Privacy Policy

Last updated: March 24, 2026

Threat Terminal is a free research platform operated by Scott Altiparmak. This policy explains what data we collect, how we use it, and your rights.

What we collect

Account data

Sign-in requires an email address. We use Supabase Auth with passwordless one-time codes — no passwords are stored. Your email is used solely for authentication and is never shared with third parties.

Research data

When you play, we record:

• ▸Your answer (phishing or legit) and whether it was correct
• ▸Confidence level (guessing, likely, or certain)
• ▸Response time per card
• ▸Whether you inspected URLs, sender details, or attachments
• ▸Session position (which card in the session)
• ▸Self-reported background (if provided)
• ▸Game mode (research, freeplay, daily, expert, head-to-head)

What we do NOT collect

• ▸Geographic location
• ▸Device fingerprints
• ▸Browser history
• ▸Cookies beyond the authentication session

Transient processing

• ▸IP addresses are temporarily processed for rate limiting (to prevent abuse) and are automatically discarded within 1 hour. IP addresses are not stored in our database or linked to your account.

Analytics

We use Vercel Analytics, a privacy-friendly, first-party analytics service. It collects anonymous page-view data with no cross-site tracking and no cookies.

How we use your data

• ▸Research analysis: Anonymized and aggregated answers are used to study how humans detect AI-generated phishing when linguistic quality is no longer a reliable signal.
• ▸Game features: Your answers power XP, leaderboards, achievements, and progression.
• ▸Platform improvement: Aggregate usage patterns help us improve the game experience.

We do not sell, rent, or share your individual data with anyone.

Data storage

All data is stored in Supabase (PostgreSQL) with row-level security policies. Rate limiting uses Upstash Redis. Both are hosted on infrastructure with industry-standard encryption at rest and in transit.

Data retention

Your account and gameplay data are retained for the duration of the research study. You may request deletion at any time (see below).

Your rights

Regardless of where you are located, you may:

• ▸Access your data — view your stats, answers, and profile in-app
• ▸Correct your data — update your display name, bio, and background in your profile
• ▸Delete your data — email scott@scottaltiparmak.com to request full account and data deletion
• ▸Export your data — email to request an export of your gameplay records

If you are in the EU/EEA (GDPR) or California (CCPA), you have additional rights including the right to object to processing and the right to non-discrimination for exercising your rights.

Children

Threat Terminal requires users to be at least 16 years old. We do not knowingly collect data from anyone under 16.

Changes to this policy

We may update this policy as the platform evolves. Material changes will be noted in the changelog. Continued use of the platform after changes constitutes acceptance.

Contact

For privacy questions or data requests:

Scott Altiparmak scott@scottaltiparmak.com