TofuGauntlet: Terms of Service & Privacy Policy

Effective Date: 15 February 2026

Welcome to TofuGauntlet. By registering an account at tofugauntlet.com, you agree to the following terms and data practices. This document is governed by the laws of England and Wales and complies with the UK GDPR and the Data Protection Act 2018.

1. Terms of Service

1.1 The Platform

TofuGauntlet is a gamified learning environment for Infrastructure as Code (IaC). It utilizes OpenTofu, the AWS Provider, Trivy, and Tflint to validate mission submissions.

Beta Notice: TofuGauntlet is currently provided as a Beta service. We do not guarantee 100% uptime or that validation logic will be error-free.

1.2 Infrastructure Disclaimer

While missions utilize the OpenTofu AWS provider for architecture validation, TofuGauntlet is an independent platform and is not hosted on, or affiliated with, Amazon Web Services (AWS).

1.3 User Conduct & Platform Integrity

To maintain a secure and performant learning environment, you agree to the following:

No Infrastructure Abuse: You shall not attempt to use the platform's OpenTofu engine to provision actual billable resources or perform unauthorized API calls.
Security Integrity: You must not attempt to bypass or "poison" the Tflint or Trivy scanning engines. Obfuscating code to hide vulnerabilities is strictly prohibited.
XP Integrity: Experience points (XP) and badges are for personal tracking only. Automated "farming" of XP via scripts or bots is prohibited.
Responsible Disclosure: If you discover a vulnerability in our validation logic, you agree to report it to us privately rather than exploiting it.

1.4 Age Restriction

Users must be at least 16 years of age to register an account. By signing up, you represent that you meet this requirement.

1.5 Account Termination

You may delete your account at any time via your profile settings. TofuGauntlet reserves the right to suspend or terminate accounts that violate these terms without prior notice.

2. Privacy Policy

2.1 Data Minimisation

We collect only the essential data required to provide the service:

Account Identity: Your email address (used for authentication and account recovery).
Platform Progress: Your mission completion status, XP, and earned badges.

2.2 Data Sharing & Third Parties

Current Policy: We do not share, sell, or trade your personal data with any third parties, recruiters, or advertisers.
Future Changes: Should we introduce features allowing companies to contact candidates (e.g., a "Blind Bridge"), we will notify you via email and update this policy. You will have the choice to accept the new terms or delete your account.

2.3 Data Processing Tools

Your mission code is processed locally by our servers using:

Tflint: For static analysis and linting.
Trivy: For vulnerability and misconfiguration scanning.
OpenTofu Engine: To validate the logic of your infrastructure blocks.

2.4 Your Rights (UK GDPR)

Under the UK Data Protection Act, you have the following rights:

Right to Access: Request a copy of the data we hold on you.
Right to Rectification: Request corrections to your data.
Right to Erasure: Delete your account and all associated progress data.

2.5 External Links

TofuGauntlet may contain links to third-party sites (e.g., official OpenTofu or AWS documentation). We are not responsible for the privacy practices or content of these external sites.

3. Limitation of Liability

TofuGauntlet is provided "as is" for educational purposes only. We are not liable for any costs, security breaches, or infrastructure failures that occur if you apply mission logic or code snippets to your own production or personal AWS environments.

4. Contact

For any questions regarding these terms or your data, please contact: admin@tofugauntlet.com