Privacy policy

HackOS is a platform for running hackathons. Organisations buy a plan and set up their events; the people at those events — participants, judges, mentors and volunteers — take part through the platform. This policy covers the hack-os.app websites, the platform itself and the e-mails it sends.

Who is responsible depends on the data. For the people at an event, the organisation that runs the event decides what is collected and why, and HackOS stores and processes that data on its behalf. For customer accounts, orders and invoices, and for this website, HackOS itself is responsible.

• Account: your name, your e-mail address and a password, which we store only as a one-way hash. We also record when you confirmed your e-mail address.
• Event roles: the events you take part in and your role in each; for mentors their expertise and availability, for volunteers their tasks.
• Profile, if you fill it in: phone number, age, country, time zone, university and cohort, links to GitHub and LinkedIn, skills and experience, dietary needs, T-shirt size and similar details an event asks for.
• Registration: your answers to the event's registration form, any files you attach (for example a CV), and your status — pending, approved, waitlisted or rejected.
• Teams and projects: team membership and invitations, your project's links and files, and presentation slots.
• Judging: the scores and comments judges give, a history of every change to a score, conflict-of-interest declarations, votes in a people's choice vote where an event holds one, and the results the organiser publishes.
• Communication within an event: chat messages and reports about them, help requests to mentors (topic, description, where you are sitting and, if you give one, a contact phone number), announcements and the notifications sent to you.
• Certificates: your name as printed, the event, your team and placing, and the certificate's code. Anyone who has the code can check the certificate on the public verification page; it shows the name, the event and the award, never your e-mail address.
• Feedback: ratings and comments you leave after an event. Answers to the “would you recommend it” question are shown to organisers without names.
• Customers: the organisation's name, legal name, tax number, country, city, website and billing e-mail address, the contact people there, and orders with their status history and invoices. For an order placed with a card we keep only the card brand and the last four digits.
• Security records: for important actions — the owner console's second sign-in step, changes to roles and passwords, e-mail confirmations, decisions on orders, publishing and archiving events, chat moderation — we record who acted, when, and the IP address the request came from.
• Messages sent through the website's contact form are delivered to our mailbox; the form does not store them in the platform.

• To run the events you organise or take part in: registration, teams, submissions, judging, results, certificates, announcements, chat and help requests.
• To keep your account secure: signing in, confirming your e-mail address, resetting passwords and limiting repeated failed attempts.
• To process orders and issue invoices for customers.
• To send the e-mails the service needs: confirmation links, invitations, order updates, announcements from your organiser and certificates.
• To investigate problems and misuse, using the security records described above.

We do not sell personal data, show advertising or use your data to build profiles for anyone else.

We work with a small number of providers, each only for its part of the service:

• Vercel hosts the website and the platform's interface.
• Render runs the platform's servers, in its Frankfurt (Germany) region.
• Supabase provides the PostgreSQL database in which the data above is stored.
• An e-mail delivery service — Resend or Brevo, or an SMTP mail server, depending on our configuration — sends the platform's e-mails.
• Telegram is used only if you link your Telegram account to receive notifications, or an organiser links a Telegram channel to repeat announcements there. We then keep your Telegram chat ID, username, first name and language.
• GitHub: when a submission links to a GitHub repository, the platform reads the repository's public details through GitHub's public API to check when it was created and worked on. The request contains only the repository's address.
• Calendar apps such as Google Calendar receive event dates only when you choose “Add to calendar” or subscribe to your personal calendar feed.

Some of these providers process data outside Azerbaijan, for example in the European Union or the United States. They act on our instructions and under their own security and data-protection commitments.

• Events stay in the platform after they end. Fourteen days after the end an event is archived: it can still be read and exported, but nothing in it can be changed.
• An organiser can delete their event. Its registrations, teams, submissions, scores, chat, certificates and files are deleted with it.
• In-app notifications are deleted after 90 days.
• When a chat message is removed, its text is erased at once; only a “message removed” marker remains.
• E-mail confirmation links expire after 72 hours and password reset links after one hour.
• Telegram link codes are deleted a day after they expire, and the record of messages received from Telegram after seven days.
• Your account stays until it is deleted. To have it deleted, write to mamishovrasul028@gmail.com.
• Orders and invoices are kept for accounting, and security records to investigate problems.

Under the Law of the Republic of Azerbaijan “On Personal Data” you can ask to see the personal data we hold about you, to have it corrected or deleted, and to object to how it is used.

• You can change your profile in the platform at any time.
• Data that belongs to an event — your registration, team, submission or scores — is managed by the event's organiser: ask them to correct it, to remove you from the event or to export the event's data.
• You can unlink Telegram, and reset the link to your personal calendar feed, in the platform.
• For anything else, or if an organiser does not answer, write to mamishovrasul028@gmail.com. We check that a request really comes from you before we act on it.

• All connections to the platform are encrypted (HTTPS).
• Passwords are stored only as bcrypt hashes. Your session is kept in a cookie that the page's own scripts cannot read, and changing your password signs out every other device.
• Every request is checked on the server against your role in the event concerned; one organisation cannot see another organisation's events.
• Confirmation and password reset links work once and expire.

No system is perfectly secure. If you think your account or data has been exposed, write to mamishovrasul028@gmail.com straight away.

HackOS is meant for people aged 16 and over. Younger people take part only with the consent of a parent or guardian, which the event's organiser arranges and is responsible for.

When we change this policy we update the date at the top of the page. If a change affects how your data is used, we will also tell you in the platform or by e-mail.

Questions about this policy or your data: write to mamishovrasul028@gmail.com.

Service

HackOS

E-mail

mamishovrasul028@gmail.com