Last updated: 5 November 2026
RootRaid ("we", "us") runs rootraid.com, a gamified platform for learning Microsoft security. This page explains, in plain English, what we collect, why, and what you can do about it.
1. What we collect
- Your account: your name, username, email address and password (stored encrypted by WordPress). If you use "Continue with Google", Google shares your name, email address and profile picture with us. We never see your Google password.
- Your learning progress: the raids you join, the tasks you complete, the questions you solve and when, your XP, rank, badges and daily streak. We do not store your wrong answers.
- Technical data: your IP address and browser information, which our hosting and security tools use to keep the site safe (for example, to block attacks and stop people guessing passwords).
- Cookies: small files that keep you signed in and protect forms from abuse. We don't use advertising cookies.
2. Why we use it
- To create your account and let you sign in.
- To save your progress so you can continue on any device.
- To show your XP, rank, badges and certificates.
- To show the leaderboard. Only your public display name and XP appear there, never your email address.
- To keep RootRaid secure and working.
- To email you about your account or important changes. We won't send marketing emails without your consent.
3. Who we share it with
We don't sell your data. We only share it with services that help us run RootRaid:
- Hostinger, which hosts the website and its database.
- Google, only if you choose "Continue with Google".
- Wordfence, our security plugin, which may process IP addresses to block attacks.
- Payment providers (for example Stripe), only if you buy a paid plan in the future. They handle your card details; we never see or store them.
We may also share information if the law requires it.
4. How long we keep it
We keep your account and progress while your account is active. If you ask us to delete your account, we delete your personal data within 30 days, except where we must keep something by law.
5. Your choices and rights
- See or download the data we hold about you.
- Correct your details, including your public display name (Profile settings).
- Delete your account and data.
- Object to or limit how we use your data.
Email us at hello@rootraid.com and we'll reply within 30 days.
6. Labs and practice data
The datasets in our raids (sign-in logs, IP addresses, names and companies) are fictional. When a raid asks you to use your own free Microsoft tools (for example Azure Data Explorer), those services are run by Microsoft under Microsoft's own privacy terms.
7. Children
RootRaid is meant for people aged 16 and over. If you're younger, please use it with a parent's or guardian's permission.
8. Security
We use HTTPS, a web application firewall, two-factor authentication for administrators, and server-side answer checking. No system is 100% secure, but protecting your data is literally what we teach. 🛡️
9. Changes
If we change this policy, we'll update the date at the top. For big changes, we'll let you know by email or on the site.
10. Contact
Questions? Email hello@rootraid.com.