Privacy Policy — Hackathon España

The short version. This site sets no cookies and uses no third-party analytics. You can browse every listing without giving us anything. The only personal data we hold is what you type in yourself — an email address if you subscribe to the newsletter, or your event details if you submit a hackathon.

who we are, and how to reach us

Hackathon España (hackathonespana.com) is an independent directory of hackathons in Spain, and is the data controller for everything described below. It is one of five national editions of the same directory; each edition runs on its own server with its own database, and no personal data moves between them.

We have no published email address yet. The domain carries no MX record, so any address printed here would bounce. A contact address is being set up. Until it exists, every request in this policy — including a request to see, correct or delete your data — goes through the submit form, which reaches the same review queue a human reads. Put the request in the description field and an address in the contact-email field so we can reply. When the inbox is live it will be published here, and this page will be dated accordingly.

cookies

This site sets no cookies. Not for analytics, not for advertising, not for preferences. That is why you have never seen a cookie banner here — there is nothing to ask you to consent to.

Browsing the site stores two small values in your own browser instead, and neither is ever sent to us:

nl_shown: Session storage. Records that the newsletter popup has already appeared, so it does not reappear while you keep the tab open. Cleared when you close the tab.
nl_subscribed: Local storage. Records that you already subscribed, so the popup stops appearing for good. Cleared whenever you clear site data.

Both hold the literal value 1. They contain no identifier and are readable only by your browser on this site.

For completeness: there is a third value, admin_api_key, which the staff-only/admin console keeps in session storage so a reviewer does not retype their key on every action. It is a credential of ours, not information about you, it is only ever created by someone who has typed that key in, and it is not set by any public page of the site.

analytics

There is no Google Analytics, no tag manager, no advertising pixel and no session-recording tool on this site. No third-party analytics service of any kind is loaded. The site also ships no JavaScript bundles — the handful of small scripts it does run (the search box, the subscribe forms, the submit wizard) are written inline and talk only to this site's own API.

how we count what's popular

We do measure which listings get looked at, so we know which events are worth featuring and whether the directory is useful. This happens on our server, not in your browser: there is no tracking script, no beacon and no cookie involved.

Each listing keeps four running counters, per day: times shown in a list, times clicked from a list, times its page was opened, and times its registration link was followed. What gets stored is:

Stored: Which event, which calendar date (UTC), which of the four counters, and a count.
Not stored: Your IP address. Your browser's user-agent string. The page you came from. Any session or visitor ID. The time of day. Any free-text field.

To avoid counting the same person twice in one day, the server takes your IP address and browser user-agent, combines them, and stores a shortened one-way SHA-256 hash of the result. It also uses them, in memory, to discard traffic from bots and crawlers. The IP address and user-agent themselves are never written to disk — only the hash is kept.

We want to be precise rather than flattering here: that hash is pseudonymous, not anonymous. It cannot be read back to reveal an IP address, but the same visitor produces the same hash on the same day. That is enough for us to treat it as personal information and tell you it exists, what it is for, and when it disappears. Anything older than 90 days is deleted — to be exact about the mechanism, that cleanup runs when the service restarts rather than on a timer, so a hash can outlive 90 days by however long the service has been up. The daily counters that remain afterwards are plain totals with nothing personal in them, and we keep those indefinitely.

Lawful basis: legitimate interests — knowing which listings are actually useful, using the least identifying method we could implement, with no cookie and no third party involved. You can object and ask us to stop counting you at any time, through the route above.

the newsletter

If you subscribe, here is the entire record we create:

Your email address: Lowercased and trimmed.
A timestamp: When you subscribed.

That is genuinely all of it — the database table has three columns and the third is an ID number. We do not record your IP address, your browser, or which page you subscribed from, and the three signup forms on the site all behave identically in this respect.

Your address is stored in this site's own database on our own server. It is not sent to a mailing-list provider, not shared, not sold, and not used to build a profile. If we later start sending through an email provider, that provider will be named here before any address reaches it.

Lawful basis: consent, given by entering your address. Withdraw it at any time through the submit form — we will delete the record, not merely flag it. We keep addresses until you unsubscribe.

submitting an event

The submit form collects the event's details — name, URL, description, organisation, city, venue, address, postal code, dates, ticket price, prize and an image link — plus a contact email address, which is the only part that is necessarily personal data. If you buy a featured listing, we also record the PayPal order ID.

Event details are published on this site, which is the point of submitting them. Your contact email is not published — it is used to reach you about the listing.

Please note: when you press submit, your browser sends the form directly to a Bunny.net edge endpoint that receives our submissions. That means Bunny.net, our infrastructure provider, receives your IP address along with the submission, including your contact email. This happens only when you actually submit the form.

