Privacy Policy
1. Who we are
HackXpert Labs (labs.thexssrat.com) is a free platform of deliberately vulnerable web applications for learning ethical hacking, run by The XSS Rat (thexssrat.com) in Belgium (“we”, “us”). We are the data controller for the personal data described in this policy.
Contact for anything privacy-related: support@thexssrat.com.
2. What we collect
2.1 Account data
When you sign up or sign in, through our login page at auth.thexssrat.com (provided by Auth0),
we receive:
- your email address and whether it has been verified;
- your name or nickname and your profile picture URL, if your sign-in provider supplies them;
- a unique account identifier, and the sign-in method you used (email and password, or Google);
- the dates and times you sign up and sign in, and the IP address and browser details of those sign-ins (kept in Auth0's security logs).
If you sign up with email and password, your password is handled only by Auth0 and stored by them in hashed form. We never see or store it.
2.2 Data we receive from Google
If you choose Sign in with Google, Google shares only the basic profile information covered by
the openid, email and profile permissions:
- your Google account identifier;
- your email address and whether Google has verified it;
- your name and profile picture.
We do not request access to your Gmail, Google Drive, Contacts, Calendar or any other Google service, and we cannot read, send or change anything in your Google account. We use this information only to create your account, sign you in and show who is signed in. We do not keep any Google access or refresh tokens.
2.3 What you type into the labs
The labs are intentionally insecure training targets. Anything you enter, such as comments, usernames, uploaded files or payloads, is stored in the lab, may be visible to other users and may be wiped when a lab resets. Never enter real personal data or passwords you use elsewhere. Lab data is kept separately from your account data.
2.4 Technical and usage data
- Server logs: IP address, browser user agent, requested page, referrer and time of each request. We use these to keep the service running and to detect abuse.
- Analytics: we use Google Analytics to understand which labs are used and how the site performs (pages viewed, approximate location, device and browser type).
- Advertising: some pages show ads from Google AdSense, which helps keep the labs free. Google may use cookies to show and measure ads.
2.5 Donations and email
If you donate through PayPal, PayPal processes the payment under its own privacy policy. We receive only what PayPal shares with recipients, such as your name, email address and the amount. If you email us, we keep the correspondence so we can reply.
3. Why we use it and our legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create your account, sign you in, give you access to the labs | Account data, Google profile data | Performance of our agreement with you (Art. 6(1)(b)) |
| Keep the platform secure, prevent abuse, investigate incidents | Account data, sign-in logs, server logs | Legitimate interests (Art. 6(1)(f)) |
| Answer your messages and support requests | Email address, correspondence | Legitimate interests / performance of agreement |
| Understand usage and improve the labs | Analytics data | Consent where required by law; otherwise legitimate interests |
| Show ads that keep the site free | Advertising cookies and identifiers | Consent where required by law |
| Meet legal obligations | Any of the above, as required | Legal obligation (Art. 6(1)(c)) |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We do not sell or rent your personal data. We share it only with the service providers we need to run the site. Each processes it on our behalf or under its own privacy terms:
- Auth0 (Okta, Inc.): account sign-up, sign-in and account storage.
- Google: Sign in with Google (if you use it), Google Analytics and Google AdSense. See how Google uses information from sites that use its services.
- Our hosting provider: runs the servers that host the labs and their logs.
- PayPal: only if you choose to donate.
We may also disclose data if the law requires it, or to protect the security of the platform and its users.
5. Google API Services User Data Policy
HackXpert Labs' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide sign-in. We do not use it for advertising, do not sell it, do not transfer it to others except as needed to provide sign-in (Auth0) or as required by law, and do not let humans read it except for security purposes, to comply with the law, or with your permission.
6. International transfers
Auth0 stores account data in the United States, and Google may process data outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
7. How long we keep it
- Account data: for as long as your account exists. If you ask us to delete your account, we delete it within 30 days.
- Sign-in and server logs: for a limited period for security purposes, normally no longer than 90 days.
- Lab data: until the lab is reset. Labs are reset regularly and without notice.
- Analytics data: according to the retention setting in Google Analytics, at most 14 months.
- Emails: for as long as needed to handle your request.
8. Cookies
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
hx_auth | labs.thexssrat.com | Keeps you signed in (signed, HttpOnly) | 7 days |
hx_auth_tx | labs.thexssrat.com | Protects the sign-in process against forgery | 10 minutes |
| Auth0 session cookies | auth.thexssrat.com | Remembers your login on the sign-in page | Session / up to a few days |
PHPSESSID and lab cookies | labs.thexssrat.com | Used by individual labs as part of the exercise | Session |
_ga, _ga_* | Google Analytics | Usage statistics | Up to 2 years |
| Google ad cookies | Google AdSense | Showing and measuring ads | Varies |
You can block or delete cookies in your browser settings. The sign-in cookies are required to use the labs. You can opt out of Google Analytics with Google's opt-out add-on, and of personalised ads at adssettings.google.com.
9. Your rights
Under the GDPR you have the right to access, correct or delete your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time. To use any of these rights, including deleting your account, email support@thexssrat.com from the address linked to your account. We answer within one month.
You can remove HackXpert Labs' access to your Google account at any time at myaccount.google.com/permissions.
You also have the right to lodge a complaint with a supervisory authority. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).
10. Security
The labs are deliberately vulnerable, but your account is kept separate from them. Sign-in is handled by Auth0 over HTTPS. Your session is a signed, HttpOnly cookie that lab code and lab scripts cannot read, and account data is never stored in the lab databases. No system is perfectly secure. If you find a vulnerability in the platform itself rather than in a lab, please report it to support@thexssrat.com.
11. Children
HackXpert Labs is not intended for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If we make significant changes, we will announce them on the site, or by email to account holders.
See also our Terms of Service.