PRIVACY POLICY & DATA HANDLING CHARTER

PwnBox is engineered on a Privacy-First, Client-Centric architecture. We do not operate persistent user account databases, do not sell behavioral data, do not run intrusive tracking pixels, and do not profile your web activity. Your lab progress, simulation scores, and operative notes reside locally inside your own browser.

To provide persistent game progression, terminal custom tools, and notes across browser restarts without requiring cloud logins, PwnBox utilizes HTML5 localStorage on your local device. The specific keys saved are:

• theme: Your interface display mode preference ('dark' or 'light').
• pwnbox_xp / userXP: Gamification experience points earned in the 8 kill-chain labs.
• pwnbox_operative_name / operative_callsign: Custom tactical alias you select for your session.
• pwnbox_notes: Personal study notes written inside the tactical notepad (notes.html).
• pwnbox_completed_modules: Completion tracking across Footprinting, Scanning, Enumeration, Vulnerability, System Hacking, Web App Threats, OSINT, and BlackOps.
• pwnbox_sound_enabled: Audio effect toggle for arcade simulations and terminal typing sound.
• pwnbox_custom_tools: Custom penetration testing shortcuts you add in the module labs.
• pwnbox_cookie_consent: Your preference regarding optional anonymous performance telemetry.

When you interact with the AI SOC Assistant (ai_assistant.html) or the floating tactical assistant widget, your prompt messages are securely transmitted via HTTPS through our serverless Firebase Cloud Function proxy (/api/chat) to Groq Cloud's high-speed inference API (Llama 3.3 70B Versatile).

• No User Data Training: User queries are processed ephemerally in volatile memory for live response generation and are not utilized to train foundational LLMs.
• Backend Secret Protection: API authorization tokens are securely stored in Google Secret Manager and are never exposed to the client-side JavaScript bundle.
• Zero Identifiers: We do not attach personal names, email addresses, or device hardware IDs to LLM queries.

PwnBox is deployed on Google Firebase Hosting and backed by Google Cloud Platform (GCP) global edge CDN nodes. When your browser requests resources from https://pwnbo-x.web.app, standard technical HTTP web server access logs are automatically generated by the underlying network infrastructure:

• Your device's public IP address (for geographical routing and DDoS rate limiting).
• Request timestamp and HTTP protocol version.
• User-Agent string (browser type and operating system).
• Uniform Resource Identifier (URI) requested and response status code (e.g. 200 OK, 404 Not Found).

These logs are maintained by Google Cloud for infrastructure reliability, abuse mitigation, and server health monitoring under Google Cloud's enterprise security compliance.

PwnBox includes a Progressive Web App (PWA) Service Worker (sw.js). This script caches static styling, fonts, and 3D Three.js hardware assets in your browser's Cache Storage API so the academy can be accessed offline without sending recurring network requests. You may clear this cache anytime via your browser's Developer Tools (Application → Storage → Clear site data).

In compliance with the European Union General Data Protection Regulation (GDPR), UK Data Protection Act 2018, and Swiss FADP:

• Essential Storage: LocalStorage keys required for UI display and module persistence are categorized as strictly essential technical data.
• Optional Performance Telemetry (GA4): When Google Analytics 4 is enabled, it operates under Google Consent Mode v2. Anonymous session metrics (page views, session duration) are only loaded if you grant explicit affirmative consent.
• Opt-Out & Reset: You can modify or withdraw your consent status at any time using the control panel below.

PwnBox is exclusively created as an educational cyber range and defensive instructional laboratory for security analysts, ethical hackers, students, and defense cadets:

• All laboratory targets, simulation engines, and mock networks reside strictly in browser memory or sandboxed environments.
• Exploits, payloads, and methodologies documented across our modules must only be executed on systems where you possess explicit, written authorization from the asset owner.
• Unauthorized network intrusion, vulnerability exploitation, or interception of communications is illegal under the Computer Fraud and Abuse Act (CFAA), UK Computer Misuse Act, and equivalent global cyber legislations. PwnBox and its architects assume no liability for misuse of knowledge acquired from this platform.

If you have questions regarding this Privacy Policy, wish to report a security vulnerability in our codebase, or request technical clarification, contact the System Architect directly via our secure transmission desk: