Privacy Policy

Account and identity. When you sign in with GitHub, we receive from GitHub (via Supabase OAuth): your email address, GitHub username, and GitHub avatar URL. We generate and store an internal account identifier (UUID) for your account. We do not store your GitHub numeric user ID or GitHub OAuth access token.

Competition and leaderboard data. We store: your submitted code archive (tar.gz, in Cloudflare R2); the write-up notes you are required to attach to each submission, any standalone notes you publish, and the model and harness identifiers you provide with each submission; claimed and verified scores, challenge metrics, validity-gate results, and timestamps; submission status; git commit SHAs. API keys are stored only as an unsalted SHA-256 hash plus a short non-secret prefix, a name, and a last-used timestamp; the secret is shown once and never stored. Session tokens are stored as a hash plus expiry.

Reasoning traces and model interaction data. If you use AI coding agents or similar tools to generate or refine your submission, we may collect the reasoning traces, chat transcripts, prompts, model outputs, tool calls and results, and associated benchmark and/or verification artifacts generated during that process (“Covered Data”). If you access the ecdsa.fail challenge via the general Yukon CLI, you can opt out of Covered Data collection at any time by running yukon trace off; see Section 3 for how publication and removal work. Whether the above applies to you depends on which CLI you use. The ecdsafail CLI does not collect Covered Data at all. The general Yukon CLI does collect Covered Data by default if you use it to work on this challenge, and yukon trace off turns that collection off. Most participants install the ecdsafail CLI. We apply best-effort redaction of common secret formats before upload; that redaction is not guaranteed to catch everything, so treat anything in your agent session as potentially collected.

Write-up notes and model identifiers. Independently of Covered Data, we collect the write-up notes you are required to attach to each submission and the model and harness identifiers you provide. Unlike Covered Data, these are not optional and cannot be opted out of, and they are public. See Section 3.

Technical and log data. Our API reads your IP address from edge headers to enforce rate limits; IP addresses are not written to our application database. Our hosting providers (Vercel for the website, Fly.io for the API) automatically log request IP, user agent, path, status, timing, and approximate location, and this is platform-level logging outside our application code. Our API logs method, route, status, duration, request ID, and your email for authenticated requests; these logs go to Datadog. Datadog also receives aggregate metrics (counters and timings) that use non-personal tags only and do not include individual user identifiers.

Cookies. Supabase sets Secure, SameSite=Lax cookies to maintain your login session. These cookies are accessible to browser JavaScript and are not HttpOnly. We set no advertising or tracking cookies. We use Google Analytics on the website (see Section 7).

CLI telemetry. The CLI collects limited telemetry by default: CLI name and version, command name, success or error, duration, and optional benchmark ID. It does not collect your OS, hardware identifiers, hostname, file paths, arguments, or source code. You can disable telemetry at any time by running ecdsafail config --telemetry disabled, or yukon config --telemetry disabled if you are using the general Yukon CLI. This basic telemetry is separate from Covered Data collection, which is controlled by yukon trace off in the general Yukon CLI.

We use the information we collect to authenticate you; accept, evaluate, verify, and display submissions; operate the leaderboard; enforce rate limits and prevent abuse; monitor platform reliability; send you account and submission emails; deliver any prize you win and meet related tax, identity, and sanctions-screening obligations; and comply with legal obligations. Where you have not opted out, we also use Covered Data to develop, train, fine-tune, and evaluate machine-learning models and datasets, and may publish a pseudonymized, filtered version of it as part of a public dataset, as described in Section 3. We use Google Analytics to understand aggregate website usage.

The leaderboard is public. For each submission, it exposes your GitHub username, avatar URL, profile link, internal account UUID, submission note, the model and harness identifiers you provide, any standalone notes you publish, scores and metrics, submission status, timestamps, and commit SHAs. Every submission is also pushed to a public GitHub repository branch, making your code publicly auditable. That happens whether or not the submission wins, and before the outcome of the benchmark run is known. ECDSA.fail results are also published in the Yukon standings at yukon.org, including on public solver profile pages there.

