Privacy

The ZeroBox app has no accounts, no analytics and no telemetry. Your data stays in your browser. This page explains what is stored, what is counted and what can leave your device.

Last updated 2026-10-12.

The app

The app is everything under /tracker/, /exam/, /notes/, /vault/ and the other tool pages. There is no sign-in and no ZeroBox server that receives your data. It does not load analytics, ads or third-party scripts.

An optional operator profile (a display name, callsign and avatar) exists, but it is only a label stored in your browser.

What the app stores in your browser

Everything below stays on your device, in the storage your browser gives this site.

• Your work. Targets and their status, notes, credentials and other loot, checklists, the attack graph, writeups, goals and exam simulator sessions. Most of it is in local storage. Larger items, such as the notes vault, long writeups and exam proof screenshots, are in IndexedDB.
• A safety copy. A second copy of your workspace and a few automatic snapshots, including one before an update, so a browser storage problem does not cost you your work. These are in IndexedDB.
• Preferences. Theme, layout, pinned tabs, sound and font settings, and whether you finished onboarding.
• An offline copy of the app. A service worker keeps the app files in the browser cache so ZeroBox opens without a connection. This holds the app itself, not your data.
• An AI key, only if you add one. See the AI section below.

The app code sets no cookies. If you want to look, the IndexedDB databases are named zerobox_vault_db, zerobox_deep_storage_db and zerobox_resilient_store_v1.

The public pages

The home page, the guides, the machine lists, the pentest notes and the other pages on this site load Cloudflare Web Analytics, including this page. It is cookieless and counts page views: which page, the referrer, the country and the browser. The app pages do not load it.

Cloudflare handles that data under its own privacy policy.

Optional AI scan interpretation

This is off by default and works only with your own Anthropic API key. If you add a key and approve the consent dialog, the scan text you selected is sent from your browser straight to api.anthropic.com. No ZeroBox server sits in between. What Anthropic does with it is covered by Anthropic's own terms and privacy policy.

• By default, IP addresses, hostnames, Active Directory domains and usernames are replaced with placeholders before sending. You can turn this off in the AI tab. The consent dialog shows the exact request first.
• You can choose to skip the dialog for later redacted requests. Requests without redaction always ask again.
• The key is kept in session storage and is cleared when you close the tab. It goes into local storage only if you choose to remember it on this device. You can remove it with Forget key.
• The connection test sends a small test request with your key.

Hosting

This site is hosted on GitHub Pages behind Cloudflare. Like any website, they see standard request information, such as your IP address and browser user agent, when you load a page. They handle it under their own policies.

Backups and sync files

Backups are files you create with the backup tool and move yourself. Nothing is uploaded. An encrypted export uses a passphrase you choose, and ZeroBox does not keep it, so it cannot recover a lost one.

Delete your data

Clear the site data for ctftracker.com in your browser settings. That removes everything the app stores, including local storage, IndexedDB and the offline cache.

Inside the app, Backup has a Reset all progress option. It resets target progress and clears flags, notes, loot and the vault, but it leaves your preferences and any saved AI key. Forget key removes the key.

Questions

The source is public, so you can check all of this. To ask a question or report a problem, open an issue on GitHub. See also the terms.