DedSec Project

Privacy Policy

Learn about our privacy practices and how we protect your data.

This Privacy Policy explains, at a high level, how DedSec Project ("we," "our," or "us") handles data in connection with the website and related services. It should be read together with the updated Legal Disclaimer & Statement on this page.

1. Privacy Approach

DedSec Project aims to collect the minimum amount of personal data reasonably necessary to operate the website, maintain security, and respond to lawful requests or user communications.

2. Data We May Process

In normal website operation, limited technical and operational data may be processed, such as IP address, device/browser details, security logs, and similar server-side records generated through hosting, delivery, or abuse-prevention systems.

If you voluntarily contact us through third-party channels listed on the website (for example social platforms, messaging apps, payment providers, or community platforms), the information you share is handled under the policies and settings of those third parties in addition to any internal handling needed to respond.

3. How Data May Be Used

  • to operate, secure, and maintain the website and related services,.
  • to detect, prevent, or investigate abuse, fraud, misuse, or technical issues,.
  • to respond to messages, support requests, legal/privacy inquiries, or content-removal requests,.
  • to comply with applicable legal obligations and enforce project terms, and.
  • to understand service reliability and improve operational stability.

4. Legal Bases And Applicable Frameworks

Where applicable, processing is governed by GDPR (Regulation (EU) 2016/679), ePrivacy rules, Greek data protection law including Law 4624/2019, and relevant consumer/privacy frameworks in the United States where applicable.

5. Third-Party Services And Links

The website may contain links or integrations involving third parties such as GitHub, social networks, referral or affiliate links, and other external services. Those third parties have their own terms and privacy policies, and DedSec Project is not responsible for their independent practices.

6. Consent, cookies and local preferences — Test preview

This Test preview saves your selected theme, language and explicit Accept/Decline choice locally in the browser using dedsec:theme, dedsec:language and dedsec:cookie-choice. These are localStorage values, not HTTP cookies. They remain until changed or cleared in your browser.

Saved Lessons, bookmarks and reading history are not retained; obsolete Test bookmark data is cleared. On Home, the GitHub Stars and Forks cards always show a locally bundled numeric snapshot from 16 October 2026. If you Accept optional content, the site may request https://api.github.com/repos/dedsec1121fk/DedSec to refresh those two counts; if you Decline, no such optional refresh is sent and the snapshot stays visible. Request information is subject to GitHub's privacy practices. Reading and searching remain functional either way.

The illustrated Cookie Preferences tile on Home allows you to change the choice. The popup has separately labeled Accept and Decline buttons with icons. Hosting providers and external links you open may process independent technical requests. The Test consent code does not activate Google Analytics or Google Tag Manager and does not describe the production website's independent privacy setup.

7. Data Retention

Technical records and communications are retained only for as long as reasonably necessary for security, operational, legal, moderation, or record-keeping purposes, after which they may be deleted, anonymized, or minimized where appropriate.

8. Security

Reasonable steps may be taken to protect technical and communication data, but no website, transmission method, or storage environment can be guaranteed to be completely secure or uninterrupted.

9. Your Rights

Depending on your jurisdiction, you may have rights relating to access, correction, deletion, restriction, objection, portability, or withdrawal of consent where consent applies. To make a privacy-related request, use the contact methods listed on the Contact & Credits page.

10. International Transfers

Because third-party platforms, hosting providers, and infrastructure may operate internationally, limited technical data may be processed outside your country of residence, subject to the safeguards or legal mechanisms required by applicable law.

11. Children's Privacy

The website and tools are not directed at children under 13. If we become aware that personal data of a child under 13 has been collected in a way covered by COPPA or other applicable law, reasonable steps will be taken to delete it.

12. Changes To This Policy

This Privacy Policy may be updated from time to time. Changes take effect when the revised version is posted on this page with an updated "Last Updated" date.

13. Contact

For privacy questions, legal/privacy issues, or content-removal requests, use the contact methods listed on the Contact & Credits page.

Legal Disclaimer & Statement

Last Updated: October 21, 2026

By accessing, downloading, using the DedSec Project website, the GitHub repository, scripts, tools or any related content, you expressly acknowledge that you have read, understood and agree to be bound by this entire Legal Disclaimer & Statement. If you do not agree, you must immediately cease all use and delete any downloaded materials.

1. Purpose / Educational Use

The DedSec Project is a free, community-driven Termux cybersecurity toolkit that provides scripts, utilities, learning resources and related content. Any functionality related to cybersecurity, OSINT, network testing, scraping or similar tools is provided strictly for:

  • education,.
  • lawful security research,.
  • defensive testing, and.
  • use only on systems/accounts that you own or where you have explicit, prior, written permission.

The optional phishing and social-engineering simulation modules are included solely for educational awareness training in fully controlled environments with explicit informed consent from all involved parties. Any other use is strictly prohibited.

2. Prohibition Of Unlawful Use / Authorization Required

IT IS STRICTLY PROHIBITED to use the DedSec Project for any illegal or unauthorized purpose. You must NOT use the tools, guides or content of the DedSec Project for:

  • access, testing, disruption or monitoring of systems without authorization,.
  • phishing or credential collection against real targets,.
  • unauthorized scanning, exploitation, DDoS/DoS, brute-force, malware or any illegal activity.

