This site collects nothing.
It is static HTML served from a CDN. There is no analytics, no pixel, no tag manager, no A/B testing, no session replay, no newsletter, and no third-party script of any kind. It sets no cookies. It loads no web fonts, so no font provider learns you were here. Every asset comes from this domain.
The one interactive page, the passive scan, computes everything in your own browser and transmits none of it. Nothing it reads leaves your tab, and nothing is written to storage.
The challenge console on the front page checks flags in your browser too. Nothing you type into it is sent anywhere. When you solve a challenge it remembers which one, as a short list of challenge names in your browser's local storage, so the list can show a tick. That list never leaves your device and holds nothing else: not the answer, not the reward. The forget command erases it.
If you finish the capstone and make a key for the coin with keygen, the key is made in your browser and handed to you as a file to keep. It is not stored by the site and not sent anywhere. A coin claim is text the console prints for you to paste yourself; the console never sends it.
The shop is a separate thing
Buying a shirt happens on a Shopify store on a different hostname. That is a separate system with its own privacy behaviour, and it is the only place any personal data is handled at all.
When you buy something there, Shopify processes the order and the payment, and the print-on-demand fulfiller receives the name, shipping address, and item needed to make and post it. Shopify sets cookies required to operate a cart, complete checkout, and prevent fraud.
No analytics or advertising pixel is installed on the store either.
Customer information is not sold, and is not shared with anyone beyond what is listed above.