Privacy Notice
Effective 1 October 2026
Who we are
TRG QUESTS LLC, a Delaware limited liability company based in Dover, Delaware, United States (“we”, “us”), operates The Phishing Dojo (the “Service”) at phishingdojo.com.
Privacy questions: hello@theredguild.org. Security reports: security@theredguild.org.
This notice
This notice describes how we handle personal data when you visit the site, join the waitlist, create an account, or use the Service. It is written for workplace training. The Service is not for anyone under 18.
Who is responsible
For waitlist signups and for accounts that have never belonged to an organization, we decide why and how personal data is processed.
For people invited or provisioned into an organization, that organization is responsible for the personal data it puts in the Service (names, work emails, assignments, completion records). We process that data to provide the Service to the organization.
What we collect
Depending on how you use the Service, we may process:
Account details: name, email address, password (stored by our authentication provider), profile photo if you upload one, role, and, for accounts outside an organization, an individual plan.
Upgrade requests, including any message you add.
Organization data: organization name, membership, teams, invitations, plan, and single sign-on configuration (including SAML identifiers when SSO is used).
Training records: progress, completions, assignment status, and assessment results. Behavioral metrics record timing and position only — not quiz answer text, and not whether an answer was correct.
Waitlist email addresses, when the waitlist is open.
Messages you send to Dojo Sensei, when that tutor is enabled, so it can reply.
Technical data needed to run the Service: session cookies, a sidebar-layout preference cookie, coarse usage analytics, and hashed addresses used only to rate-limit public forms.
Error reports, application logs, and performance telemetry, which may include account identifiers so we can diagnose failures.
In-app problem reports you submit, including contact details and screenshots.
Anonymous-session progress, if you train without creating an account.
We do not ask for payment-card data. Plans are assigned by us; billing is handled off the Service.
How we use it
To operate accounts, organizations, training, assignments, and administration.
To send transactional mail (confirmations, invitations, password reset, and similar).
To measure training activity for learners and their organizations, with privacy floors on aggregates so small groups are not singled out.
To protect the Service (authentication, multi-factor authentication, bot checks, rate limits, abuse prevention).
To email waitlist subscribers when the Service opens, and only for that purpose.
To diagnose errors and keep the Service available.
We do not sell personal data. We do not use it for advertising.
Where it is hosted
The Service is hosted on Vercel (application) and Supabase (database and authentication) in the United States. Operators we use to run specific functions:
Vercel — hosting and privacy-preserving usage analytics.
Supabase — database, authentication, and file storage.
Resend — transactional email.
Sentry — error monitoring. Reports may include account identifiers we attach.
Grafana Cloud — application logs and performance telemetry. Records may include account identifiers.
Cloudflare Turnstile — bot protection on the waitlist form.
Vercel AI Gateway and model providers, only when Dojo Sensei is enabled — to generate tutor replies. Chat content is processed to operate the tutor, not sold.
GitHub — in-app problem reports (contact details and screenshots you submit).
Those operators process data on our instructions. Some keep logs on their own schedules after an account is deleted; we do not currently scrub those third-party stores on erasure.
Cookies
We use cookies that are needed to run the Service:
Authentication session cookies (required to stay signed in).
A sidebar collapsed/expanded preference, remembered across visits.
Cloudflare Turnstile on the waitlist, which sets cookies as part of its bot check.
Vercel Analytics, which measures visits without advertising identifiers.
There is no cookie banner because we do not use optional marketing cookies.
How long we keep it
Account and profile data: until the account is deleted.
Organization members: when an administrator removes someone, personal details are erased. Completions earned for that organization stay with the organization as its training record, without a name attached.
Someone who has never been in an organization can delete their account from settings. Profile and progress are removed at once.
Deleting an organization removes it and every member account. A record that a deletion happened is kept, with no personal data in it.
Behavioral metrics: retained for 180 days, then detached from the person.
Waitlist addresses: until we have notified you that the Service is open, or you ask us to remove the address.
Authentication infrastructure may keep its own sign-in logs (including email) after an account is deleted. We cannot currently purge that log through a supported interface.
Your choices
You may ask us to access, correct, or delete personal data we hold, or to object to or restrict certain processing, at hello@theredguild.org.
If your account is managed by an organization, that organization controls membership. You cannot leave or delete the account yourself; ask an administrator there. We will point organization-managed requests to the organization when that is the right place for them.
There is no self-service data export yet. Ask us and we will provide what we hold, subject to the organization’s record where it applies.
If we process your data for an organization in the EEA, UK, or a similar regime, you may also have the right to complain to a supervisory authority.
International transfers
TRG QUESTS LLC is a US company. Personal data is processed in the United States. If you access the Service from elsewhere, you understand that transfer.
Security
We use access controls, encryption in transit, and role-based permissions. No method of transmission or storage is completely secure. Report a vulnerability to security@theredguild.org.
Children
The Service is for people 18 or older. We do not knowingly collect personal data from children. If you believe we have, write to us and we will delete it.
Changes
We will update this notice when our practices change. The effective date above is the current version. Material changes will be posted on this page.
Related
Use of the Service is also governed by our Terms of Service.