privacy policy

who we are

Hackathons Australia (hackathonsaustralia.com.au) is an independent directory of hackathons in Australia. For anything in this policy — including a request to see or delete your data — email jasperfyfe4@gmail.com. That address is read by the person who runs the site.

cookies

This site sets no cookies. Not for analytics, not for advertising, not for preferences. That is why you have never seen a cookie banner here — there is nothing to ask you to consent to.

Two small values are stored in your own browser, and neither is ever sent to us:

nl_shown

Session storage. Records that the newsletter popup has already appeared, so it does not reappear while you keep the tab open. Cleared when you close the tab.

nl_subscribed

Local storage. Records that you already subscribed, so the popup stops appearing for good. Stays until you clear site data.

Both hold the literal value 1. They contain no identifier and are readable only by your browser, on this site. (A third key exists on the admin console, holding the operator's own access key for the length of one tab session — it is not set on any page a visitor sees.)

analytics

There is no Google Analytics, no tag manager, no advertising pixel and no session-recording tool on this site. No third-party analytics service of any kind is loaded — the public pages carry no external script at all. The small amount of JavaScript that does run (the search box, the subscribe forms, the submit wizard) is written inline and talks only to this site's own API.

how we count what's popular

We do measure which listings get looked at, so we know which events are worth featuring and whether the directory is useful. This happens on our server, not in your browser: there is no tracking script, no beacon and no cookie involved.

Each listing keeps four running counters, per day: times shown in a list, times clicked from a list, times its page was opened, and times its registration link was followed. What gets stored is:

Stored

Which event, which calendar date (UTC), which of the four counters, and a count.

Not stored

Your IP address. Your browser's user-agent string. The page you came from. Any session or visitor ID. The time of day. Any free-text field.

To avoid counting the same person twice in one day, the server takes your IP address and browser user-agent, combines them, and stores a shortened one-way SHA-256 hash of the result. It also uses them, in memory, to discard traffic from bots and crawlers. The IP address and user-agent themselves are never written to disk — only the hash is kept, and the whole hash ledger is deleted after 90 days.

We would rather be precise than flattering here, so: that hash is pseudonymous, not anonymous. It cannot be read back to reveal an IP address, but it is derived from your IP and browser alone — not mixed with the date or a secret — so the same visitor produces the same value on every day it is recorded, until it ages out. We tell you it exists, what it is for, and when it disappears. The daily counters that remain afterwards are plain totals with nothing personal in them, and we keep those.

Why we do it: to understand which listings are useful, using the least identifying method we could implement. You can object at any time using the address above.

the newsletter

If you subscribe, here is the entire record we create:

Your email address

Lowercased and trimmed.

A timestamp

When you subscribed.

That is genuinely all of it — the database table has three columns and the third is an ID number. We do not record your IP address, your browser, or which page you subscribed from, and all three signup forms on the site behave identically in this respect. Your address is stored in this site's own database, on our own server.

The email itself is sent through Maileroo, an email delivery provider, which therefore holds a copy of every subscriber address in order to deliver the weekly campaign. Those campaigns are sent with open and click tracking switched on, which is Maileroo's standard mechanism: a small invisible image records that a message was opened, and links in the email are rewritten to pass through Maileroo before continuing to their destination. That tells us how many people opened an issue and which listings they clicked. It applies to the email only — nothing of the sort runs on this website.

Your address is not sold, not rented, and not used to build a profile. It is not shared with any company other than Maileroo, and it is never given to event organisers.

Basis: consent, given by entering your address. You can withdraw it at any time. We keep addresses until you ask us to remove yours.

submitting an event

The submit form collects the event's details — name, URL, description, organisation, city, venue, address, state, postcode, dates, ticket price, prize and an image link — plus a contact email address, which is the only part that is necessarily personal data. If you buy a featured listing, we also record the PayPal order ID that comes back.

Event details are published on this site, which is the point of submitting them. Your contact email is not displayed on your event's page; it exists so we can reach you about the listing, and it is not sold or used for marketing.

Payment for a featured listing is handled entirely on PayPal's side. We never see or store card details — only the order ID PayPal hands back.

Basis: the steps necessary to list an event at your request. Submissions are kept as the record of what was published and why.

other companies that see something

We keep this list as short as we can, but it is not empty, and pretending otherwise would be the easiest thing in this policy to get wrong:

Google Fonts

Every page loads two typefaces from Google's font servers, so Google receives your IP address, your user-agent and the address of the page you are viewing — on every page view, before you interact with anything. This is the most significant third-party data flow on the site. Self-hosting the fonts would remove it entirely.

Event image hosts

Most listing images are copied to and served from this site. A few are not: while a featured banner is running, its thumbnail loads from Luma's image CDN on every page, and a small number of individual cards load their banner from the platform that hosts it — currently Luma, Facebook's and LinkedIn's CDNs, cdn.hackclub.com andgetpinch.com.au. Those hosts see your IP address and user-agent when such an image loads.

PayPal

The /submit page loads PayPal's payment script, so PayPal receives the IP address and user-agent of everyone who opens that page, whether or not they pay, and sets its own cookies under paypal.com. No other page loads it.

Bunny.net

Hosts the endpoint that receives event submissions, as described above.

Maileroo

Delivers the newsletter, and therefore holds subscriber email addresses and the open/click records described above. Nothing about a website visitor reaches it.

Each of these companies processes data under its own privacy policy, and we cannot tell you where in the world they do it. Beyond these, no third party receives anything about you.

links out to organisers

Registration links go through a /go/ address on this site. That step adds one to the "registration link followed" counter described above and then immediately forwards you to the organiser's page on Humanitix, Eventbrite, Luma or Devpost. It stores nothing else, and it does not add tracking parameters — the destination is exactly the URL the organiser published.

Once you land on an organiser's site — or any other site we link to — you are covered by their privacy policy, not ours.

logs

The application itself keeps no visitor log files: no access log, no request log, no record of which pages you viewed. The web server in front of it does not write an access log either, but it does record occasional warnings and errors to the system journal, and those entries include the IP address and browser string of the request that triggered them. The journal is capped by size and rotates, holding roughly the last few weeks.

who can see the data we hold

Subscriber addresses, submissions and featured-listing requests are visible only through a key-protected admin console on this site, used by the person who runs it. The site has no user accounts and no other logins.

your rights

You can ask us to give you a copy of your data, correct it, or delete it. In practice, for this site that means:

• Your newsletter subscription — we can confirm whether an address is on the list, and delete it.
• An event submission — we can send you what was submitted, correct it, or remove it, along with the listing.
• The 90-day counting hash — it is not searchable by name or email, so we cannot single it out to show you; it deletes itself within 90 days, and you can object to the counting entirely.

Email jasperfyfe4@gmail.com. There is no charge and no particular form of words is required. If you think your data has been handled badly, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au — though we would rather you gave us the chance to put it right first.

children

This is a listings site for public events and is not directed at children. We do not knowingly collect data from anyone under 13. Some listed hackathons are school or student events with their own age rules — those are set by the organiser, not by us.

changes

This policy describes the site as it works on the date shown at the top. If what the site does changes — a different mail provider, self-hosted fonts, a different submission endpoint — this page is updated to match and the date changes with it. We make no claim to hold any privacy certification or third-party audit; this is a plain description of the system, and you are welcome to ask about any part of it.