The short version. Playing requires no account and stores nothing that identifies you. Signing in with Google is optional and exists for one reason: to unlock your report and keep your own records. Your name never appears in public unless you tick a box that is unticked by default. There is no advertising, no analytics, no tracking, no profiling, and nothing is sold or shared with anyone for marketing.
01Who is responsible
INFORMÁTICA TÉCNICA ROBOTIZADA SATENUR, S.L.U. (“ITR”)
CIF B75572123
C/ Blas de Otero nº 2, local 4 · 50018 Zaragoza · Spain
Data protection enquiries: privacy@aegixplay.com
General enquiries: contact@aegixplay.com
Aegix Play is a project run by ITR, a cybersecurity consultancy based in
Zaragoza. ITR is the data controller for everything described on this page.
The corporate site is ip-sac.com
and has its own privacy policy covering ITR’s consultancy work; this notice
covers aegixplay.com only.
02What we use your data for
These are the only purposes. They are not a general list copied from a consultancy’s policy — each one corresponds to something this site actually does.
| Purpose | What it involves | Legal basis |
|---|---|---|
| Running the game | Playing an arena. The game state travels in a signed token in your browser and is never linked to you. No account, no personal data. | Not personal data |
| Recording the outcome of a game | When a game ends we store the result: which scenario and which edition of it, whether you survived, the grade, shields, blocks, hits, money spent, how long it took, and the points that result is worth. If you are not signed in, this row has no link to any person. | Legitimate interest in operating the arena and its leaderboard (Art. 6(1)(f) GDPR) |
| Ranking accounts by points, and showing a rank | Adding up the points from the results above — only your best
result on each game counts — into a ranking for the current
calendar month, a ranking for all time, and a rank:
one of fifteen levels reached at a given lifetime total, which does
not go down.
This uses results we already hold and collects nothing further about you. It is nevertheless described separately, because a rank is a more lasting statement about a person than a position in a monthly table: it is calculated from everything you have ever played and it is shown beside your name wherever your name appears. The rank is calculated when it is shown and never stored — there is no rank column on your account. Your name appears in a ranking only if you have switched on the leaderboard consent below; otherwise your entry is shown without a name, and you can still see your own position and your own rank. Monthly medals are the one exception, and they are stored. When a calendar month closes, the three accounts at the top of that month's ranking are recorded as having finished first, second or third in it. That record is kept: it is a statement about a month that has ended, and recalculating it later — after other people have deleted their accounts, for example — would take a medal away from somebody who had won it. It is shown to you in your own profile. Deleting your account deletes your medals with it, and they are the only part of your standing that is written down rather than worked out when it is displayed. |
Legitimate interest in operating the arena and its leaderboard (Art. 6(1)(f) GDPR) |
| Signing you in | Identifying you through Google so the full report can be unlocked and so your own past results can be shown back to you. | Providing the service you asked for (Art. 6(1)(b) GDPR) |
| Showing your name publicly | Displaying a name you choose next to your score on the leaderboard. Off by default. Nothing appears until you switch it on. | Your explicit consent, withdrawable at any time (Art. 6(1)(a) GDPR) |
| Telling you when an arena opens | The front page lists arenas that are not built yet. If you are signed in and press Tell me when it opens on one of them, we record that you asked, and when that arena opens we send you one message saying so, to the address on your account. Nothing else: no newsletter, no reminders, no second message. The count of people waiting for each arena is shown on the tile as a number, with nobody’s name behind it, and tells us which arena to build first. Press the button again and the request is gone. | Providing the service you asked for (Art. 6(1)(b) GDPR): you asked to be told, and you can withdraw the request at any time |
| Giving an organisation content of its own | An organisation — a university, a company — can be given
an arena of its own, and only the people it names can
see or play the games in that arena. To do that we record
which group you are in, and which groups and people
each private arena has been given to.
