1. The service

PromptInjects provides prompt-injection capture-the-flag challenges you can play, and tools to host live events. We may change, add, or remove features over time.

2. Operator

PromptInjects is operated by ALYNX — Inhaber: Dat Tran, Albrechtstr. 18, 45130 Essen, Germany. Contact: [email protected]. Our full legal notice is on the imprint page.

3. Accounts

You can play open challenges without an account. Some features (saved progress, ELO, hosting, payments) require one. You're responsible for activity under your account and for keeping your login secure. Provide accurate information and keep it current.

4. Acceptable use

The challenges are a sandbox: the "secrets" are fake flags planted for the game. You agree not to:

  • Attack, probe, or attempt to exploit our infrastructure, other users, or any system outside the intended challenge sandbox.
  • Use the service to develop or deploy real-world attacks against systems you don't own or have permission to test.
  • Submit unlawful, harmful, or infringing content, or content containing real secrets or others' personal data.
  • Disrupt the service, evade rate limits, scrape at scale, or resell access without permission.

Prompt-injection techniques you practice here are for learning and authorized testing only. What you do elsewhere is your responsibility.

5. Hosted events

If you host an event, you're responsible for your participants' conduct and for any content or branding you add. The "Powered by PromptInjects" badge remains on leaderboards across all tiers. We may suspend events that violate these terms.

6. Payments

Paid plans and one-off events are billed through Stripe at the prices shown at checkout. Unless stated otherwise, event purchases are one-time and non-recurring; subscriptions renew until cancelled. Except where required by law, fees are non-refundable. We may change pricing prospectively. Prices are shown inclusive of applicable VAT where required; under the small-business regulation (§ 19 UStG), no VAT is separately charged or shown.

7. Right of withdrawal for consumers

If you are a consumer (Verbraucher) under German law, you generally have a statutory right of withdrawal for distance contracts. However, for digital content delivered online (such as access to challenges and hosted events), this right expires once we have begun performance with your express consent and acknowledgment that you thereby waive your right of withdrawal. By starting a challenge, activating a hosted event, or otherwise accessing the digital content, you expressly agree to immediate performance and waive your right of withdrawal to the extent permitted by § 356 Abs. 4 BGB.

8. Intellectual property

We own the platform, challenge designs, and content, except content you supply. You keep rights to content you submit, and grant us a license to host and display it as needed to run the service. You may not copy or redistribute our challenges without permission.

9. Third-party services

We rely on providers including Kinde, Cloudflare, Stripe, and OpenRouter / model providers. Your use may be subject to their terms, and we're not responsible for their services.

10. Disclaimers

The service is provided "as is," without warranties of any kind. We don't guarantee it will be uninterrupted, error-free, or that model outputs will be accurate. Educational content is not professional security advice. The statutory consumer rights under German law (§§ 312g, 474 BGB) remain unaffected where applicable.

11. Limitation of liability

We are liable for damages in accordance with the statutory provisions. Without prejudice to mandatory statutory liability (e.g. under the Produkthaftungsgesetz, for intent, gross negligence, injury to life, body or health, or under the guarantee), our liability for slight negligence is limited as follows: we are only liable for slight negligence in the event of a breach of essential contractual duties (Kardinalpflichten), and such liability is limited to the typical, foreseeable damage. Our total liability for each claim is limited to the amount you paid us in the 12 months before the claim arose. The foregoing limitations do not apply to consumers' statutory rights.

12. Termination

You may stop using the service anytime. We may suspend or terminate access for violations of these terms or to protect the service and its users.

13. Governing law and jurisdiction

These terms are governed by the laws of the Federal Republic of Germany, excluding the UN Convention on Contracts for the International Sale of Goods (CISG). If you are a consumer with habitual residence in Germany, the place of jurisdiction is Essen, Germany. If you are a merchant (Kaufmann), a legal entity under public law, or a special fund under public law, the place of jurisdiction is Essen, Germany.

14. Consumer dispute resolution

The European Commission provides a platform for online dispute resolution (ODR), available at ec.europa.eu/consumers/odr. We are not obliged or willing to participate in a dispute resolution proceeding before a consumer arbitration board (Verbraucherschlichtungsstelle).

15. Changes

We may update these terms; we'll revise the "last updated" date and, for material changes, provide notice. Continued use means you accept the updated terms.

16. Contact

Questions about these terms: [email protected].
Postal address: ALYNX — Inhaber: Dat Tran, Albrechtstr. 18, 45130 Essen, Germany.