Acceptable use

LevelUpCTF runs vulnerable code in isolated sandboxes for training purposes. You agree not to:

• Attack or attempt to escape the sandbox boundary into LevelUpCTF infrastructure. Container escapes are vulnerabilities — report them to security@levelupctf.com.
• Attack other players, scrape the leaderboard, or try to de-anonymise other accounts.
• Share or publish challenge flags, full writeups of active challenges, or solver scripts that trivialise future attempts. Generalised learning content (techniques, methodology) is welcome.
• Automate account creation or attempt to game the ELO / AI-classifier systems.
• Use the platform to plan or execute attacks against systems you do not own or have explicit authorisation for.

Your account

You’re responsible for keeping your credentials secure. If you suspect account compromise, use the password-reset flow or email security@levelupctf.com. We may suspend accounts that violate these terms; we’ll tell you why if we do.

The LevelUpCTF challenge-type skill vector uses 15 axes: Web, Cryptography, Binary Exploitation, Smart Contracts, Reverse Engineering, Forensics, General Security, OSINT, AI Security, API Security, Malware Analysis, Incident Response, OT/ICS Security, Mobile Security, and Boot2Root. LevelUpCTF records attempt timestamps and outcomes, tool and command execution events, retries, hint usage, and sandbox session metadata. Session replay is recorded where the selected service or workspace enables it. Free-tier telemetry is mandatory because it supports difficulty calibration, fair matchmaking, abuse prevention, and aggregate platform reliability.

Deleting an account immediately disables access and removes live profile, authentication, and direct identity data. Encrypted backups expire within 30 days. De-identified aggregate solve-time and calibration metrics may be retained and cannot be used to restore the account.

Account dormancy

To keep our leaderboards and community stats accurate, accounts that are never used may be marked dormant. If you register but don’t sign in for 30 days, we may email you and then mark the account dormant.

Dormancy is not deletion. A dormant account still exists and you can reactivate it at any time simply by signing in. While an account is dormant it is removed from the public leaderboard and from our registered-user counts. This policy applies to self-registered accounts; accounts provisioned by an institution or competition are governed by that organiser’s agreement and are exempt.

Intellectual property

Challenge content, the REACTOR pipeline, and all platform code are owned by LevelUpCTF and its licensors. Challenges are for personal use and training — redistributing them outside the platform requires written permission.

Your solve history, writeups (where you choose to publish them), and profile content remain yours. By posting content visible to other players, you grant us a non-exclusive licence to display it within the platform.

Billing and subscriptions

Commercial plans (Community Tier, Business Tier, Enterprise Tier) are billed monthly or annually per the plan page. Cancellation ends billing at the end of the current period; we don’t pro-rate refunds for partial months except where required by local consumer-protection law.

AI Agent Evaluation API usage is metered. Rate limits and quotas are documented on the pricing page and in API responses.

Service availability

We run LevelUpCTF as reliably as we can but don’t promise an SLA on free or Developer tiers. Enterprise Tier contracts include a written SLA with credits for breach.

Limitation of liability

To the maximum extent allowed by law, LevelUpCTF is not liable for indirect, incidental, or consequential damages arising from platform use. Our aggregate liability is capped at the amount you paid us in the 12 months before the claim.

Nothing in these terms limits our liability for fraud, gross negligence, or statutory rights that cannot be waived.

Privacy

How we collect and use data is covered on the Privacy page. It’s linked from here because it’s the companion document to these terms.

Changes

We’ll email material changes to these terms at least 14 days before they take effect. Continued use of the platform after the effective date confirms you accept the updated terms.