Privacy at The $0 Hackathon

01Who is responsible for your data

The data controller is Justinas Rolando, an individual (solo maker) based in Valencia, Spain, organizing The $0 Hackathon. [Legal entity, if one is used: full name / trading name, registration number, registered postal address].

Contact for anything about your data: hello@zerohackathon.com. There is no data protection officer; a solo project doesn't need one, so the email goes to the person who actually has the keys.

02What we collect, and when

We collect different things depending on what you do on the site. Nothing is collected just for visiting.

2.1 Signing up as a builder

• Your email address.
• The handle of your biggest public account (X, YouTube, TikTok, LinkedIn, Instagram, or newsletter).
• Your bracket (Seed, Sprout, Grove, Forest), chosen by you and checked against the public follower count of that handle.
• Your country, read from the request headers our hosting provider adds (based on your IP address). We store the two-letter country code, not the IP.
• An optional "double dipper" flag if you tick the box saying you already paid to enter another hackathon. It prints a stamp on your ticket. It's a joke and a data point at the same time.
• The time you signed up and a random ticket code.

2.2 Your public receipt page

Every signup gets a receipt page at an unguessable URL (zerohackathon.com/t/<code>) with a preview image, built for sharing on X. It shows your handle and bracket (and the double-dipper stamp, if you chose it). It never shows your email or country. Anyone who has the link can see it, so share it only if you want to. We don't list or index these pages, and we can take yours down on request.

2.3 Live chat

• The display name you type (or an auto-generated "Builder #1234" if you don't).
• An optional X handle, which we don't verify.
• Your message text, which is public to everyone on the site, in real time.
• A salted hash of your IP address. We never store the IP itself. The hash lets us rate-limit (a few messages per minute), count one report per person, and block someone who is being awful, without knowing who they are.
• If you report a message, we store the same IP hash against that report so one person can't report ten times.

2.4 Contact form

• Your name (optional), email, chosen topic, and message.
• A salted hash of your IP, for rate-limiting (3 messages per hour) and spam control. Not the IP itself.

2.5 Verification (from Dec 15, 2026)

If you want to be ranked, you connect your payment provider (Stripe, Lemon Squeezy, Polar or Paddle) with a read-only / restricted API key. We then collect:

• The key itself, stored encrypted and used only to read transactions for the Hackathon period.
• Aggregated sales data: counts and totals of payments, refunds, chargebacks and fees between Nov 15 and Dec 22, plus the number of unique paying customers and the share of the largest one.
• To check the "strangers only" rule we may need to look at per-customer patterns (for example whether one card or email paid many times). We look for patterns, we don't build profiles of your customers, and we don't keep their details. [Confirm exactly which fields the verification script reads and whether a neutral partner, e.g. TrustMRR, does this instead].
• The costs you declare and any receipts you send to back them up.

2.6 Winners

If you win cash, we additionally collect what we need to pay you and stay on the right side of the law: a government ID for a basic identity check, your payout details (bank, Wise or PayPal), and tax information where required [confirm which tax forms, if any, are needed for an individual organizer in Spain paying international winners].

2.7 Sponsors and backers

Sponsors and community backers who pay by card go through Stripe. Stripe collects the card details; we never see the full card number. We receive the payer's name, email, amount, and what the money is for, so we can put it in the public ledger (by sponsor name, or "anonymous backer" if you ask).

2.8 Email

Builders receive a welcome email on signup, a kickoff email before Nov 15, and hackathon updates during the event (results, deadlines, verification instructions). We send them through Resend. Every update email has an unsubscribe link; you can't unsubscribe from the verification instructions if you want to be judged, for obvious reasons, but you can unsubscribe from everything by withdrawing.

2.9 Server logs

Our hosting provider (Cloudflare) keeps standard, short-lived request logs for security and to keep the site up. We don't export or analyse them beyond that.

03Why we use it, and on what legal basis

Where we rely on legitimate interest, we've weighed it against your privacy: the data is minimal, mostly public by your choice or hashed, and you'd reasonably expect it. You can object at any time (Section 8).

04What we don't do

• No advertising and no ad networks on the site.
• No tracking pixels, fingerprinting, or cross-site tracking. No social-media embeds that phone home.
• No selling, renting or trading your data. Sponsors get a logo slot and a thank-you, not your inbox. If a sponsor offers a perk you want, you redeem it with them directly and their privacy policy applies.
• No automated decisions with legal or similar effects. Rankings are computed from your payment data, but a human reviews the top 10 in every bracket and every disqualification.
• Analytics: Umami, self-hosted by the organizer (on Vercel). It is cookie-free and counts page views and clicks (e.g. "opened signup", "shared receipt") with your country, browser, device type and referrer. It does not store your IP address or build a profile of you, and nothing is sold or shared for advertising. Legal basis: legitimate interest in knowing what works on the site.

