extract it. It's receive-only — you can't post to it, only read receipts land there. If you reverse-engineer it, you're basically doing the CTF.

These messages persist on Discord's servers subject to Discord's Privacy Policy. We don't export, analyze, or aggregate them beyond reading the channel to cheer you on.

Apple Game Center

The app uses Apple Game Center for authentication, the finishers leaderboard, and achievements. iOS signs you in silently at launch (or prompts you if you haven't enabled Game Center). We read your Game Center display name and submit your finish timestamp and achievement completions through Apple's GameKit framework.

Apple controls all Game Center data. Their policy lives at apple.com/legal/privacy.

What Your Phone Does Locally

Several challenges require hardware access. All sensor data is processed on-device and immediately discarded. None of it leaves your phone.

📍 Location Geo challenge verifies you're at the right spot in Vegas. Checked locally. LOCAL ONLY 📷 Camera One challenge uses your camera feed. Nothing is stored or transmitted. LOCAL ONLY 🔵 Bluetooth Scans for a specific BLE advertisement. No device IDs logged. LOCAL ONLY 📡 NFC Reads one specific tag (the developer's hand). UID checked on-device. LOCAL ONLY 🎤 Microphone On-device speech recognition for one challenge. Audio never leaves your device. LOCAL ONLY 🏃 Motion Accelerometer and pedometer used for two challenges. Data discarded immediately. LOCAL ONLY

The Backdoor Terminal

If you find the hidden terminal, running whoami dumps local device diagnostics to your screen — model, OS, battery state, local IP, uptime, and so on. This data is displayed to you and goes nowhere else. It's an Easter egg. Not a keylogger. Not a data harvest. The joke is that it runs whoami on your own device and prints it back at you. You're the target and you're watching it happen.

What We Never Do

  • Sell or broker your data to anyone, ever
  • Run third-party analytics SDKs (no Firebase, no Mixpanel, no bullshit)
  • Run advertising SDKs or serve ads
  • Store data on our own servers — we don't have any
  • Collect data from children under 13 (App Store age rating enforces this)
  • Retain location, camera, or audio data beyond the moment it's needed
  • Link your Game Center alias to any other identity

Data Retention

Discord webhook messages persist on Discord's servers until manually deleted. That's our full data footprint — a channel of pirate announcements.

Game Center data (scores, achievements) is managed by Apple and persists per their policies.

Everything else is ephemeral. The app stores no database of users. There's no backend. There's no analytics pipeline. When the con ends, there's nothing to delete because there was nothing to begin with.

Changes to This Policy

If something changes, this page gets updated and the date below changes. The app's App Store listing will also be updated. We're not going to start secretly harvesting your data one day — if we ever add something new, you'll read about it here first.

Contact

Developer: Jeremy Yablan · RocketGod
Find me at The Pirates' Plunder Discord, links at betaskynet.com, on GitHub as RocketGod-git, or at the Exhibitor booth if you're at the con. If something in this policy is wrong or unclear, tell me and I'll fix it.