A private arena does not appear on this site at all for anybody else: no tile, no card, no address that can be guessed. You reach it only by signing in, and only if you have been given it. The group has a name we agreed with the organisation, such as “University 2026”. You cannot join or leave a group yourself. We put you in one at the organisation’s request and take you out at its request or at yours. The organisation is not given a panel: it does not see the list of members, who played, or what anybody scored. Nobody outside ITR sees any of that either. If that ever changes, this notice changes first. |
Legitimate interest in providing the training your organisation arranged, and in making sure that content meant for one group is not shown to anybody else (Art. 6(1)(f) GDPR) |
| Administering the site | A small number of staff accounts can sign in to an internal panel to look at accounts and results — for example to answer somebody who has written to us. Which accounts those are is recorded as a role on the account. Every screen they open and every search they make is written to an audit record: who, when, what, and — for a search — the address they looked for, masked. Nobody outside ITR ever sees the panel or the audit records. | Legitimate interest in operating the service safely and being able to account for what staff did (Art. 6(1)(f) GDPR) |
| Keeping the service up | Limiting how many requests one address can make, so the game cannot be scraped or flooded. | Legitimate interest in the security and availability of the service (Art. 6(1)(f) GDPR) |
What we do not do
We do not advertise, and we do not let anyone advertise here. We run no analytics: there is no Google Analytics, no pixel, no tag manager, no heatmap, no session recording. We do not profile you, we make no automated decisions that produce legal effects, and we do not sell, rent or share personal data with third parties for their own purposes.
Playing does not subscribe you to anything. The report ends with an invitation to request a security assessment from ITR; that is an ordinary link, and following it is your decision. Until you write to us, nobody from ITR will contact you because you played a game.
03What we actually store
If you never sign in
One row describing the game, and nothing else: the scenario, whether you survived, your grade, shields left, blocks, hits, money spent, budget left, elapsed time, a random identifier for that single game, and the date. There is no name, no email, no address and no identifier that leads back to you.
If you sign in with Google
Google tells us three things about you, and only three, because those are
the only ones we ask for (openid, email,
profile):
- your Google account identifier — an opaque number, not your password;
- your email address;
- the name on your Google account.
To that we add, only if you choose it, the display name you type for the leaderboard and whether you consented to it being shown. We also record when your account was created here and when you last signed in.
We never see and never receive your Google password. The authentication happens on Google’s servers. We are told the outcome, not the credentials.
If you sign in with Microsoft
The same three things arrive, from the same three scopes: an account identifier, an email address and a name. We never see and never receive your Microsoft password — the authentication happens on Microsoft’s servers.
One thing is handled differently, and it is worth explaining because it changes what happens to you. Microsoft allows the organisation that runs your account to set the email address on it, and does not by itself guarantee that the address belongs to you. So we treat it as unconfirmed unless Microsoft also tells us that the organisation has verified the internet domain it belongs to. Personal Microsoft accounts are always in the first case.
An unconfirmed address is exactly the same situation as signing up with a password: you play, your games are saved, and we send you one message with a link so you can prove the mailbox is yours. Until you open it your name does not appear on any leaderboard and your account can hold no administrative role. We never use an unconfirmed address to join your sign-in to an account that already exists here — that is what would let somebody reach another person’s account by claiming their address, and it is the whole reason for the paragraph above.
If you sign up with an address and a password
We store your email address, a hash of your password, and whether the address has been confirmed. A hash is a one-way fingerprint: we can check that a password you type matches it, and we cannot work out the password from it. We never store the password itself, and nobody here can read it — not an administrator, not a database backup, not us.
When you sign up we send one message to that address with a link, so that you can prove the mailbox is yours. The link works for 24 hours and is sent through the same mail provider that serves this domain. Until you open it you can play normally and your games are saved, but your name will not appear on any leaderboard and your account cannot hold any administrative role. That is the whole reason the confirmation exists: it stops somebody publishing a name beside a score using an address that is not theirs.
If you later sign in with Google using the same address, and that address has been confirmed, the two ways in become one account. An unconfirmed account is never joined this way — otherwise registering with somebody else’s address would be a way into their account.
If you write to us through the form
We store nothing. The form does not write to a database: it composes one email and sends it to our own mailbox, and what we keep afterwards is that email, in that mailbox, like any other message somebody sends us.
It contains what you typed — your message, your email address, and your name if you gave one — plus the page you wrote from and the time. The address is used to answer you and for nothing else: no list, no newsletter, no third party. Messages are deleted when the matter they are about is closed, and at the latest after two years.
The form can only write to us. It cannot send email to an address you type, and it never sends you a confirmation, precisely so that it cannot be used to send mail from this domain to anybody else.
If you ask to be told when an arena opens
One row per arena you asked about: which arena, an internal reference to your account, and the date you pressed the button. Nothing you did not already give us. When the arena opens we send one message to the address on your account, through the same mail provider that serves this domain, and the row is deleted once that message has gone. Pressing the button again deletes it sooner; erasing your account deletes it with everything else.