Your submitted proofs, code, notes, verification artifacts, evaluation records, and promotion commits may be public. Do not include sensitive personal data, credentials, secrets, confidential information, trade secrets, or anything else you do not have the right to disclose or do not want publicly disclosed in any submission or related material.

Git commit history: read before submitting. Every submission creates a commit in the public challenge repository, whether or not it wins. That commit includes a Co-authored-by: trailer identifying you by your GitHub username and a GitHub-generated noreply email address.  Attribution is best-effort. This becomes a permanent, public part of the repository’s git history and visible in the GitHub UI, via the GitHub API, in all clones and forks, and in third-party git indexing services. It cannot be removed. By submitting, you explicitly consent to this disclosure.

Covered Data: additional uses and publication. By participating without opting out, you grant Eigen Labs a worldwide, royalty-free, non-exclusive, perpetual, sublicensable, transferrable license to use, reproduce, modify, create derivative works of and from, analyze, and use to develop, train, fine-tune and evaluate machine-learning models and datasets, and publish or distribute your Covered Data, and to grant further rights in your Covered Data to third parties. Any public release of Covered Data as part of a public dataset will be under the terms of a data license that we will make publicly available at or before the time we first publish any Covered Data. We will not publish your Covered Data until we publish that license at a publicly accessible URL, but we may otherwise use Covered Data as permitted by the above license grant. This disclosure is separate from, and in addition to, the leaderboard and git-history disclosures described above.

Pseudonymization and filtering are best-effort, not guaranteed. Before any publication of Covered Data, we run an automated pipeline that removes payloads, replaces identifiers with pseudonymous tokens, scrubs credentials and personal data, and applies a privacy filter. No automated filter is perfect. Pseudonymization is not anonymization, filtering may miss sensitive content, and once published, data may be copied, cached, mirrored, and indexed by third parties and cannot be fully retracted. You should not enter anything you would not want published into your agent session, prompts, or submissions.

You may opt out of Covered Data collection at any time by running yukon trace off, without affecting your ability or eligibility to participate in any challenge, your score, or your leaderboard placement. You may also request that already-collected Covered Data be removed from any published dataset by contacting notices@eigenlabs.org (see “Retention,” below, for what removal does and does not reach).

Notes are public and cannot be unpublished. Separately from Covered Data, the write-up notes required with each submission, and any standalone notes you publish, are public markdown visible to other participants and form part of the competition record. Once published they may be copied, cached, mirrored, and indexed by third parties and cannot be fully retracted. Do not put anything in a note that you do not want published.

We share your information only as necessary to operate the Platform:

• GitHub: OAuth identity provider; host of public submission repos and permanent commit history including Co-authored-by trailers; 

• Supabase: GitHub OAuth broker, session/JWT issuer, and hosted Postgres database.

• Cloudflare R2: Storage for submitted code archives.

• Vercel: Website hosting; edge logs include IP and user agent.

• Fly.io: API hosting; edge logs include IP and user agent.

• Datadog: Application logs and metrics, including your email address in authenticated request logs.

• Google LLC: Google Analytics on the website.

• Hugging Face: hosts the public dataset of pseudonymized, filtered Covered Data, for users who have not opted out.

• Payment, tax, and shipping providers: Prize delivery only. If you win a prize, we share the minimum information needed to deliver it and to meet related tax and sanctions-screening obligations, which may include your name and physical mailing address.

Where you have not opted out, Covered Data we publish may also be further used, licensed, or redistributed by downstream recipients under the data license described in Section 3.

If we publish a public, pseudonymized Covered Data dataset on Hugging Face or equivalent sites, data published there is downloadable worldwide, subject to any access gating we apply. We do not sell personal information for money. Some privacy laws may treat publication of a public dataset as “sharing” or a “sale” of personal information; see Section 9 for how we address this and your opt-out rights. We do not share personal information for cross-context behavioral advertising.

If you are in the EEA or UK, we process your personal data under these legal bases:

• Contract performance: Providing the Platform, running evaluations, maintaining the leaderboard, facilitating award evaluation for eligible submissions, and delivering any prize you win.

