Privacy Policy

1. About this policy

This policy covers the Hack League platform and the events, products, and services offered through or in connection with Hack League. Hack League is a START Global programme, so the general START Global privacy policy linked above also applies. This page explains how we use data specifically for Hack League.

START Global, Unterstrasse 6, 9000 St. Gallen, Switzerland, is the controller responsible for that data. You can reach us at info@startglobal.org or find our full details in the imprint. START chapters run their local events on our behalf and under our instructions.

We follow the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR). An event or another START Global service may also have its own privacy notice. Section 5 is the specific notice for Hack League leaderboards.

2. What we collect

We collect the information you give us and the data created when you use Hack League:

• Account and sign-in details: your email address and the basic identity details returned by Google, GitHub or Apple if you use one of them to sign in. Apple's Hide My Email gives us a relay address instead of your own, which we store and use the same way. You can also use an emailed sign-in code or a passkey. We do not use passwords.
• Profile details: your display name, handle, home chapter, and any avatar, LinkedIn profile, or GitHub profile you add.
• Event details: your registration, application answers and uploads (such as a CV), RSVP and check-in status, skills, preferred role, experience, languages, and whether you are looking for a team.
• Teams and submissions: your event teams, join requests and invites, case choices, and the content and files your team submits.
• Results and season records: the case partners' winner picks, your community vote if you cast one, results, placements, points, rankings, and event wins.
• Messages and preferences: in-app messages and broadcasts, your notification choices, and your browser's push endpoint, keys, and user-agent string if you enable push.
• Consent records: what you agreed to or withdrew, which version of the event terms applied, and when you made or withdrew that choice.
• Technical and audit data: IP addresses, request details, error reports, and a record of administrative actions, including who acted, when, and for which chapter. Audit records cannot be changed or deleted.
• Usage analytics: the pages you visit, the buttons and links you use, the steps you complete (such as applying, joining a team, or submitting), your browser, device, and approximate location derived from your IP address. Only if you accept analytics cookies do we also keep a random identifier in your browser, link it to your account when you sign in, and record masked sessions. Section 3 explains both cases.

3. Why we use it

• To provide Hack League: this includes accounts, applications, teams, cases, submissions, winner selection, community votes, and results. We need this to fulfil our contract with you or take steps you ask for before entering one (Art. 6(1)(b) GDPR).
• To keep the platform safe and reliable: this includes preventing abuse, keeping audit records, and sending essential updates about deadlines, decisions, locks, and results. We rely on our legitimate interests (Art. 6(1)(f) GDPR). These are service messages, not marketing, and you cannot opt out of them.
• To run the leaderboards: we publish names and rankings because they are part of the competition. We rely on our contract with you and our legitimate interest in running a fair, comparable league (Art. 6(1)(b) and (f) GDPR). Section 5 explains this in more detail.
• When you choose to share more: we ask for consent before listing you in an event directory, sharing your profile with a case partner, or sending optional email or push notifications (Art. 6(1)(a) GDPR). We ask separately for each purpose. Any future event invitations or START Global newsletter would also need their own separate consents.
• To understand how the platform is used: we count page views, referring sites, countries, device types, and page load times in aggregate, so we can see which pages people use and fix slow ones. These statistics set no cookies and do not identify you. If you decline analytics cookies, PostHog still counts your visit using a value calculated on its servers from your IP address and browser that changes every day, and stores nothing in your browser. We rely on our legitimate interest in running and improving the platform (Art. 6(1)(f) GDPR).
• If you accept analytics cookies: PostHog stores a random identifier in your browser so we can see how people move through Hack League over time: which steps of an event they complete, where they drop off, and which features they use. When you are signed in we link that identifier to your account ID (never your name or email address). We also record sessions so we can see where the platform confuses people; all text and everything typed into forms is masked in those recordings before it leaves your browser. We rely on your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time in section 6.
• To meet our legal obligations where required (Art. 6(1)(c) GDPR).

Consent is optional and separate from accepting the terms or this policy. We ask for each consent again for every event. You can change directory and notification choices in your account settings. To withdraw another consent, email us. Withdrawal only affects what we do from that point onward.

4. Who can see what

The event participant directory is opt-in. If you turn it on, other participants in that event can see your event profile; you can turn it off again at any time. Your teammates can see their team's submission, case partners can see the submissions made to their case, and organisers can see participants, submissions, and community votes for their event. Other participants see the case winners during a community vote, but not who voted for what. We share your profile or CV with a case partner only if you consent. You can withdraw that consent by emailing us.

5. Leaderboards

If you earn points at a league event, you currently appear on the leaderboard. There is no separate opt-out. If you do not want to be listed, contact us before the event so we can explain your options.

• Individual leaderboard: your display name, avatar (if set), home chapter, points, rank, number of scoring events, and event wins. We never show your email address, application answers, or submissions there.
• Audience: anyone signed in to Hack League, across every chapter. Avatar files use public links, so someone with the link can load the image without signing in. We will tell you before making a leaderboard public without sign-in.
• Retention: leaderboards remain available during their season and afterwards in the archive of past seasons. If you object to being named, contact us. We keep the underlying points to preserve the season results and will explain what removing your name means for your entry.

Supabase stores the leaderboard data and avatars. Cloudflare delivers the platform and currently caches leaderboard results for 20 seconds. Sections 7 and 8 explain these providers and international transfers.

