TryHackMe
- The documents do not say whether your data trains AI.
- The documents do not say whether your data is used for ads.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
They collect account, payment, device and learning data, can ban you without notice, and you them.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account, job, payment, IP, device details, and how you use rooms, badges and progress.
Read the exact line
Privacy policy
“Identity Data such as your first name, last name, username, password and any social media profiles you choose to link to your TryHackMe account.”
Training
They use it to run the site, bill you, personalize learning, send emails, and watch for cheating.
Read the exact line
Privacy policy
“We also use your Usage Data (such as rooms you complete, how you interact during the completion of rooms, and your progress) to provide you with a personalised service”
Sharing
Host, payment and analytics companies see data; username, rank and rooms can be public.
Read the exact line
Privacy policy
“Certain limited user information is publicly available on our platform, such on our leaderboards and public aspects of your user profile (e.g. username, rank, badges, streak and completed rooms).”
Kept
They keep it as long as they think they need it; data may be kept forever.
Read the exact line
Privacy policy
“We only retain collected information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.”
Controls
You can email support to access, fix or delete data; marketing emails need a specific opt-out request.
Read the exact line
Privacy policy
“If you would like to exercise any of these rights, please contact us at our email: support@tryhackme.com.”
Fine print
They can ban you and delete your content with no warning; you them; English courts apply.
Read the exact line
Terms of service
“We may terminate your use or participation on the Website or delete any content or information that you provided at any time, without warning, in our sole discretion.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask to erase or access your data
Email support@tryhackme.com
Opt out of usage and interest emails
Email support@tryhackme.com (they say opt-out is upon specific request)
Complain to the UK ICO if needed
https://ico.org.uk/make-a-complaint or telephone 0303123113
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can shut your account and wipe what you posted whenever they want, with no heads-up.
Read the exact line
Terms of service
“We may terminate your use or participation on the Website or delete any content or information that you provided at any time, without warning, in our sole discretion.”
For example, you could lose progress, badges and paid access overnight with no email first.
If someone sues them because of how you used the site, you may have to pay their legal bills.
Read the exact line
Terms of service
“You agree to and hold us harmless, including our subsidiaries, affiliates, and all of our respective officers, agents, partners, and employees, from and against any loss, damage, , claim, or demand, including reasonable attorneys’ fees”
For example, a dispute over something you posted could leave you covering their lawyer fees.
Ideas or feedback you send them belong to them completely, and they can use them without paying you.
Read the exact line
Terms of service
“You acknowledge and agree that any questions, comments, suggestions, ideas, feedback or other information regarding the Website ("Submissions") provided by you to us are non-confidential and shall become our sole property.”
For example, a room idea you email them could be used in a paid product with no credit to you.
They can change the rules and you are treated as agreeing if you keep using the site.
Read the exact line
Terms of service
“You waive any right to receive specific notice of each such change. It is your responsibility to periodically review these Terms of Service to stay informed of updates.”
For example, new limits on refunds could apply the next time you log in even if they never emailed you.
They start sending you marketing-style usage emails unless you specifically ask them to stop.
Read the exact line
Privacy policy
“By default, users opt-in to receiving emails from TryHackMe about your usage, stats, and other parts of the site that you haven't used but may be interested in.”
For example, you might get emails pushing rooms you have not tried until you write to support.
Parts of your profile and progress are visible to other people on the site.
Read the exact line
Privacy policy
“Certain limited user information is publicly available on our platform, such on our leaderboards and public aspects of your user profile (e.g. username, rank, badges, streak and completed rooms).”
For example, someone could see your username, streak and which rooms you finished on a leaderboard.
They log your IP, browser, device and similar technical details when you use the site.
Read the exact line
Privacy policy
“Technical Data such as your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform”
For example, they can see your IP and what browser you used when you complete a room.
After they strip your name off, they may keep and use that data forever.
Read the exact line
Privacy policy
“In some circumstances we will and/or aggregate your data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely.”
For example, your room-completion times could stay in their stats even after you delete your account.
They say they store data on secure servers and limit who inside the company can see it.
Read the exact line
Privacy policy
“TryHackMe will take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal information, including storing all the personal information you provide on secure servers.”
For example, they claim payment and account details sit on locked-down servers, not open files.
leftover disputes go to courts in England and Wales.
Read the exact line
Terms of service
“Should such negotiations fail to achieve a resolution within thirty (30) business days, the dispute shall be submitted by TryHackMe for resolution by the courts of England and Wales”
For example, but you would sue in UK courts, not your local small-claims court.
Words to know
Legal words from the lines above, in plain English.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- opt in
- Something is off until you actively say yes to it. For example, marketing emails that only start after you tick a box are opt in.
- de-identified
- Data with your name and obvious identifiers removed, though it can sometimes still be traced back to you. For example, your chats with names stripped out may still be kept and studied after you delete your account.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- venue
- The specific court or city where any lawsuit must be filed, which may be far from where you live. For example, a user in Florida may have to travel to a court in San Francisco to sue.
How we got here · grade F · score 34/100 · 15 of 15 policy answers backed by a verified quote · 6 not stated
What does the app collect beyond what it needs to work?
They collect account, job, payment and contact details plus IP, device data and how you use rooms and features.
Does it record your voice, face or body, and what happens to that?
Not stated in the documents.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
Not stated in the documents.
Do they sell or share your data, and can you opt out?
They say they do not share except with service providers, advisers, authorities, in a sale of the business, and public profile bits.
What rights do they take over what you type and what the AI makes?
Feedback and similar submissions become their sole property for any lawful use, with no pay or credit to you.
How long do they keep your data after you delete it, and can you delete it in the app?
They keep data as long as they think they need it; you ask for erasure by emailing support, not in-app.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They use your room progress and behaviour to personalize paths and feedback, but they do not describe memory controls.
Do they commit to basic security, and have they leaked data?
They describe secure servers, limited staff access and confidentiality duties, but no independent audit.
Is there a real age gate, and are teens protected?
Not stated in the documents.
Will they tell you when the rules change, and is the policy specific?
Terms can change without specific notice; keeping using the site counts as agreeing. The privacy policy has no date.
Can they close your account without warning, and can you get your data out first?
They can deny access and delete your content at any time, for any reason or none, without warning.
If something goes wrong, who pays?
The site is as-is with broad damage limits, and you must indemnify them for claims arising from your use.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 2,451 words at a professional or legal expert level (Flesch reading ease 0); the terms are 3,283 words at a professional or legal expert level.
