Privacy,
in plain terms
HackHQ is an open-source hackathon directory. We collect as little as the product allows, and this page tells you exactly what that is - what happens when you just browse, what changes when you sign in, and which third parties are involved. No dark patterns, no fine-print surprises.
The short version
- We never sell, rent, or trade your data. There are no ads and no advertising trackers.
- We set no analytics or advertising cookies. The only cookies set on our behalf come from Clerk, our sign-in provider, and exist purely to run sessions. Embedded third parties are a separate story: Mapbox's map library stores an anonymous ID in your browser - spelled out below.
- Your application tracker lives in your own browser unless you sign in - then it syncs to your account.
- Product analytics is off by default. When enabled, it is cookieless and anonymous, and it respects Do Not Track and Global Privacy Control.
- Want something deleted? Email hackheadquarters@gmail.com and we will handle it.
Just browsing the site
You can use the globe, the deck, the resources, and the tracker without an account. Here is everything that happens on a plain visit:
Our hosting provider (Cloudflare Workers) processes standard request metadata - your IP address, user agent, and the pages you request - in short-lived server logs used to serve and secure the site. We do not build profiles from these logs.
Fonts are bundled with the site at build time and served from our own domain. Your browser makes no font requests to Google or any other font service.
The 3D globe renders map tiles from Mapbox. While it is on screen, your browser requests tiles directly from Mapbox servers, which see your IP address and user agent, as with any map on the web. On top of that, Mapbox’s map library sends its default usage telemetry to events.mapbox.com and stores a persistent anonymous identifier in your browser’s localStorage (under mapbox.eventData keys) to go with it. That identifier is not tied to your name or account, and clearing this site’s data removes it. The hackathon pins themselves are our own public listing data.
On deployments where sign-in is configured (the live site is one), Clerk’s script loads and talks to Clerk’s servers on every page view - for every visitor, signed in or not. So even a plain visit sends your IP address and user agent to Clerk, and Clerk sets a device cookie (__client_uat) whether or not you ever sign in. What Clerk stores about you once you do sign in is covered in the accounts section below.
We use Sentry to find out when the site breaks. If an error happens, the report includes the error message, a stack trace, the page URL, and basic browser and device metadata. We have Sentry’s optional extras switched off: no performance tracing, no session replay, and no personally identifying enrichment of error reports.
The site ships with optional PostHog web analytics that is off unless a deployment explicitly enables it. When it is enabled, it is cookieless and anonymous by construction: nothing is stored on your device (memory-only, so nothing survives a reload), no user profiles are ever created, and it records page views for the initial load and in-app navigations. Like any server on the receiving end of a request, PostHog’s servers see your IP address when those events arrive; events carry only a random identifier that resets every page load and is never tied to you. If your browser sends Do Not Track or Global Privacy Control, the analytics script is never even downloaded.
Signing in and the tracker
The tracker works entirely in your browser. Your pipeline and wins are saved in localStorage on your own device (under the keys hackhq-tracker-v1, hackhq-wins-v1, and hackhq-tracker-imported-v1) and never leave it. Clearing your browser’s site data removes them.
Sign-in is optional and handled by Clerk, a dedicated authentication provider. Clerk manages your account details - such as your email address, name, and sign-in method - and uses cookies to keep your session alive. That means the site is not cookie-free once sign-in is in play; those cookies are strictly functional.
When you are signed in, your tracker syncs to your account so it follows you across devices. What we store per saved hackathon is deliberately minimal: your account ID, the hackathon’s ID, the stage you put it in, whether you marked it a win, and two timestamps recording when the row was created and last changed. That is the whole row. It lives in our Supabase database, every read and write we make against it is scoped to your account, and on first sign-in your browser-local tracker is offered to your account once so nothing you saved gets lost. We are in the middle of moving that scoping into the database itself, so it is enforced by Postgres rather than only by our code.
Everyone involved, by name
These are all the third parties that can receive any data when you use HackHQ, and when each one is in play:
- CloudflareEvery visit
Host the site. See standard request logs (IP address, user agent).
- SentryWhen an error occurs
Receives error reports: message, stack trace, page URL, browser and device metadata. No session replay, no tracing.
- MapboxWhile the globe is on screen
Serves the map tiles behind the 3D globe and receives its library's default usage telemetry at events.mapbox.com, keyed to an anonymous identifier stored in your browser's localStorage.
- ClerkEvery visit, plus sign-in
Its script loads and contacts Clerk's servers on every page view, and it sets a device cookie even for signed-out visitors. Once you sign in, it manages your account and session cookies and holds your email, name, and sign-in method.
- SupabaseSigned in, tracker in use
Stores your tracker rows (account ID, hackathon ID, stage, win flag) and a mirror of the public listings.
- PostHogOnly if analytics is enabled
Receives anonymous, cookieless page view events. Sees the sending IP address at ingestion, like any server. Honors DNT and Global Privacy Control.
- GitHubWhen you submit or contribute
Hosts the open-source repo. Listing submissions and gallery photos are public GitHub issues under your GitHub account.
Control and deletion
- Browser-local tracker: clear this site's data in your browser and it is gone. It was never on our servers. The same clearing also removes Mapbox's anonymous identifier.
- Account and synced tracker: email hackheadquarters@gmail.com from the address on your account and we will delete your account records and every tracker row tied to it. You can also manage your account details directly from the account menu, powered by Clerk.
- Analytics: nothing to delete - when enabled it is anonymous and stores nothing on your device. Turning on Do Not Track or Global Privacy Control keeps it fully off for you.
- Public contributions: listings and gallery photos submitted through GitHub live in the public repo. Ask us (or open an issue) and we will remove a photo or credit you submitted.
The rest of it
HackHQ is a general-audience site aimed at hackathon builders and is not directed at children under 13. We do not knowingly collect personal information from children under 13; if you believe a child has created an account, email us and we will delete it.
When our data practices change, this page changes with them and the effective date at the top is updated. Material changes will be called out on the site rather than buried here.
Questions, deletion requests, or anything unclear: hackheadquarters@gmail.com. A human reads it.