privacy policy

who we are

Hackathons Australia (hackathonsaustralia.com.au) is an independent directory of hackathons in Australia. For anything in this policy — including a request to see or delete your data — email hello@hackathonsaustralia.com.au. That address is read by the person who runs the site.

cookies

This site sets a few cookies of its own, and there is no banner. On this site, ad measurement with Meta is on unless you switch it off at cookie settings, which shows your answer and changes it with one click. Your answer there is stored as hx_consent (granted or denied, six months, readable only by our server, never sent to anyone else).

Unless you have switched it off, our server sets three more cookies. hx_id is a random visitor number that contains nothing about you (HttpOnly, six months, readable only by our server); Meta never receives it as it is — only its SHA-256 hash, as external_id. _fbp is a browser id set by this site, not by Meta: fb.1. followed by the time it was created and a random number (90 days, not HttpOnly); an _fbp left from an earlier visit is reused. When you arrive from a Meta ad, _fbc holds the ad's click id and the time you arrived (90 days, not HttpOnly). Switching it off in cookie settings deletes hx_id, _fbp and _fbc. See Meta below.

Two further values are stored in your own browser, and neither is ever sent to us:

nl_shown

Session storage. Records that the newsletter popup has already appeared, so it does not reappear while you keep the tab open. Cleared when you close the tab.

nl_subscribed

Local storage. Records that you already subscribed, so the popup stops appearing for good. Stays until you clear site data.

Both hold the literal value 1. They contain no identifier and are readable only by your browser, on this site. (A third key exists on the admin console, holding the operator's own access key for the length of one tab session — it is not set on any page a visitor sees.)

analytics

There is no Google Analytics, no tag manager and no session-recording tool on this site. No code from Meta runs in your browser either: ad measurement with Meta is done from our server, described under Meta, and it is on unless you switch it off. The small amount of JavaScript that runs (the search box, the subscribe forms, the submit wizard) is written inline and talks only to this site's own API; the only script from another company is PayPal's, on the submit page.

how we count what's popular

We do measure which listings get looked at, so we know which events are worth featuring and whether the directory is useful. This happens on our server, not in your browser: there is no tracking script, no beacon and no cookie involved in that count.

Each listing keeps four running counters, per day: times shown in a list, times clicked from a list, times its page was opened, and times its registration link was followed. What gets stored is:

Stored

Which event, which calendar date (UTC), which of the four counters, and a count.

Not stored

Your IP address. Your browser's user-agent string. The page you came from. Any session or visitor ID. The time of day. Any free-text field.

To avoid counting the same person twice in one day, the server takes your IP address and browser user-agent, combines them, and stores a shortened one-way SHA-256 hash of the result. It also uses them, in memory, to discard traffic from bots and crawlers. The IP address and user-agent themselves are never written to disk — only the hash is kept, and the whole hash ledger is deleted after 90 days.

We would rather be precise than flattering here, so: that hash is pseudonymous, not anonymous. It cannot be read back to reveal an IP address, but it is derived from your IP and browser alone — not mixed with the date or a secret — so the same visitor produces the same value on every day it is recorded, until it ages out. We tell you it exists, what it is for, and when it disappears. The daily counters that remain afterwards are plain totals with nothing personal in them, and we keep those.

Why we do it: to understand which listings are useful, using the least identifying method we could implement. You can object at any time using the address above.

the newsletter

If you subscribe, here is the entire record we create:

Your email address

Lowercased and trimmed.

A timestamp

When you subscribed.

That is genuinely all of it — the database table has three columns and the third is an ID number. We do not record your IP address, your browser, or which page you subscribed from, and all three signup forms on the site behave identically in this respect. Your address is stored in this site's own database, on our own server.

The email itself is sent through Maileroo, an email delivery provider, which therefore holds a copy of every subscriber address in order to deliver the weekly campaign. Those campaigns are sent with open and click tracking switched on, which is Maileroo's standard mechanism: a small invisible image records that a message was opened, and links in the email are rewritten to pass through Maileroo before continuing to their destination. That tells us how many people opened an issue and which listings they clicked. It applies to the email only — nothing of the sort runs on this website.

Your address is not sold, not rented, and not used to build a profile. It is not shared with any company other than Maileroo, and it is never given to event organisers.

Basis: consent, given by entering your address. You can withdraw it at any time. We keep addresses until you ask us to remove yours.

submitting an event

The submit form collects the event's details — name, URL, description, organisation, city, venue, address, state, postcode, dates, ticket price, prize and an image link — plus a contact email address, which is the only part that is necessarily personal data. If you buy a featured listing, we also record the PayPal order ID that comes back.

Event details are published on this site, which is the point of submitting them. Your contact email is not displayed on your event's page; it exists so we can reach you about the listing, and it is not sold or used for marketing.

Payment for a featured listing is handled entirely on PayPal's side. We never see or store card details — only the order ID PayPal hands back.

Basis: the steps necessary to list an event at your request. Submissions are kept as the record of what was published and why.

other companies that see something

We keep this list as short as we can, but it is not empty, and pretending otherwise would be the easiest thing in this policy to get wrong:

Google Fonts

Every page loads two typefaces from Google's font servers, so Google receives your IP address, your user-agent and the address of the page you are viewing — on every page view, before you interact with anything. This is the most significant third-party data flow on the site. Self-hosting the fonts would remove it entirely.

