Terms of Service

01Introduction

1.1.These Terms of Service (the "Terms") govern your access to and use of the website at duckurity.com and the Duckurity Academy at academy.duckurity.com (together, the "Service"). The Service is operated by Duckurity LLC, a company registered in the Arab Republic of Egypt with its registered office at 46 Abd El-Razzak El-Sanhouri, Makram Ebeid, 6th District, Nasr City, Cairo Governorate ("Duckurity", "we", "us" or "our"). Our full company details are set out in our Legal Notice.

1.2.The following documents form part of these Terms and are incorporated by reference:

• (a)the Acceptable Use Policy, which sets out what you may and may not do in the Service, including in labs;
• (b)the Payment and Refund Policy, which applies to paid plans; and
• (c)the Privacy Notice, which explains how we process personal data.

1.3.By creating an account or otherwise using the Service, you agree to these Terms. If you use the Service on behalf of an organization, you agree to these Terms on behalf of that organization and confirm that you are authorized to do so. If you do not agree to these Terms, you must not use the Service.

02Definitions

In these Terms:

• "Account" means the account you create to use the Academy.
• "Content" means any text, data or other material you submit to the Service, including writeups, names and messages.
• "Handle" means the unique identifier you select for your Account, which forms the address of your public profile.
• "Lab" means a deliberately vulnerable training environment made available through the Academy, and "Session" means a running instance of a Lab deployed for you.
• "Organization" means a university, company or other entity that manages students within the Academy.
• "Receipt" means the record generated when you submit a valid flag in a Session.

03The Service

3.1.The Academy is a practical cybersecurity training platform. Students deploy Labs, identify and exploit the vulnerabilities they contain, and submit flags. Organizations may manage students and assign Labs to groups of students.

3.2.Certain features are under development and are identified in the Service as unavailable. We do not commit to a release date for any feature that is not yet available.

04Eligibility

4.1.You must be at least 18 years old to create an Account or use the Academy.

4.2.You may not use the Service if you are prohibited from doing so under applicable law, or if we have previously suspended or terminated your Account and have not reinstated it.

05Your Account

5.1.Each Account is for one individual. You may associate more than one email address with your Account, but each email inbox may be associated with only one Account.

5.2.You must provide an email address that belongs to you and that is able to receive mail. We do not accept addresses from disposable email services.

5.3.Access to your Account is secured through your email address and any other sign-in methods you add. You are responsible for keeping those methods secure. You must notify us promptly at support@duckurity.com if you believe your Account has been accessed without your authorization.

5.4.A university email address may be used to verify student status. Because universities typically close these addresses after graduation, we recommend that you also add a personal email address or another sign-in method to your Account.

06Handles and Names

6.1.Certain Handles are reserved because they may be confused with Duckurity, its staff or parts of the Service. The Handle and name of a verified Organization are reserved for that Organization.

6.2.We may change or withdraw a Handle where we reasonably consider that it impersonates a person or an Organization, infringes the rights of a third party, is abusive, creates a safety risk, or contains an error that you have asked us to correct. We will inform you of the reason, and the withdrawn Handle will be retired rather than reassigned.

6.3.The name displayed with your Handle is chosen by you and is not verified. You must not use a name to impersonate any other person or Organization.

07Public Profile

7.1.Your profile is publicly accessible. It displays your Handle, your name, your generated avatar, your student number, the month you joined and, once Labs are available, your Receipts and completed Labs. Your email address is never displayed. The Privacy Notice describes precisely which information is public.

08Labs and Acceptable Use

8.1.Labs contain real vulnerabilities by design. You may test only the Session you have deployed, within the scope described in the Acceptable Use Policy. Any activity outside that scope is prohibited and may constitute a criminal offence under applicable law.

8.2.The skills taught in the Academy are intended for defending systems and for testing systems that you are authorized to test. You are solely responsible for your use of those skills outside the Service.

8.3.Each Session runs for a limited period determined by your plan. When a Session ends, its contents are permanently deleted. You should not store anything in a Session that you need to keep.

09Receipts and Certificates

9.1.A flag is valid only in the Session in which it was generated. A flag is either verified or rejected; there is no partial credit.

9.2.Receipts, ranks, completed Labs and certificates record activity within the Service. They are not academic degrees or accredited qualifications, and they have not been accredited by any ministry, university or professional body unless a certificate expressly states otherwise. You must not represent them as such.

