Privacy

This notice covers the CypherMonkey Labs website only. Each lab you open is its own site and has its own practices.

Plain version

No ads, no affiliate links, and no tracking cookies set by this site.
No analytics script is loaded.
Settings stay in this browser under the key cm.settings. They are not sent to a server.
The site does not publish an email address. Mission Control is a form, and the private mailbox is a Cloudflare secret when that Worker is turned on.

What stays on your device

The site scripts do not set cookies. Theme, motion, language, and sound preferences can be stored in localStorage under cm.settings. That is how the pages avoid a theme flash and remember a choice. Clearing site data for cyphermonkeylabs.com removes it. URL overrides such as ?theme=starlight&motion=reduce apply to that view only and are not written to storage.

Contact

The contact form asks for your name, your email, a topic, an optional lab, and a message, plus consent. Your email exists so a person can reply. It is not printed on the page and it is not put in a public GitHub issue.

Send posts the form to the Worker at contact.cyphermonkeylabs.com. The Worker checks a Turnstile token, a honeypot, a short timing trap, and a rate limit, then emails a destination that lives only in a Cloudflare secret. The Worker does not store the message and does not send the destination address back to the browser. Nothing in this repository is the studio inbox.

If JavaScript is off, or you open the page with ?contact=fallback, the public path is a GitHub issue. That issue does not include your email. On that path only, a message that itself contains an email address is refused, because a public issue would show it.

Spam check

The contact form loads Cloudflare Turnstile. Cloudflare may set its own anti-abuse signals in your browser. That is Cloudflare’s processing, not a cookie this site uses for ads or analytics. Their privacy notice is Cloudflare’s privacy policy.

Analytics

None by default. If a cookieless measurement tool is added later, this page will say so before it ships.

Hosting

The site is static files on GitHub Pages, with HTTPS on the custom domain. GitHub Pages cannot set custom response headers, so the content security policy is a meta tag. frame-ancestors does not work in a meta tag. That is a known limit, not a hidden setting. The policy also leaves out upgrade-insecure-requests because Pages already redirects to HTTPS, and that directive blocks the scripts during a local HTTP preview.

How we verify

Primary sources come first: official documentation, RFCs, and standards bodies.
Numbers that are not in a cited source do not get published as facts.
Illustrative timeline or sample data stays labeled EXAMPLE, or it is removed.
A live lab should show at least one source and a last-verified date. The checker treats a live lab unverified for more than 365 days as an error, and more than 180 days as a warning.
Vendor names are text. Logos are not used.

Changelog

No public corrections are logged here yet. When a correction is accepted, it will be listed with the date. The target is to fix a confirmed mistake within 14 days.

These trust pages aim for WCAG 2.2 AA: visible focus, 48 pixel targets, text that can reflow, a skip link, and motion that stops when the system asks for reduced motion or when cm.settings says so. High contrast is a theme, and forced colors keep borders.

Known limits: the contact form needs JavaScript to run Turnstile and send the private note. Without JavaScript, the page shows a direct link to open a public issue. The full screen-reader pass on VoiceOver, TalkBack, and NVDA is still a manual check. To report a barrier, use Contact and choose Accessibility issue.

Licenses

MIT License

Copyright (c) 2026 CypherMonkey Labs

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

Content (the words on these pages, diagrams, and timeline copy) is under CC BY-NC-SA 4.0. That includes disclaimer text even when a script prints it. You can share and adapt it for non-commercial use if you credit CypherMonkey Labs, link the license, and share adaptations under the same terms.

Brand (the name CypherMonkey Labs, the logo, and the mascot) is excluded from that content license. All rights reserved. The copyright line uses the project name until a person confirms a different legal name. That brand exclusion is the working position and can be confirmed or changed by the maintainer.

Trademarks

Amazon Web Services, Amazon Connect, Microsoft, Cisco, Webex, Five9, Genesys, Genesys Cloud, NICE, NICE CXone, Google, and Gemini belong to their owners. They are used here only to say what a lab teaches. CypherMonkey Labs is not affiliated with, sponsored by, or endorsed by those companies. The fuller list is also in the Ground Rules panel.