Privacy Policy — Canada Hackathons

The short version. This site sets no cookies and uses no third-party analytics. You can browse every listing without giving us anything. The only personal data we hold is what you type in yourself — an email address if you subscribe to the newsletter, or your event details if you submit a hackathon.

who we are

Canada Hackathons (canadahackathons.com) is an independent directory of hackathons in Canada. For anything in this policy — including a request to see or delete your data — contact hello@canadahackathons.com. We decide what data is collected and why, so we are the ones accountable for everything described below.

cookies

This site sets no cookies. Not for analytics, not for advertising, not for preferences. That is why you have never seen a cookie banner here — there is nothing to ask you to consent to.

Two small values are stored in your own browser, and neither is ever sent to us:

nl_shown: Session storage. Records that the newsletter popup has already appeared, so it does not reappear while you keep the tab open. Cleared when you close the tab.
nl_subscribed: Local storage. Records that you already subscribed, so the popup stops appearing for good. Cleared whenever you clear site data.

Both hold the literal value 1. They contain no identifier and are readable only by your browser on this site.

analytics

There is no Google Analytics, no tag manager, no advertising pixel and no session-recording tool on this site. No third-party analytics service of any kind is loaded. The site also ships no JavaScript bundles — the handful of small scripts it does run (the search box, the subscribe forms, the submit wizard) are written inline and talk only to this site's own API.

how we count what's popular

We do measure which listings get looked at, so we know which events are worth featuring and whether the directory is useful. This happens on our server, not in your browser: there is no tracking script, no beacon and no cookie involved.

Each listing keeps four running counters, per day: times shown in a list, times clicked from a list, times its page was opened, and times its registration link was followed. What gets stored is:

Stored: Which event, which calendar date (UTC), which of the four counters, and a count.
Not stored: Your IP address. Your browser's user-agent string. The page you came from. Any session or visitor ID. The time of day. Any free-text field.

To avoid counting the same person twice in one day, the server takes your IP address and browser user-agent, combines them, and stores a shortened one-way SHA-256 hash of the result. It also uses them, in memory, to discard traffic from bots and crawlers. The IP address and user-agent themselves are never written to disk — only the hash is kept.

We want to be precise rather than flattering here: that hash is pseudonymous, not anonymous. It cannot be read back to reveal an IP address, but the same visitor produces the same hash on the same day, so we treat it as personal information. Anything older than 90 days is deleted — to be exact about the mechanism, that cleanup runs when the service restarts rather than on a timer, so a hash can outlive 90 days by however long the service has been up. The daily counters that remain afterwards are plain totals with nothing personal in them, and we keep those indefinitely.

Why we have it: to understand which listings are useful, using the least identifying method we could implement. Email the address above if you would rather not be counted.

the newsletter

If you subscribe, here is the entire record we create:

Your email address: Lowercased and trimmed.
A timestamp: When you subscribed.

That is genuinely all of it — the database table has three columns and the third is an ID number. We do not record your IP address, your browser, your name, or which page you subscribed from, and the three signup forms on the site all behave identically in this respect. Subscribing takes effect immediately; there is no confirmation email.

The newsletter is sent through Maileroo, an email delivery provider, so your address is passed to them each time an edition goes out. Sends have open and click tracking switched on: Maileroo adds an invisible image to record that you opened the email, and rewrites the links so it records which ones you click. We see this as per-campaign totals; Maileroo holds it per recipient. Nothing else about you is sent to them — not your name, because we do not have one.

The list itself lives in this site's own database on our own server. It is not sold, not shared with anyone besides Maileroo, and not used to build a profile. Sending is automatic: the server checks every fifteen minutes and, if an edition is due, sends the current week's listings onMonday at 9am Toronto time.

Why we have it: because you typed your address into a subscribe box, which is the only way an address ever gets on the list.

To unsubscribe: email hello@canadahackathons.com from, or quoting, the address you signed up with. Being straight with you: there is no one-click unsubscribe link — the emails carry an unsubscribe header that opens a message to us, and removal is done by hand. We delete the record rather than flagging it. We keep addresses until you ask us to.

submitting an event

The submit form collects the event's details — name, URL, description, organisation, city, venue, address, province, postal code, dates, ticket price, prize and an image link — plus a contact email address, which is the only part that is necessarily personal data. If you buy a featured listing, we also record the PayPal order ID.