9.3.We may withdraw any Receipt, rank or certificate obtained in breach of these Terms or the Acceptable Use Policy.

10Your Content

10.1.You retain ownership of your Content.

10.2.You grant us a worldwide, non-exclusive, royalty-free licence to host, store, reproduce, display and format your Content to the extent necessary to operate the Service, including to make it available to the audience you select, to verify it against your Sessions and to maintain backups. Where you make Content public, this licence extends to displaying it to the public. The licence ends when you delete the Content or your Account, except for copies held in backups until they expire and for public Content already shared by others.

10.3.You represent that your Content is your own work or that you have the right to submit it, and that it does not contain the personal data of others, confidential information, working exploits against systems outside the Service, or unlawful material.

10.4.A writeup relating to a private Lab remains visible only to you and, where it is submitted for an assignment, to the relevant instructors, until we retire that Lab. You must not publish flags, markers or solutions for private Labs elsewhere.

10.5.You may use AI tools to improve the wording of a writeup. You must not use them to fabricate any part of your Session. The evidence section of a writeup must reflect the actual requests and responses from your own Session.

10.6.Feedback. If you send us suggestions, ideas or other feedback about the Service, we may use them freely and without any obligation to you. This does not affect your ownership of your Content.

10.7.Copyright complaints. If you believe that Content in the Service infringes your copyright or other intellectual property rights, please write to support@duckurity.com and include:

• (a)a description of the work you believe has been infringed;
• (b)the address or location of the Content concerned;
• (c)your name and contact details; and
• (d)a statement that you are the rights holder or are authorized to act on their behalf, and that the information in your complaint is accurate.

We may remove or restrict access to the Content and will inform the user who submitted it, who may respond to the complaint. We may terminate the Accounts of users who repeatedly infringe the rights of others. Knowingly submitting a false complaint may make you liable for the resulting loss.

11Our Intellectual Property

11.1.The Labs, flags, software, design, the Duckurity name and the duck logo are owned by Duckurity or its licensors. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable and revocable right to use them within the Service for your personal learning while your Account remains active.

11.2.You must not copy, resell, mirror or scrape the Labs or the Service, or use our name or logo in a way that suggests our endorsement.

11.3.Open Labs are published in our openlabs repository under their own licences, which govern the Lab source code. Our hosting of those Labs is governed by these Terms. Third-party notices are listed on our Credits page.

12Organizations

12.1.Any user may create an Organization. An Organization remains unverified until it has demonstrated control of its domain and the verification has been reviewed by our staff.

12.2.If you are a member of an Organization, its administrators and instructors may view your activity relating to that Organization, as described in the Privacy Notice, and only for the period of your membership. Your Account remains yours. If you leave the Organization, your Receipts and profile remain with you.

12.3.If you administer an Organization, you must:

• (a)be authorized to act on its behalf and describe its name and type accurately;
• (b)invite only individuals who are eligible to accept these Terms; and
• (c)use the information you can access about members only for legitimate purposes and in accordance with the data protection laws that apply to your Organization.

12.4.We may remove a verification badge, or an Organization, that misrepresents itself.

12.5.Organizations on an Enterprise plan may enter into a separate agreement with us. In the event of a conflict, that agreement prevails over these Terms in respect of that Organization.

13AI Features

13.1.Certain features, including our AI mentor, Nester, use artificial intelligence. Such features are clearly identified as AI in the Service.

13.2.AI output may be inaccurate or incomplete and should be checked before you rely on it. You must not submit passwords, secrets or the personal data of others to AI features. The providers that generate AI output are listed in the Privacy Notice and on our Subprocessors page.

14Paid Plans

14.1.Certain features require a paid plan. Prices, plan features, regional pricing, taxes, refunds and cancellation are governed by the Payment and Refund Policy. In Egypt, plans are sold by Duckurity and payments are processed by Geidea. In all other countries, plans are sold through Polar, which acts as our merchant of record.

15Availability and Changes to the Service

15.1.We use reasonable efforts to keep the Service available, but we do not guarantee that it will be uninterrupted or error-free.

15.2.We may modify, add or remove features. If we remove a paid feature, we will give you reasonable advance notice and a fair refund for the loss of that feature.