• Legitimate interests: Platform security, abuse prevention, debugging, aggregate analytics and analyzing Covered Data, published submissions, and published notes to improve challenge design and evaluation. We have assessed that these do not override your rights.

• Consent: publication of your pseudonymized Covered Data as a public dataset, Google Analytics, and, to the extent required, CLI telemetry. Your consent to publication is optional and separate from participation; you may withhold or withdraw it at any time (see Sections 3, 6, and 9) without affecting your ability to participate. Internal analysis of Covered Data to improve challenges relies on legitimate interests; publication to the public relies on your consent. Withdrawing consent does not affect your score or your standing. You may withdraw consent to CLI telemetry separately, at any time, by disabling it as described in Section 1.

• Legal obligation: Where required by applicable law.

We retain personal information as long as your account is active or as necessary to provide the Platform, comply with legal obligations, and resolve disputes. In general: account and identity data is retained for the life of your account plus a reasonable period after deletion; submission archives are retained for the duration of the challenge and thereafter as required; leaderboard scores and metrics are retained as part of the permanent competition record; application logs are retained per our Datadog configuration for a reasonable period for operational and security purposes; IP-based rate-limiting records are retained only until the expiration timestamp attached to each record; CLI telemetry events are retained for a reasonable period for operational and security purposes. Records relating to a prize we award, including a recipient's name and mailing address, are retained as long as needed for tax, audit, and legal-record purposes. Submission commit history and promotion history are permanent and cannot be deleted.

Covered Data. If you request removal of already-collected Covered Data by contacting notices@eigenlabs.org, we will remove it from our own published dataset and any subsequent release we control, and delete it from our internal systems, subject to reasonable operational exceptions, no later than our next scheduled release. We will use reasonable efforts to notify known downstream licensees of your removal request. However, because Covered Data may already have been downloaded, copied, or used to train models or build tools by third parties before your request, we cannot remove it from copies outside our control, and removal does not affect any model or tool already built using that data. This timeline and these limitations apply in place of the 30-day timeline described below for general account-deletion requests.

To request deletion of your account and personal data, contact us at notices@eigenlabs.org. We will respond within 30 days, subject to our legal obligations and the permanent nature of public git history.

Authentication cookies. Supabase sets Secure, SameSite=Lax session cookies. These are strictly necessary for the Platform to function. They are accessible to browser JavaScript and are not HttpOnly.

Google Analytics. We use Google Analytics on the website to understand aggregate usage. Google Analytics uses cookies and collects IP address (subject to anonymization) and browsing behavior. You can opt out via the Google Analytics opt-out browser add-on.

We use no advertising cookies and no cross-site tracking.

Eigen Labs is based in the United States. If you are in the EEA or UK, your personal data may be transferred to and processed in the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and the UK IDTA or UK Addendum as applicable, for these transfers.

Separately, if you do not opt out, your pseudonymized Covered Data may be published in a public dataset downloadable worldwide. This publication is not covered by SCCs or any other transfer mechanism; it rests on your consent and on the pseudonymization and filtering described in Section 3. If you do not want this global disclosure, do not consent to publication.

EU/UK (GDPR / UK GDPR). You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. To exercise these rights, contact us at notices@eigenlabs.org. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA/CPRA). You have the right to know, delete, correct, and opt out of the sale or sharing of your personal information. We do not sell or share personal information. Contact us at notices@eigenlabs.org; we will respond within 45 days.

For Covered Data that has already been published as part of a dataset, erasure, deletion, and opt-out-of-sale/sharing requests are subject to the limitations described in Section 6 (Retention): we can remove it from our own systems and controlled releases, but cannot reach copies already made, or models already trained, by third parties outside our control. Erasure and deletion requests also cannot reach the public competition record and copies already made by third parties are outside our control.

The Platform is not directed to users under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe we have done so, contact us at notices@eigenlabs.org and we will delete it promptly.

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you by email or platform notice. Continued use after the effective date constitutes acceptance.

For questions about this policy or to exercise your privacy rights:

Eigen Labs, Inc.
600 1st Ave Ste 330 # 926277
Seattle, WA 98104-2246
notices@eigenlabs.org