Lawful basis: legitimate interests, and the steps necessary to list an event at your request. Submissions are kept as our record of what was published and why.

other companies that see something

We deliberately keep this list as short as we can, but it is not empty, and pretending otherwise would be the easiest thing in this policy to get wrong:

Google Fonts: Every page loads two typefaces from Google's font servers, so Google receives your IP address, your user-agent and the address of the page you are viewing — on every page view, before you interact with anything. This is the most significant third-party data flow on the site. We intend to self-host the fonts, which removes it entirely.
PayPal: The /submit page loads PayPal's payment script, so PayPal receives the IP address and user-agent of everyone who opens that page, whether or not they pay, and sets its own cookies under paypal.com. No other page loads it. Payment is handled entirely on PayPal's side — we never see or store card details, only an order ID.
Bunny.net: Hosts the endpoint that receives event submissions, as described above. It is not involved in ordinary browsing.

Each of these companies processes data under its own privacy policy and on its own global infrastructure. All three are US-headquartered, so where they receive your IP address that is an international transfer outside the EEA, made under whatever safeguards each of them operates — we are not in a position to audit those, and we are not going to claim we have. The honest summary is that avoiding the transfer means self-hosting the fonts (planned) and not opening /submit. Beyond these three, no third party receives anything about you.

Two more companies sit near the site without receiving anything about your browsing: the server provider that hosts it, and our DNS provider, which answers the lookup that turnshackathonespana.com into an address before your browser ever contacts us. The site is not behind a proxy or CDN on the page-serving path, so no such intermediary sees your page views.

links out to organisers

Registration links go through a /go/ address on this site. That step adds one to the "registration link followed" counter described above and then immediately forwards you to the organiser's page on Luma or Eventbrite. It stores nothing else. The links are marked so that the organiser's site is not told which page you came from.

Once you land on an organiser's site — or any other site we link to — you are covered by their privacy policy, not ours. Event images shown here are currently copied and served from our own domain rather than loaded from the organiser, so simply viewing a listing does not reveal you to them.

logs

The application itself keeps no visitor log files: no access log, no request log, no record of which pages you viewed. As with any website, the web server and network provider in front of it may hold short-lived operational logs for security and reliability.

how long we keep things

Newsletter address: Until you ask to be removed. There is no expiry — we would rather hold an address you still want on the list than quietly drop it.
Event submission: Kept after it is processed, as the record of what was published and why, including a rejected one. Deleted on request; nothing purges it automatically.
Counting hash: 90 days — see the note above about the cleanup running at restart rather than on a timer.
Daily counters: Indefinitely. They are plain totals per event per day with nothing personal in them.

your rights

Under the EU General Data Protection Regulation (GDPR) and Spain’sLey Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales(LOPDGDD), you have the right to:

Access — get a copy of what we hold about you, and be told what we do with it.
Rectification — have anything inaccurate corrected.
Erasure — have it deleted. For the newsletter this is unconditional: we delete the row rather than flag it.
Restriction — have us hold data without using it while a dispute about it is resolved.
Portability — receive what you gave us in a machine-readable form. In practice that is your email address and, if you submitted an event, the submission JSON.
Objection — object to processing based on our legitimate interests, which here means the view and click counting.

You may also withdraw consent for the newsletter at any time, which does not affect anything done before you withdrew it. We do not carry out automated decision-making or profiling. We do not sell personal information to anyone, and we have never disclosed any of it for money or for anyone else’s advertising.

What each of those means concretely, given how little there is:

Your newsletter subscription — we can confirm whether an address is on the list, export it, and delete it.
An event submission — we can send you what was submitted, correct it, or remove it.
The 90-day counting hash — it is not searchable by name or email, so we cannot single yours out to show you or delete only yours; it expires on the schedule described above, and you can object to the counting entirely.

Ask through the submit form — that is the working route while there is no published address. There is no charge, we do not require a particular form of words, we will not treat you differently for asking, and we aim to answer well inside the one month the GDPR allows. We honour these rights for everyone who asks, wherever they live.

If you think we have handled your data badly, tell us first — we would rather put it right than have you take it elsewhere. But you also have the right to complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD,aepd.es), and you can do that without coming to us at all.

children

This is a listings site for public events and is not directed at children. We do not knowingly collect data from anyone under 13. Some listed hackathons are student events with their own age rules — those are set by the organiser, not by us.

changes

This policy describes the site as it works on the date shown at the top. If what the site does changes — a mailing provider, self-hosted fonts, a different submission endpoint — this page gets updated to match, and the date changes with it. We make no claim to hold any privacy certification or third-party audit; this is a plain description of the system, and you are welcome to ask us about any part of it.