Welcome!

private-piranha.pics is built as a practical privacy range: explore a deliberately imperfect shop, identify GDPR-related issues, and compare your findings afterwards.

The private-piranha.pics shop is a training environment for common privacy problems in web applications. It focuses on the General Data Protection Regulation (GDPR) while considering best practices. The training environment targets developers and service operators, but is also useful for anyone looking to deepen their understanding of the GDPR and its real-world impact on web applications.

The shop implements a set of privacy-related issues (referred to as privacy problems). Your goal is to find them using your knowledge of the GDPR while exploring the training environment.

Please take everything with a grain of salt. This project does not provide legal advice. Implemented problems may be outdated, and new ones may be missing.

Guide

What are the requirements?

Having basic knowledge about the GDPR and its most essential articles is strongly recommended. You should also have some experience in web development and be familiar with the developer tools of your preferred browser.

Finding and understanding all problems can be challenging — you need to be attentive and persistent.

How to start?

Open the training environment at private-piranha.pics.

Open the training environment: private-piranha.pics

The problems vary in difficulty and fall into three groups:

Visible

Issues you can see while using the shop.

Missing

Issues caused by absent information or controls.

Hidden

Issues only visible in source code or dev tools.

Besides the privacy problems, there are false flags — pay attention to whether something is a privacy problem, a security problem, or no problem at all.

There is no guidance inside the shop itself. You must independently identify and understand each issue. A privacy problem can be as subtle as a single faulty sentence or line of code.

Ensure that ad blockers, content blockers, and anti-tracking extensions are disabled. Safari is not recommended. Do not use real payment, address, or account information — data may be publicly viewable due to intentional privacy or security problems.

More about the project

How is private-piranha.pics built?

The shop uses a modern web tech stack. The frontend and backend are built with Nuxt 4, using server-side rendering. Data is stored in a PostgreSQL database, accessed via Drizzle ORM. The training environment resets daily to a clean state.

This project page is a separate Nuxt application served from project.private-piranha.pics. It hosts the project overview and background information about the privacy range.

Both applications use Tailwind CSS and daisyUI for styling. Icons are from Tabler Icons and Flaticon. The piranha pictures were generated using Craiyon.

Why was private-piranha.pics developed?

There are many training environments in the security space — cyber ranges, Capture The Flag (CTF) games, and serious games are common approaches. The most popular example is probably the OWASP Juice Shop. The GDPR, in force since 2018, is a major milestone for data protection — yet the privacy area lacks comparable training tools for developers. private-piranha.pics tries to fill that gap, bridging the developer-unfriendly wording of the GDPR and its real-world implications for web applications.

I have a question or an idea. How can I contact you?

You can reach us via mail@private-piranha.pics.