You are solely responsible for ensuring that your use complies with all applicable laws. Misuse may lead to serious civil and criminal penalties, including prosecution under the CFAA, Greek cybercrime legislation or equivalent laws.

3. No Professional / Legal Advice

The content is provided solely for informational purposes and does not constitute legal, financial, medical or any other professional advice. No attorney-client relationship is created. For legal advice, consult a qualified lawyer.

4. User Responsibility, Risk And Safety

Software and scripts can cause data loss, service interruption, account restrictions or other damage if used incorrectly or maliciously. You assume all risk arising from the use of:

  • the website,.
  • the scripts/tools referenced or provided,.
  • third-party services, websites or APIs.

Always test in a controlled and fully authorized environment.

You further acknowledge that certain tools may be detected by antivirus software, security systems or service providers, potentially leading to account restrictions or legal scrutiny.

5. Limitation Of Liability (To The Maximum Extent Permitted By Law)

To the maximum extent permitted by applicable law (including the laws of Greece, the European Union and the United States), the DedSec Project, its owner, contributors and collaborators shall not be liable for any direct or indirect, incidental, consequential, special or exemplary damages, including loss of data, profits, reputation or business interruption, arising from access to or use of the website or the tools.

Some jurisdictions do not allow certain limitations; where prohibited, they do not apply.

6. Indemnification

You agree to indemnify and hold harmless the DedSec Project, its owner, contributors and collaborators from any claims, damages, liabilities, losses and expenses (including reasonable attorney fees) arising from:

  • use or misuse of the website/tools,.
  • violation of any law/regulation or third-party rights,.
  • breach of this statement.

7. Intellectual Property / Open Source

Unless otherwise stated, the text, graphics and branding are protected by applicable intellectual property laws. The code and scripts are governed by the proprietary license included in the GitHub repository (LICENSE.txt), which grants only limited rights for personal, non-commercial use. Modification, redistribution, reverse engineering or commercial use without the owner's explicit written permission is strictly prohibited. Third-party trademarks belong to their respective owners and are used for identification purposes only.

8. Third-Party Links / Services And Affiliate Links

The website may contain links to third parties (e.g. GitHub, social networks, affiliate/referral links). Third parties have their own terms and policies and the DedSec Project is not responsible for their content or practices. If an affiliate/referral relationship exists, a commission may be earned at no extra cost to you.

9. Privacy And Data Protection (High-Level)

The DedSec Project aims to collect the minimum amount of personal data. However, standard hosting/security operations may process limited technical data (e.g. IP address, device/browser details, logs) for security and operational purposes.

Where applicable, processing is governed by:

  • GDPR (Regulation (EU) 2016/679) and related rules,.
  • ePrivacy rules (Directive 2002/58/EC as transposed),.
  • Greek data protection legislation (in particular Law 4624/2019 and related rules),.
  • and the applicable consumer protection/privacy frameworks in the USA (where relevant).

For details, see the website's Privacy Policy.

10. Legal Compliance - Applicable Laws

You must ensure that your actions remain within the boundaries of all applicable laws, including (but not limited to):

  • European Union / Europe: Regulation (EU) 2016/679 (GDPR), ePrivacy Directive 2002/58/EC, NIS2 Directive, Cyber Resilience Act and national implementing laws;
  • United States of America: Computer Fraud and Abuse Act (CFAA), Digital Millennium Copyright Act (DMCA) and applicable federal and state laws;
  • Greece: Law 4624/2019 on personal data protection, provisions of the Greek Penal Code on cybercrime, Law 2225/1994 (as amended) and all other relevant Greek cybersecurity and data protection legislation.

11. Cookies

If cookies or similar technologies are used (including via third-party embeds), disclosure and consent are provided as required by GDPR/ePrivacy and Greek law. See the Privacy Policy / cookie notice (if displayed).

12. Children's Privacy

The website and tools are not directed at children under 13. If the operator becomes aware that personal data of a child under 13 has been collected in a manner covered by COPPA (USA) or other applicable law, reasonable steps will be taken to delete it.

13. Security Research Boundaries (USA, EU, Greece - Where Applicable)

You must ensure that your actions remain within lawful boundaries, including (indicatively and where applicable):

  • USA: CFAA, DMCA, FTC Act and state legislation,.
  • EU: national criminal legislation and cybersecurity/data protection rules,.
  • Greece: relevant provisions of criminal law and applicable legislation on cybercrime and data.

This document does not list every law. You must comply with all laws that apply to you and to the targets/systems you are testing.

14. Disclaimer Of Warranties

The website, tools, scripts and all content are provided "AS IS" and "AS AVAILABLE" without any warranty of any kind, express, implied, statutory or otherwise, including (but not limited to) warranties of merchantability, fitness for a particular purpose, title or non-infringement. We do not warrant that the tools will be error-free, secure, uninterrupted or suitable for any particular purpose.