If you are in a group
One row per group you are in: which group, an internal reference to your account, and who added you and when. That is all — a group is a list of accounts, and being on it says nothing about you except that somebody put you there. Where an arena has been given to you personally rather than through a group, there is one more row of the same shape: which arena, the reference to your account, and the date.
Both are deleted when you are taken out of the group, and when your account is erased. Inside our panel a member list shows a name and a reference, never an address: somebody is added to a group by typing their exact address, which is checked and then not kept by the list.
Technical data
To limit abuse, the server keeps your IP address in memory, paired with the route you called, for at most sixty seconds. It is never written to the database. Separately, our hosting provider keeps its own web server logs, as any hosting provider does; those logs are the provider’s and are covered by its own terms.
Identity and performance are kept apart
This is a deliberate design choice, not an accident of implementation. Who you are lives in one table; what you did lives in another, joined by an internal number. When an account is erased, the link is destroyed and the game statistics survive without it. That is what erasure has to mean when the statistics still need to work.
04Cookies and browser storage
There is no cookie banner on this site, and that is not an oversight. Every cookie we set is strictly necessary to do something you asked for. We set no analytics cookies and no advertising cookies, so there is nothing to ask your permission for.
All three cookies are first-party, HttpOnly (JavaScript
cannot read them), SameSite=Lax and Secure.
| Cookie | What it is for | Life |
|---|---|---|
ax_session |
Keeps you signed in. Holds your account identifier, name and email in a signed value, so the server can recognise you without a lookup. | 7 days |
ax_state |
Set only while you are being sent to Google and back. It is what stops somebody forging that return trip. | 10 minutes |
ax_ms_state |
The same thing for the trip to Microsoft. It is a separate cookie so that starting one sign-in cannot cancel the other. | 10 minutes |
ax_reset |
Set only when you open a “forgotten password” link, and it holds the token from that link. It lives in a cookie rather than in the address bar so that it never lands in your browser history, in a proxy log or in a referrer header. Deleted the moment the password is changed. | 15 minutes, single use |
ax_pending |
Carries your finished game across the trip to Google, so signing in reopens the report you just earned instead of losing it. Deleted the moment the report opens. | 15 minutes, single use |
Storage that is not a cookie
ax_gamein local storage — a spare copy of that same finished game, used only if the cookie above does not survive the trip. It expires after 30 minutes and is deleted as soon as it is used.ax_reloadedin session storage — a flag that stops the page reloading in a loop after we publish a new version. It contains a version number and nothing else.
How to get rid of them
Every browser lets you view and delete cookies and site data for a single
site, usually under Settings → Privacy. Deleting
ax_session signs you out immediately; it does not delete your
account or your results. You may also block cookies for this site entirely:
the game will still work from beginning to end, but you will not be able to
sign in, and therefore not able to open the full report.
05Who else is involved
Only if you click sign in. At that moment your browser goes to Google, you authenticate there, and Google returns the three items listed above. If you never click it, this site makes no request to Google at all. Google’s handling of that authentication is governed by Google’s own privacy policy. Google may process data outside the European Economic Area under the safeguards it publishes for international transfers.
The typefaces on this site used to be loaded from Google’s servers, which sent every visitor’s IP address to Google before they had agreed to anything. They are now served from this domain. That transfer no longer happens.
Microsoft
Only if you click sign in with Microsoft. At that moment your browser goes to Microsoft, you authenticate there, and Microsoft returns the same three items described in section 3. If you never click it, this site makes no request to Microsoft at all. Microsoft’s handling of that authentication is governed by Microsoft’s own privacy statement. Microsoft may process data outside the European Economic Area under the safeguards it publishes for international transfers.
Hosting
The site and its database run on infrastructure provided by Hostinger, which acts as our processor: it stores the data on our behalf and under our instructions, and does not use it for its own purposes. Where its infrastructure involves processing outside the European Economic Area, that is governed by the safeguards in its data processing terms.
Nobody else
There is no third party beyond those two. No advertising network, no analytics provider, no email platform, no customer data platform.