16Suspension, Termination and Deletion

16.1.By you. You may stop using the Service at any time. You may deactivate your Account, which hides it until you next sign in, or delete it. A deleted Account is hidden immediately and its personal data is erased 30 days later. Signing in during that 30-day period cancels the deletion. Until these options are available in your account settings, you may request them at privacy@duckurity.com.

16.2.By us. We may suspend or terminate an Account that breaches these Terms or the Acceptable Use Policy, that creates a risk to other users or to the Service, or where we are required to do so by law. We will inform you of the reason unless doing so would compromise security or breach the law. You may request a review of the decision by a member of our staff at support@duckurity.com. In the case of a serious or repeated breach, we may act without prior notice.

16.3.If we terminate your Account other than for your breach, we will refund the unused portion of any paid plan.

16.4.Sections 9, 10, 11, 17, 18, 19 and 20 survive the termination of these Terms.

17Disclaimers

17.1.To the extent permitted by law, the Service is provided "as is" and "as available". Labs are intentionally insecure. We do not warrant that the Service will meet all of your requirements or prepare you for any particular examination or role.

17.2.Nothing in these Terms limits any rights you have as a consumer that cannot be limited under applicable law.

18Limitation of Liability

18.1.Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud, for intentional misconduct or gross negligence, or for any other liability that cannot be excluded or limited under applicable law.

18.2.Subject to section 18.1:

• (a)we are not liable for any indirect or unforeseeable loss, or for any loss of profits, business or data that you could reasonably have retained elsewhere; and
• (b)our total aggregate liability for all claims arising in any period of 12 months is limited to the amounts you paid us during that period.

18.3.If you are a consumer resident in the European Union, we are liable in accordance with the statutory provisions of your country of residence for breach of essential contractual obligations, limited to the damage that was reasonably foreseeable when the contract was concluded.

19Indemnity

19.1.If you use the Service on behalf of an Organization or for business purposes, you will indemnify us against reasonable costs and losses arising from third-party claims caused by your breach of these Terms or the Acceptable Use Policy. This section does not apply to consumers.

20Governing Law and Disputes

20.1.These Terms are governed by the laws of the Arab Republic of Egypt. The competent courts of Cairo have jurisdiction over any dispute arising from them.

20.2.If you are a consumer resident in the European Union, you also benefit from the mandatory provisions of the law of your country of residence, and you may bring proceedings in the courts of that country.

20.3.We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board.

20.4.Before commencing proceedings, we ask that you contact us at support@duckurity.com so that we can try to resolve the matter.

21Changes to These Terms

21.1.We may amend these Terms from time to time. We will update the date at the top of this page and, for material changes, notify you by email at least 30 days before they take effect. If you do not agree to the changes, you may delete your Account before they take effect and we will refund the unused portion of any paid plan. If you continue to use the Service after that date, the amended Terms will apply.

22General

22.1.If any provision of these Terms is held to be invalid or unenforceable, the remaining provisions remain in full force and effect.

22.2.Our failure to enforce any provision of these Terms is not a waiver of our right to do so later.

22.3.You may not assign or transfer your Account or your rights under these Terms. We may assign these Terms to a successor that takes over the Service, and we will notify you if we do.

22.4.Events beyond our control. We are not liable for any failure or delay in performing our obligations caused by events beyond our reasonable control, such as natural disasters, war, acts of government, widespread failures of public networks or third-party infrastructure, or attacks that we could not reasonably have prevented. We will notify you and resume performance as soon as reasonably possible. This does not affect your right to a refund for any part of a paid plan that we cannot provide.

22.5.Electronic communications. You agree to receive notices and other communications from us by email to the address associated with your Account or within the Service, and that such communications satisfy any requirement that they be in writing. Your acceptance of these Terms online has the same effect as a handwritten signature. Notices to us must be sent to the address in section 23.

22.6.Entire agreement. These Terms, together with the documents listed in section 1.2, form the entire agreement between you and us regarding the Service and replace any previous agreement on the same subject. Section 12.5 applies to Organizations that have entered into a separate agreement with us.

23Contact

Duckurity LLC, 46 Abd El-Razzak El-Sanhouri, Makram Ebeid, 6th District, Nasr City, Cairo Governorate, Arab Republic of Egypt. Email: support@duckurity.com.