15. Governing Law And Jurisdiction

This Legal Disclaimer & Statement is governed exclusively by the laws of the Hellenic Republic, without regard to conflict-of-laws principles. Any dispute arising out of or relating to this statement or the use of the Project shall be resolved exclusively by the competent courts of Athens, Attica. You irrevocably submit to the jurisdiction of those courts.

16. Severability

If any clause, or part of a clause, of this Disclaimer is found by any court or administrative body of competent jurisdiction to be illegal, invalid or unenforceable, the legality, validity or enforceability of the remainder of the clause or paragraph which contains the relevant provision shall not be affected, unless otherwise stipulated under applicable law. If the remainder of the provision is not affected, the parties shall use all reasonable endeavours to agree within a reasonable time upon any lawful and reasonable variations to the Disclaimer which may be necessary in order to achieve, to the greatest extent possible, the same effect as would have been achieved by the clause, or the part of the clause, in question.

17. Entire Agreement & Changes

This statement constitutes the entire agreement between you and the DedSec Project regarding its subject matter and supersedes all prior understandings. It may be modified at any time; continued use after changes constitutes acceptance of the new version.

18. Contact

For legal/privacy issues or content-removal requests, use the contact details listed on the Contact page.

Changing email: A signed-in account holder who already verified the existing mailbox may request an email-address change after confirming the current password. Approval links are sent first to the old address and then to the new address; the change occurs only after both are expressly confirmed. Unused links expire after one hour, are stored as token hashes, and account sessions are revoked after completion. The old and new mailbox addresses are processed by the configured transactional email provider solely for these security confirmations. Your private notes and account identity stay linked to the same user ID. Browser copies and exported backups require independent removal if desired.

Account terms, privacy and storage

Accounts are optional and registration is available to people aged 18–130, inclusive. The general website stays public. An account provides private TXT notes, folders, pins, TXT/ZIP exports and eligible referral rewards. The secure service runs on Cloudflare; the account window connects to that separate origin only when opened. Minimizing keeps its draft in the same window; closing the browser can lose unsaved changes.

Cloudflare D1 stores first and last name, email, date of birth, age at registration, a protected password verifier, folder names, notes, pins, sessions, terms acceptance and referral status. Your original password is processed in your browser and is never stored. Account data is excluded from public GitHub, public search, sitemap and LLM exports. D1 notes are not end-to-end encrypted against the service operator.

Essential secure HttpOnly cookies support sign-in. Embedded windows use a separate partitioned cookie; ordinary portal tabs use SameSite=Lax. Turnstile helps reject automated abuse. The application retains keyed network hashes rather than raw IPs, grouping IPv6 by /64. Sign-in and signup-network records have a 30-day rolling retention; rate-limit and verification records expire sooner as applicable. Cloudflare may separately process technical security logs under its policies.

Cloud notes are the default. Only an explicit browser-storage choice saves TXT contents, paths, pins and storage preference in IndexedDB, associated with a hash of an opaque account identifier and website profile. That hash is an identifier, not encryption; local notes are not separately encrypted. Signing out hides the workspace but retains the local copy. Clearing cache/site data, browser eviction, profile deletion or private browsing can permanently lose it. Local storage does not provide offline authentication. Export TXT/ZIP backups regularly.

Local mode pauses note uploads while the previous cloud copy remains in D1. Switching back checks combined quotas, merges identical files, renames conflicting local copies and saves one complete cloud revision. Failed transfers keep the browser copy. A browser copy can remain after transfer; clear site data to remove it. Deleting an account removes its D1 application records and attempts to remove the current browser workspace. Separately remove copies in other browsers and exported files; provider recovery backups can retain deleted data temporarily.

The Test service allows 300 accounts and 444 unique signed-in users per day, resetting at midnight Europe/Athens. Each workspace allows 900,000 bytes of UTF-8 TXT contents and names, 200 files, 50 folders and eight path levels; total cloud-note storage is limited to 400,000,000 bytes. Browser notes use the same personal workspace limits. Free-plan limits may interrupt access; this Test service has no uptime guarantee.

Verification sends your email address to the configured mail provider only when you request it. The prepared provider is Brevo; an existing legacy installation may use Resend. Website verification remains disabled until its mail credentials are configured. No newsletter is sent. The application caps verification at 100 emails per UTC day and 3,000 per calendar month. Referral rewards require your verified email and three friends with distinct verified email identities and separate networks. Each friend must wait 24 hours and sign in on two different days. Pending referrals expire after 30 days. Email aliases and shared networks may not qualify. Fake referrals are prohibited; an IP address cannot prove a unique person.

Keep your password and recovery code private. Save the recovery code shown once after registration or recovery. Recovery and password changes revoke previous sessions. Profile controls let you export notes, sign out, change your password or permanently delete your account. Contact the project through Contact & Credits for data-access, correction or privacy requests. These account terms are accepted through the registration checkbox.

Date of birth determines age automatically. Verify your email before changing password or email, including recovery resets. After account deletion we request a confirmation email; failed delivery does not undo deletion. Optional referral codes are validated; pending invitations qualify only under the published reward rules.