Privacy and usage statistics
This page explains what AttackGraph.org records, why, and how to switch it off.
Usage statistics
To see how the site is used and improve it, we record anonymous statistics:
- a random number stored in your browser, so a return visit can be counted as the same visitor
- a random number for each visit
- which pages you view, and roughly how long you actively use them
- in the tools, what kind of action you take (for example "exported a PNG" or "loaded the example") and counts of edits. Never what you wrote
- the website you came from, if any (just its name, such as moodle.example.ac.uk)
We don't record your name, email address or IP address in these statistics, don't use cookies for them, and don't share them with anyone. They're kept for about 13 months.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we don't collect statistics at all. You can also switch them off here:
Your work in the Attack Graph Builder
What you type stays in your own browser. It's kept in your browser's storage so you don't lose it if you close the page, and it's only saved to a file when you choose Save.
If you sign in
Signing in is optional. If you do, we store a username you choose and the email address you give (used only to send your sign-in link — there are no passwords). Any email address works; it doesn't have to be a university one. While you're signed in, your activity log is saved to our server as you work, so a tutor can confirm the work is yours, and each sign-in is recorded. You can ask us to delete your account and its data at any time.
Your course progress (which tasks you've opened and your best check result) and the title of your last graph are also kept in your browser, so the home page can offer to continue where you left off. They aren't sent to us.
The builder also keeps an activity log of how your graph was built, so your tutor can see the work was done by you. It records:
- each change, when it was made, and whether it was typed, pasted or made on the graph
- the text you typed, pasted or deleted
- changes you made on the graph, such as adding, linking or renaming boxes
- when the builder was in the background (you switched to another window or tab) for 5 seconds or more, and for how long
- when you opened, saved and exported your work
The log stays in your browser with your work. It goes into the file when you save, into the activity log file when you export it, and to your tutor when you email your work. We don't receive it otherwise.
Emailing your work to a tutor
When you use Email to tutor, our server sends an email to the address you enter, with a copy to your own address if you give one. It contains your name, your message, your activity log and the files you chose (graph code, SVG, PNG). Work can only be emailed to university addresses.
To stop the form being misused by automated programs, it includes a check that you're a person, provided by Cloudflare Turnstile. It loads only when you open Email to tutor, and Cloudflare receives technical information about your browser to make the check. Emails can't contain web or email addresses in the name or message.
We don't keep a copy of your work or the email. To prevent misuse, we record the email's reference number, when it was sent, the tutor's email domain (for example warwick.ac.uk, not the full address), whether you asked for a copy, and a fingerprint of the activity log so a sending can be confirmed later. We also keep a scrambled form of your IP address for two days, only to limit how many emails can be sent. These records are kept for about 13 months.
Sending work to a class
If your lecturer uses class codes, Send to lecturer stores what you send: your name, the class code, any message, your graph with its activity log, and the images you include. Only the lecturer who owns that class code can see it. It's kept for about 13 months and then deleted, or sooner if your lecturer deletes it.
Contact
AttackGraph.org is run by Harj Lallie. To ask about your data or have it removed, contact [contact email to be added].