Event details are published on this site, which is the point of submitting them. Your contact email is not published — it is used to reach you about the listing, and it is stripped out of any export of the submissions list.

Please note: when you press submit, your browser sends the form directly to a Bunny.net edge endpoint that receives our submissions. That means Bunny.net, our infrastructure provider, receives your IP address along with the submission, including your contact email. This happens only when you actually submit the form.

Why we have it: it is what you asked us to publish, plus a way to reach you about it. Submissions are kept as our record of what was published and why.

if you email us

Mail to any @canadahackathons.com address is forwarded to a personal Gmail mailbox, so Google receives and stores the message — the address you sent from, the subject and everything in the body. That is worth knowing before you send us anything you would not want in someone's inbox. We keep correspondence for as long as it is useful and delete it on request.

other companies that see something

We deliberately keep this list as short as we can, but it is not empty, and pretending otherwise would be the easiest thing in this policy to get wrong:

Google Fonts: Every page loads two typefaces from Google's font servers, so Google receives your IP address, your user-agent and the address of the page you are viewing — on every page view, before you interact with anything. This is the most significant third-party data flow on the site. We intend to self-host the fonts, which removes it entirely.
PayPal: The /submit page loads PayPal's payment script, so PayPal receives the IP address and user-agent of everyone who opens that page, whether or not they pay, and sets its own cookies under paypal.com. No other page loads it. Payment is handled entirely on PayPal's side — we never see or store card details, only an order ID.
Bunny.net: Hosts the endpoint that receives event submissions, as described above. It is not involved in ordinary browsing.
Maileroo: Delivers the newsletter, and records opens and clicks per recipient, as described above. It also handles mail addressed to this domain, forwarding it on to Google.
Google (Gmail): Receives anything you email us, via that forwarding.

One company people reasonably assume is on this list but is not: Cloudflareprovides this domain's DNS, but the record points straight at our own server rather than through Cloudflare's network, so it never sees your page views — only the DNS lookups any resolver makes. Each of the companies above processes data under its own privacy policy, and we cannot tell you where in the world they do it. Beyond these, no third party receives anything about you.

links out to organisers

Registration links go through a /go/ address on this site. That step adds one to the "registration link followed" counter described above and then immediately forwards you to the organiser's page on Luma, Eventbrite or Devpost. It stores nothing else. The links are marked so that the organiser's site is not told which page you came from.

Once you land on an organiser's site — or any other site we link to — you are covered by their privacy policy, not ours. Event images shown here are currently copied and served from our own domain rather than loaded from the organiser, so simply viewing a listing does not reveal you to them.

logs

The application keeps no visitor log files: no access log, no request log, no record of which pages you viewed. The web server in front of it is configured without an access log too. Our network provider may still hold short-lived operational records for security and reliability, as any host does.

your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. In practice, for this site that means:

Your newsletter subscription — we can confirm whether an address is on the list, and delete it.
An event submission — we can send you what was submitted, correct it, or remove it.
Correspondence — we can delete what you have sent us.
The 90-day counting hash — it is not searchable by name or email, so we cannot single it out to show you; it deletes itself on the schedule described above, and you can ask us to stop counting you.

Email hello@canadahackathons.com. There is no charge and we do not require a particular form of words. If you think we have handled your data badly, the Office of the Privacy Commissioner of Canada takes complaints at priv.gc.ca — though we would rather you gave us the chance to put it right first.

children

This is a listings site for public events and is not directed at children. We do not knowingly collect data from anyone under 13. Some listed hackathons are student and high-school events with their own age rules — those are set by the organiser, not by us.

changes

This policy describes the site as it works on the date shown at the top. If what the site does changes — a different mail provider, self-hosted fonts, a different submission endpoint — this page gets updated to match, and the date changes with it. We make no claim to hold any privacy certification or third-party audit; this is a plain description of the system, and you are welcome to ask us about any part of it.