Meta (Facebook)

We advertise this directory on Facebook and Instagram and use Meta's tools to see whether those ads bring visitors. No code from Meta runs in your browser: our server reports to Meta's Conversions API directly, and on this site it does so unless you opt out at cookie settings. It reports a page view, an event page opened, a registration link followed, a newsletter signup, an event you submit through the submit form (ListingSubmitted — the listing type, never your contact email) and a featured-listing payment (Purchase — the price and the PayPal order id). Each report carries your IP address, your browser's user-agent string, the click id (_fbc) and browser id (_fbp) if they exist, and the SHA-256 hash of hx_id as external_id; a newsletter signup also carries your email address as a SHA-256 hash so Meta can match the signup to an ad — we never send the address itself, and nothing else you type — and signups, submissions and payments carry a hash of this site's country code. To stop it: opt out at cookie settings, one click: that deletes hx_id, _fbp and _fbc and stops every report from the next page. What Meta already holds is governed by Meta's own tools. Meta processes this under its own privacy policy, partly outside your country.

Event image hosts

Most listing images are copied to and served from this site. A few are not: while a featured banner is running, its thumbnail loads from Luma's image CDN on every page, and a small number of individual cards load their banner from the platform that hosts it — currently Luma, Facebook's and LinkedIn's CDNs, cdn.hackclub.com and getpinch.com.au. Those hosts see your IP address and user-agent when such an image loads.

PayPal

The /submit page loads PayPal's payment script, so PayPal receives the IP address and user-agent of everyone who opens that page, whether or not they pay, and sets its own cookies under paypal.com. No other page loads it.

Bunny.net

Hosts the endpoint that receives event submissions, as described above.

Maileroo

Delivers the newsletter, and therefore holds subscriber email addresses and the open/click records described above. Nothing about a website visitor reaches it.

Each of these companies processes data under its own privacy policy, and we cannot tell you where in the world they do it. Beyond these, no third party receives anything about you.

links out to organisers

Registration links go through a /go/ address on this site. That step adds one to the "registration link followed" counter described above and then immediately forwards you to the organiser's page on Humanitix, Eventbrite, Luma or Devpost. It stores nothing else, and it does not add tracking parameters — the destination is exactly the URL the organiser published.

Once you land on an organiser's site — or any other site we link to — you are covered by their privacy policy, not ours.

logs

The application itself keeps no visitor log files: no access log, no request log, no record of which pages you viewed. The web server in front of it does not write an access log either, but it does record occasional warnings and errors to the system journal, and those entries include the IP address and browser string of the request that triggered them. The journal is capped by size and rotates, holding roughly the last few weeks.

who can see the data we hold

Subscriber addresses, submissions and featured-listing requests are visible only through a key-protected admin console on this site, used by the person who runs it. The one other sign-in is an organiser account, described in the next section: it can reach its own organisation's listings and their view counts, and nothing else on the site.

organiser accounts

Organiser accounts are optional. You only have one if you made it yourself at /organiser/register, to list a hackathon or to claim one we already list. Browsing this site never creates an account and never needs one.

If you do have one, this is everything it holds:

The account

Your email address, the name you chose to give (optional) and the language you signed up in. The password itself is never stored — only an argon2id hash of it, which cannot be turned back into the password.

Sign-in sessions

One record per device you are signed in on: your browser's user-agent string, a truncated hash of your IP address rather than the address itself, and when the session was created and last used. A session expires 30 days after it was last used, and you can end any of them yourself.

Your organisation

Its name, website, description, contact address and logo link, plus who else is a member and at what role. An invitation you send holds the invited address until it is accepted, revoked or expires.

What you create

The listings you publish through the portal, and any claim you file on a listing we scraped — including the evidence you wrote and the decision made on it.

The numbers an organiser sees. The per-listing counts described above are broken down, for that listing's organiser, by city and by where the visit came from. The city is worked out from the visitor's IP address against a database file held on our own server (DB-IP City Lite, CC BY 4.0), so no lookup leaves this machine and the address itself is never written down: what is stored is the city name, one of five coarse traffic labels (search, social, this site, other, direct) and the same truncated 90-day hash of IP address and browser string the counters already use. None of it identifies a visitor, and none of it is shown to anyone but that listing's organiser.

The weekly summary email is off until you switch it on. An organiser can ask for a short weekly email of their own listing numbers from the portal dashboard, and switch it off again in the same place.

Who can see it. Your organisation's details and its listings are visible to the other members of that organisation. A claim you file is read by the person who runs this site, in order to approve or reject it. None of it is published — the contact address on a listing is never shown on the site — and none of it is sold, shared or handed to an advertiser.

A copy of it, or the door. /organiser/account downloads everything above as a JSON file, and deletes the account — with its sign-in sessions and any organisation you were the only member of — from one form. Deletion is refused while you are the last owner of an organisation that still has listings: hand ownership over, or remove those listings, first, so nothing goes dark by accident.

your rights

You can ask us to give you a copy of your data, correct it, or delete it. In practice, for this site that means:

• Your newsletter subscription — we can confirm whether an address is on the list, and delete it.
• An event submission — we can send you what was submitted, correct it, or remove it, along with the listing.
• The 90-day counting hash — it is not searchable by name or email, so we cannot single it out to show you; it deletes itself within 90 days, and you can object to the counting entirely.

Email hello@hackathonsaustralia.com.au. There is no charge and no particular form of words is required. If you think your data has been handled badly, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au — though we would rather you gave us the chance to put it right first.

children

This is a listings site for public events and is not directed at children. We do not knowingly collect data from anyone under 13. Some listed hackathons are school or student events with their own age rules — those are set by the organiser, not by us.

changes

This policy describes the site as it works on the date shown at the top. If what the site does changes — a different mail provider, self-hosted fonts, a different submission endpoint — this page is updated to match and the date changes with it. We make no claim to hold any privacy certification or third-party audit; this is a plain description of the system, and you are welcome to ask about any part of it.