05Who processes data for us

We're one person, so a few companies do the heavy lifting. They act on our instructions under their data-processing terms, and they don't get to use your data for themselves.

We may also share data if the law requires it (a court order, a tax authority) or to protect someone from harm, fraud or abuse. We'd tell you unless we're legally barred from doing so.

5.1 What's public by design

• Live chat messages, with the display name and optional handle you chose.
• Your receipt page (handle and bracket), to anyone with the link.
• The sponsor ledger: sponsor and backer names and amounts, unless you ask to be anonymous.
• Results: handles, product names, brackets, and verified numbers of ranked builders, as described in the rules.
• Aggregate counts (how many builders, per bracket) that don't identify anyone.

06Where your data goes (international transfers)

We're in Spain. Our providers are mostly US companies with servers around the world, so your data can leave the EU/EEA. When it does, we rely on:

• The EU-US Data Privacy Framework, for providers certified under it ([confirm current certification status of Cloudflare, Resend, Stripe]), and/or
• The European Commission's Standard Contractual Clauses built into each provider's data-processing agreement, plus their technical safeguards (encryption in transit and at rest).

If you want a copy of the relevant safeguards, email us and we'll point you at them.

07How long we keep it

The default: as long as needed to run this edition of the hackathon and pay everyone, then it goes. Proposed schedule, to be confirmed:

Backups may hold copies a little longer, and are overwritten on their normal cycle.

08Your rights

Under the GDPR (and similar laws elsewhere) you can ask us to:

• Access: tell you what we hold about you and send you a copy.
• Correct: fix something wrong (a typo in your handle, the wrong bracket).
• Delete: erase your data. Deleting your signup withdraws you from the hackathon; deleting a chat message removes it for everyone. We may have to keep winner payment records for tax law, and published results stay published (Section 5.1), but everything else goes.
• Export: receive your data in a machine-readable format (JSON is fine, right?).
• Restrict or object: pause processing, or object where we rely on legitimate interest. We'll stop unless we have a compelling reason, and we'll always stop update emails if you unsubscribe.
• Withdraw consent: untick the double-dipper stamp, say, at any time, without affecting anything done before.

How: email hello@zerohackathon.com from the address you signed up with (or tell us how to confirm it's you). We answer within 30 days, usually much faster. It's free. If a request is clearly abusive or repetitive we may refuse or ask for a reasonable fee, as the GDPR allows, but that has never been the plan.

Complaints: you can complain to a supervisory authority. Ours is the Spanish Agencia Española de Protección de Datos (AEPD), aepd.es. You can also use the authority where you live. We'd appreciate an email first so we can fix it.

09Cookies and local storage

The site sets no cookies. No consent banner, because there's nothing to consent to. Specifically:

• No analytics, advertising or tracking cookies. Umami (above) works without cookies.
• The live chat may save your chat preferences (your display name, optional handle, and whether you've muted or collapsed the chat) in your browser's localStorage, so you don't retype them. This stays on your device, is never sent to us by itself, and you can clear it from your browser settings at any time. The site works without it.
• Cloudflare may set a short-lived security cookie if it needs to challenge suspicious traffic. That's strictly necessary and not used to track you.
• Embedded fonts load from Google Fonts, which means your browser requests font files from Google and Google sees your IP and browser details in that request. [Consider self-hosting Rubik and Courier Prime from /fonts/ to remove this; the folder already exists].

10Security

• Everything is served over HTTPS.
• Payment-provider keys are read-only / restricted by design and stored encrypted at rest; the decryption secret lives outside the database. We ask you to create a key with the narrowest scope your provider allows, and to revoke it after Dec 23.
• IP addresses are stored only as salted hashes.
• Access to the database is limited to the Organizer, through authenticated tooling.
• If there's a breach that risks your rights, we'll notify the AEPD within 72 hours and tell affected people directly, as the GDPR requires. No "we take your privacy seriously" boilerplate; we'll say what happened.

11Children

The hackathon is for people 18 and over (see the rules). We don't knowingly collect data from anyone under 18, or under 16 for the chat. If you think a minor has signed up or is posting, tell us at hello@zerohackathon.com and we'll remove the data.

12Changes to this policy

We'll update this page when something changes (a new provider, a new feature, a fixed retention period). Every change is dated below, and material changes are announced on the homepage and emailed to builders. We won't quietly start doing any of the things in Section 4.

Nov 11, 2026

v0.1: first public draft, published before kickoff for review. Placeholders marked in yellow.

13Contact

Controller

Justinas Rolando, an individual (solo maker), Valencia, Spain [postal address for data-protection correspondence]

Email

hello@zerohackathon.com

Site

zerohackathon.com

Authority

Agencia Española de Protección de Datos, aepd.es

Thanks for reading a privacy policy voluntarily. Your data is in good, slightly tired, hands.