06How long we keep it
| What | Kept for |
|---|---|
| Your account, if you have signed in | Until you ask us to erase it, or until two years have passed since you last signed in, whichever comes first |
| Game results linked to your account | Deleted with the account, or unlinked and kept as anonymous statistics if you ask for erasure but the aggregate is still in use |
| Results with no account attached | Two years from the date of the game |
| IP address held for rate limiting | Sixty seconds, in memory only |
| Your request to be told when an arena opens | Until that arena opens and the one message has been sent, or until you press the button again, or until your account is erased — whichever comes first |
| Your membership of a group, and an arena given to you personally | Until you are taken out of it, or until your account is erased — whichever comes first |
| Audit records of what staff did in the internal panel | Five years from the action. Longer than everything else on purpose: the question an audit record answers — who did that, and when — is one that gets asked long afterwards. These records are excluded from the daily deletion above, and they survive the deletion of the account they describe, including the staff member's own. |
These deletions are automatic. The site runs the check once a day and removes whatever has passed its date, without anybody having to remember. Deleting an account also deletes the results attached to it.
07Your rights
Under the GDPR and Spanish data protection law you may ask us to give you a copy of your data, correct it, erase it, restrict what we do with it, object to processing based on legitimate interest, or hand it to you in a portable format. Where we rely on your consent — which is only the case for showing your name publicly — you may withdraw it at any time, and withdrawing it does not affect what was lawful before.
You can switch the leaderboard consent off yourself, immediately, from the checkbox on the arena page. For anything else, write to privacy@aegixplay.com from the address you signed in with, so we can be reasonably sure it is you. We will answer within one month.
Being straight with you about how this works today. There is still no self-service button for downloading or deleting your data: you ask us, and we do it. What changed is on our side — erasure is now carried out from the staff panel rather than by hand, so it happens the same way every time and is recorded in the audit trail described in section 2. Building the self-service version is still on our list.
Moderating a public name
If you put yourself on the leaderboard, the name shown there is one you chose, and it is published to everyone. We may change or remove that name, or take the entry off the leaderboard, if it is offensive, impersonates somebody, or is used to advertise. We change what is displayed and nothing else: your account, your results and your access to the game are untouched, and you can set a new name or opt back on to the board yourself.
Every such change is recorded in the audit trail, with the address of the member of staff who made it and the address concerned shortened.
If you think we have handled your data badly, you are entitled to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid). We would rather you told us first, but that is your choice and not a condition.
08Age
This site is not aimed at children. You must be at least 14 years old to sign in, which is the age at which Spanish law allows a minor to consent to the processing of their own data. Anyone of any age can play without signing in, because doing so involves no personal data. If you believe a child under 14 has created an account, write to us and we will delete it.
09How we protect it
- The whole site is served over HTTPS.
- We never handle your password. Google does the authentication.
- Session cookies are signed and verified in constant time, so the signature cannot be guessed by measuring how long a check takes.
- The rules of the game run on the server, so a game result cannot be forged from the browser.
- Requests are rate limited to make bulk abuse impractical.
- Email addresses are never included in the leaderboard, in any API response, or in anything a visitor can reach.
No system is perfectly secure, and we would rather say so than imply otherwise. If you find a weakness in this site, please tell us at contact@aegixplay.com. We will take it seriously and we will not come after you for reporting it in good faith.
10Permitted use
This is a game, not an audit. Aegix Play teaches by simulation. The scenarios are deliberately simplified, the numbers are invented for teaching, and the references to ISO 27001 controls are illustrative. Your result is not a security assessment, not a certification, not a compliance statement and not professional advice about your real organisation. Do not present it as any of those. If you want the real thing, that is what ITR does for a living, and you can ask us.
What you may do
- Play as often as an arena allows, alone or with your team.
- Share your result and your report, including at work, as a training exercise or a conversation starter.
- Quote the report, provided you make clear where it came from and that it is the output of a game.
What you may not do
- Alter, forge or replay the signed tokens that carry the game state, or otherwise attempt to record a result you did not earn.
- Play automatically, or call the API by script, in order to extract the scenarios, the wave composition or the scoring formula.
- Deliberately overload the service, or work around the rate limits.
- Probe, scan or attack the site. Reporting a weakness you found by accident is welcome; going looking for one without asking us first is not.
- Choose a display name that insults anyone, impersonates a real person or organisation, contains someone else’s personal data, or that you would not want shown to a room full of strangers.
We may remove a display name without warning, and we may withdraw access from anyone who does the things in that second list. The leaderboard is a small pleasure and we intend to keep it usable.