6. Cookies

We use the cookies needed to sign you in, keep your session active, and remember your active chapter. We do not use advertising cookies or tracking pixels on this platform. Our aggregate usage statistics (Cloudflare Web Analytics, section 7) work without cookies or any other storage in your browser, and do not follow you across sites.

The one optional exception is analytics cookies from PostHog. We ask the first time you visit, and we capture nothing until you answer. If you accept, PostHog stores an identifier in a cookie and in your browser's local storage on hackleague.org and its subdomains. If you decline, it stores nothing; we keep only a cookie that records your answer, so we do not ask again. You can change your answer here at any time:

The aftermovie on our home page loads nothing from YouTube until you press play: the still image you see beforehand is served by us. If you press play, YouTube sets its own storage in your browser. Section 7 explains what YouTube receives.

7. Who we share data with

We do not sell your data. START Global runs the platform and gives people access only to what they need for their role. Chapter teams can access data for their own chapter and events, but not other chapters. Case partners see only the submissions made to their own case. The Hack League board and league team can access the data needed to approve events and manage seasons, points, and rankings, but do not have full account or contact data by default. Platform administrators have wider access where needed for support, security, administration, or compliance.

Event and case partners receive only the information needed for their part of an event and only where we have a legal basis, such as your consent. Chapters and partners do not receive your full account or data from other events unless the law requires it, the platform cannot operate without it, or we have clearly told you otherwise.

We also use these service providers, which process data for us under contract:

• Supabase for the database, authentication, and file storage. Your platform data is stored in Zurich, Switzerland.
• Cloudflare for hosting and edge caching, and for Cloudflare Web Analytics, which gives us aggregate usage statistics. It receives your IP address and browser details with each page view, uses them only to count visits, and does not store the IP address or build a profile of you.
• Resend for service and notification emails.
• Sentry (EU region) for error monitoring and diagnostics.
• PostHog (EU region, Frankfurt) for the usage analytics in section 3 and, if you accept analytics cookies, session recordings. Your browser sends this data to our own domain, which passes it on without your sign-in cookies. PostHog uses your IP address to work out your country and city and then discards it.
• Google, GitHub and Apple if you choose one of them to sign in. Apple's Hide My Email relays our mail to your real address without giving us that address.
• YouTube (Google) if you press play on the aftermovie. It then receives your IP address, your browser and device details, and the address of the page you played it from. We embed it in no-cookie mode, which switches off ad personalisation, and it loads only on that press.
• Browser push services such as Google, Mozilla, Apple, or Microsoft if you enable push notifications.

8. International transfers

Some providers process data outside Switzerland and the EEA. We cover those transfers with an adequacy decision or safeguards such as the EU Standard Contractual Clauses. Contact us if you would like details of those safeguards.

9. How long we keep data

• Account and profile: while your account is active, and for seven days after you close it.
• Applications and registrations: for the life of the event. Answers that only serve the event itself (phone, date of birth, emergency contact, accessibility and dietary needs, and travel reimbursement details) are deleted three months after the event closes. We keep rejected applications for six months after the decision unless you agreed to a longer period.
• Teams, cases, and submissions: for the event and its season.
• Winner picks and community votes: for the event and its season, with the results they decided.
• Points and rankings: for the season and its archive. Point records cannot be edited or deleted; corrections are recorded as new reversing entries.
• Consent records: long enough to show when consent was given or withdrawn, including any applicable limitation period.
• Notifications and preferences: we keep notification records while we need them to provide the service. We keep your preference records while your account is active so we can remember your choices. We remove push subscription details when you turn browser push off, revoke the subscription, or the subscription stops working.
• Audit records: as needed to protect the integrity of the platform. They cannot be changed or deleted.
• Technical and diagnostic data: for a short period under the retention settings of the providers in section 7.
• Usage analytics: session recordings for 30 days, and other analytics events for up to one year.

We delete or anonymise personal data when we no longer need it, unless the law requires us to keep it. You can close your account yourself, from the danger zone at the bottom of your profile page. Sign-in stops working immediately, and seven days later we anonymise your account and profile data: your name, headline, photo, email address, and social links are removed. We also delete your application answers (including contact, emergency contact, date of birth, accessibility, dietary, and travel details), the files you uploaded with them such as a CV, any names and email addresses an organiser imported for you from a registration list, your event profiles, notification preferences, push subscriptions, and notification history. The seven-day wait is there so a request made by mistake, or by somebody else with access to your account, can still be undone: email support@hackleague.org within that period and we will reverse it.

Competition records that cannot be removed stay in place without your name attached: points, rankings, and audit entries, along with consent records, the status of your registrations and applications, your team memberships and results, and the submissions and shared work that belong to your teams rather than to you alone. You cannot close your account while you are on a team in an event whose results are not yet confirmed, because doing so would strand your team; the profile page names the event and when it ends.

10. Your rights

Depending on the FADP and GDPR rules that apply, you can ask for access to your data or ask us to correct, delete, or restrict it. You may also object to processing, ask for a portable copy, or withdraw consent. Email info@startglobal.org to make a request.

You may also complain to a data protection authority: the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or the authority in your country of residence in the EU.

11. Security

Database security rules limit access to the people and roles described above. Accounts are personal and must not be shared. We encrypt connections to the platform and store uploaded files in encrypted storage. Chapters and partners must report any data protection or security incident to START Global without delay.

12. Changes

We may update this policy. The date at the top shows the latest revision, and we will highlight material changes on the platform.

13. Contact

Questions about this policy or your data can be sent to info@startglobal.org.