Last updated 27 September 2026
Who is responsible for your data
0xRange, operated from the United Kingdom, is the controller of the personal data described here. Contact us about anything in this policy at hello@0xrange.com.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| E-mail address, password (stored only as a hash by our authentication provider), sign-in times, and your confirmation that you are 18+ and accept the terms | To create and secure your account | Contract |
| Profile: handle, optional bio, visibility setting | To run your portfolio the way you choose | Contract |
| Progress: labs, puzzles and quizzes completed and when, and the audit reports you file | To track progress, award XP and tiers, and show your portfolio | Contract |
| Waitlist e-mail address and the page you joined from | To tell you when a feature you asked about opens | Consent (withdraw any time) |
| Anonymous lab events — for example “exploit run” on a given lab — with no account, e-mail or IP address attached | To see where learners get stuck and improve the labs | Legitimate interests |
| Server and security logs: IP address, browser user agent, requested page and time | To keep the service secure, detect attacks, prevent abuse and enforce rate limits | Legitimate interests |
| Billing (when card payments open): subscription status and a customer reference from our payment provider. We never see or store your card number. | To provide paid plans | Contract; legal obligation for tax records |
We do not sell your data, use it for advertising, or build marketing profiles. We do not use third-party analytics or advertising trackers.
Your public profile
Your portfolio at 0xrange.com/u/<handle> can show your handle, tier, XP, solved labs, published audit reports and achievements. You control this with the visibility setting on your account page: Public (listed and viewable), Recruiter-only (unlisted — viewable only by people you share the link with), or Private (visible only to you). You can also choose to appear anonymously on leaderboards, and optionally set a region for regional rankings. Handles are chosen by you and are never derived from your e-mail address.
Who processes data for us
- Supabase — database and authentication, hosted in London, UK.
- Contabo — the server that runs 0xrange.com.
- Namecheap — domain registration and e-mail forwarding for our contact addresses.
- Let’s Encrypt — TLS certificates (no personal data is shared).
- When enabled: Stripe for card payments, and Anthropic (Claude) for the AI Mentor. Mentor messages are sent to Anthropic only to generate replies, under commercial terms that do not allow them to be used to train models. We keep a usage record of each Mentor request (time, lab, model and token counts, for fair-use limits) but not the conversation text.
Where a provider processes data outside the UK we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect it.
Cookies and local storage
We do not use advertising or analytics cookies. Your browser’s local storage keeps you signed in and remembers practice progress made before you create an account. These are strictly necessary for the features you use, so no consent banner is needed. Fonts and other assets are served from 0xrange.com itself.
How long we keep it
- Account, profile and progress data: while your account exists; deleted within 30 days of a deletion request.
- Waitlist entries: until the feature launches or you ask us to remove you.
- Server and security logs: normally no longer than 90 days, unless needed to investigate a specific incident.
- Anonymous lab events: kept for product analysis; they cannot be linked back to you.
Security
Data is encrypted in transit, database access is restricted by row-level security, and the service is monitored for attacks. If you find a weakness, please tell us — see our responsible disclosure policy.
Your rights
Under UK GDPR you can ask to access, correct, delete, restrict or port your data, object to processing based on legitimate interests, and withdraw consent at any time. E-mail hello@0xrange.com; we will respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Children
0xRange is for adults. If we learn that an account belongs to someone under 18 we will close it and delete the associated data.
Changes to this policy
We will update this page when our practices change and, for significant changes, tell you by e-mail or on the site before they take effect.