Get Started

A Company

PrivacyPolicy.

Draft: this hasn’t been reviewed by a lawyer yet and may change before Bruise launches.

Last updated October 1, 2026

Bruise is a cybersecurity training platform run by Layer7 Technologies, Inc. This policy says what we collect when you use Bruise, why, who can see it, and what you can do about it. We don’t sell your data, show ads, or use analytics or tracking tools.

What we collect

  • Your account: your email address, a handle (your public name on Bruise), an optional real name, and a password, which we store only as a strong one-way hash. If you sign in with Google or Microsoft, we get your account ID, email and name from them.
  • What you do on Bruise: the answers you submit (right and wrong), whether an answer was pasted, your solves, the hints you unlock, writeups you publish, the time you spend on challenge pages, and the practice targets you start.
  • Groups: the teams, classes and events you join, exam start and hand-in times, and what instructors add for you in a class, like extra time, grades and feedback.
  • AI features: questions you ask the AI tutor and its answers, and AI feedback you ask for on your writeups.
  • Technical details: your IP address and browser type when you sign in, your IP address with each answer and in your account’s activity log, and the cookies listed below.

How we use it

  • To run Bruise: your account, scoring, leaderboards, certificates, teams, classes and events.
  • To share your progress with the instructors of classes you join.
  • To keep Bruise safe: rate limits, a bot check on sign-up and sign-in, and a log of account and admin actions.
  • To email you about your account: confirming your address, resetting your password, and security notices. We don’t send marketing email.
  • To answer you when you use an AI feature.

Who can see what

  • Everyone: your handle and, depending on your profile setting, your profile (points, rank, skills, recent finishes and certificates).
  • Other players: your handle on scoreboards and in writeups you publish (only to players who solved that challenge). Your real name only if you turn on “Show my name to other players”.
  • Your teams: your handle and role, and your place on the team’s own board.
  • Instructors of your classes: your name, your progress and accuracy, active time, exam times, writeups and grades, your email address in their grades export, signals that may point to shared answers, and AI summaries of your progress. With your permission each time, an instructor can watch your Bruise screen live to help you.
  • Bruise admins: account details and activity across Bruise, to run and protect the service.

Services we use

  • Cloudflare hosts Bruise and its database, sends our email, and runs our AI features (Workers AI). The AI tutor gets the challenge, your question and your recent wrong answers, not your email or handle.
  • Google and Microsoft, if you choose to sign in with them.
  • Prosopo runs the bot check on sign-up, sign-in and password reset. Your browser talks to Prosopo directly, so Prosopo sees your IP address and browser details. We send Prosopo only the check’s result token.
  • Have I Been Pwned tells us if a new password has appeared in a known breach. We send only the first five characters of a hash of it, never the password.
  • Discord, only if a team’s coach (or, on a personal team, a captain) connects its channel: your handle appears in posts about your team’s first solves.
  • DNSweep, Layer7’s DNS service, answers the lookups you run in Tools. It gets the domain or address you look up, nothing about you.

Cookies and storage

We use only the cookies Bruise needs: one that keeps you signed in (30 days), one that links an email confirmation to the browser you signed up in (24 hours), one for the Google or Microsoft sign-in round trip (10 minutes), and one that lets a practice target know it’s yours (until it shuts down). Your browser’s local storage keeps display preferences, cleared when you sign out.

How long we keep it

We keep your account and activity while you have an account. Expired sessions and sign-in links are deleted, and IP addresses are removed from answers, sessions and the activity log after 90 days. When you delete your account, everything tied to it is deleted, except the record of account and admin actions, which we keep without your IP address to protect Bruise.

Your choices

  • Make your profile public, Bruise-only or private, and choose whether others see your name, in Settings.
  • Download everything we hold about your account, as a file, from Settings.
  • Delete your account from Settings. It’s permanent.
  • Disconnect Google or Microsoft sign-in at any time.
  • Use the AI tutor and AI feedback only if you want to: neither runs unless you ask.

Students and schools

You need to be at least 13 to use Bruise. If you’re under 18, you need a parent’s, guardian’s or school’s permission. When a school or instructor uses Bruise for a class, what we hold about that class is shared with them as described above, and they can ask us about it.

Changes and contact

If we change this policy in a way that matters, we’ll tell you on Bruise before it takes effect. Questions or requests about your data: contact Layer7 Technologies, Inc. at the address on l7.gg.