No tricks on this page

Rules & data handling

This page is written straight.

The Trackerator is a privacy challenge, and parts of it are deliberately confusing — that's the lesson. This page is not one of those parts. No character voice, no tricks, everything literal.

So, literally: we are not tracking you. There is no company, no partners, nothing is sold, and nothing here can identify a real person. The rest of this page explains exactly why that's true rather than asking you to take our word for it.

The short version

This app plays a character: a data broker that has worked you out from a handful of check-ins. The character is convincing on purpose, because the point only lands if it is.

Every input to that character is something you typed in as a joke or a QR code you chose to scan. There is no hidden channel. Nothing arrives here that you didn't put here.

How to play

Register at the first venue. Pick a handle, answer some nonsense questions.
Scan the card at each venue you visit. That's the whole game.
After 3 check-ins, your dossier unlocks.
There are flags hidden in the app. Submit them in CTFd.

What we actually collect

The complete list. Not a summary of a longer list.

A handle you invented.
Your answers to the joke questions on the signup form.
A venue ID and a timestamp, once per QR scan.

There is no email field, no phone field, no real-name field — not hidden ones, none at all. We don't fingerprint your device, read its MAC address, or watch the wifi. Not because we couldn't, but because a privacy challenge that does that has become the thing it's warning about.

We also ask you not to type anything real into the fields that do exist. Make up a handle, answer the questions badly. The dossier at the end is funnier that way and it costs you nothing, because the app has no way to tell whether any of it is true — which is itself worth noticing about profiles built this way.

How long we keep it

Storage is session-scoped and the whole database is wiped on a timer after the event by a script that actually runs. The server itself gets destroyed. If you ask us next month for your data, the honest answer is that it's already gone.

Playing without check-ins

Some people would simply rather not have a list of venues and times sitting in a database today, however synthetic. That's a perfectly sensible way to feel and there's a mode for it.

Any check-ins already recorded for you are deleted.
No new ones are recorded.
You get a ready-made dossier built from a fictional person instead.
You score exactly the same as everyone else.

No penalty, no reduced content, no "are you sure?" loop, and you can switch back whenever you like. The confusing consent stuff elsewhere in this app is part of the character and governs a fictional sale of made-up data. It has nothing to do with this button.

Flags

There is nothing to hack here.

Every flag in this challenge is sitting in the app's own interface — on a page you can reach by tapping, in text you can read. Finding them is a reading exercise and an attention exercise, and that is the entire point.

No exploits, no 0-days, no injection, nothing to bypass.
No hidden endpoints to guess and no source to pull apart.
No terminal, no tooling, no downloads. A phone is enough.
Nothing is hidden in the page source that isn't also on the page.

If you find yourself reaching for a tool, you've left the intended path. Come back and read more carefully instead — that's where they all are. Please don't attack the server; there's nothing in it and you'd be spoiling someone else's afternoon.