11Changes to this notice
If what we do with data changes, this page changes with it, and the date at the top changes too. Two kinds of change, treated differently:
- Wording. A clearer sentence, a corrected typo, a new phone number. The date changes and the version does not. We will not interrupt you for it.
- Substance. A new purpose, a new recipient, new data collected, a longer retention period, a different legal basis. The version number changes, and if you have an account you will see a notice on this site the next time you visit, saying what changed, with a link back here. It disappears once you have seen it and does not come back.
That notice is information, not a consent form. Being told about a change is not the same as agreeing to it, and we will not pretend otherwise by putting an “I agree” button on something that is simply an announcement. If a change ever needs your consent, you will be asked for it properly, and you will be free to say no.
History
| Version | Date | What changed |
|---|---|---|
| 1.11 | 18 September 2026 | Some arenas are private: an organisation — a university, a company — is given one, and only the people it names can see or play the games in it. That means we record which group you are in, which is a new thing stored about you and a new purpose, in sections 2 and 3, kept until you are taken out of the group or your account is erased (section 6). This was already true and this notice had not said so — the feature was built in an earlier release and described here only now. The organisation is not given a panel and is not shown who played or what they scored. |
| 1.10 | 3 September 2026 | The front page now lets a signed-in player press Tell me when it opens on an arena that is not built yet. That request is stored — which arena, your account, the date — and is a new purpose, in section 2: one message to your address when the arena opens, and nothing else. Section 3 says what the row holds and section 6 how long: until the message has gone, until you press again, or until your account is erased. The number of people waiting is shown on the tile without anybody’s name. |
| 1.9 | 31 August 2026 | A closed month now awards medals to its top three, and a medal is stored — the first thing about your standing that is. Everything else in section 2 is calculated when it is shown; a medal is a statement about a month that has ended, and recalculating it later would take it away from people who had won it. Nothing new is collected: the medal comes from results already described, and deleting your account deletes your medals with it. |
| 1.8 | 30 August 2026 | Points now also produce a rank: one of fifteen levels reached at a lifetime total, which never goes down and is shown beside your name. Nothing new is collected — it is calculated from results already described in section 3, and it is calculated when shown rather than stored. It is announced because a lasting rank says more about a person than a monthly position does, and section 2 now says so. |
| 1.7 | 30 August 2026 | You can now sign in with a Microsoft account.
Microsoft is a new recipient — named in section 5 — and
sets a new cookie, ax_ms_state, listed in section 4.
The same section now also lists ax_reset, which has
been set since password accounts arrived and was missing from the
table by mistake.
Nothing new is stored about you: the same three items arrive as
from Google. Section 3 explains the one difference that affects
you, which is that an address from Microsoft is treated as
unconfirmed, and confirmed by a link, unless Microsoft states that
the organisation behind the account has verified its domain. |
| 1.6 | 30 August 2026 | Editorial: the controller’s registered name is corrected to INFORMÁTICA TÉCNICA ROBOTIZADA SATENUR, S.L.U. — it was printed here without the final R. The same company, the same CIF, the same address. Nothing about the processing changed. |
| 1.6 | 23 August 2026 | Games now earn points, and those points are added up into a monthly ranking and an all-time one. Only your best result on each game counts. Nothing new is collected about you — these are the same results already described in section 3, counted a different way — but it is a new use of them, so it is stated rather than left to be discovered. Your name appears in a ranking only under the same consent that puts it on the leaderboard. See Ranking accounts by points in section 2. |
| 1.3 | 22 August 2026 | The staff panel gained its first two abilities to change something. It can now moderate the name you show on the leaderboard — change it, remove it, or take the entry off the board — and it can erase an account, which until now was done by hand. Nothing new is collected about you, and both actions are recorded in the audit record described in section 2. See Moderating a public name in section 7. |
| 1.2 | 21 August 2026 | A staff panel was added. Two new things: a role on an account, saying whether it can use that panel, and an audit record of what staff do in it, kept for five years. Nothing about what is collected from a player changed, and the panel cannot alter anything — in this version it can only look. |
| 1.1 | 21 August 2026 | Results with no account attached are now deleted after two years instead of three, and both deletions run automatically every day rather than on request. Nothing new is collected and nothing is kept for longer. |
| 1.0 | 21 August 2026 | Editorial: the contact telephone number was removed. Nothing about the processing changed; write to us at the addresses above. |
| 1.0 | 20 August 2026 | First publication. |
Questions about anything on this page: privacy@aegixplay.com. A real person reads that address.