Privacy Policy

Last updated: October 30, 2026

This policy explains what personal data HackQ ("we", "us") collects when you use https://hackq.tech, why we collect it, who we share it with, and the choices you have. We keep it short and plain on purpose. If anything is unclear, write to [email protected].

1. What we collect

Information you give us

• Account data: username, email address, a hashed password (we never store your plain password), birthdate, and your chosen or uploaded profile picture.
• Profile data (optional): bio, portfolio link, GitHub username, job/role and interests.
• Content: posts, comments, replies, reactions, images, links, GIF selections and anything else you publish.
• Messages to us: emails you send to the contact address.

Information from sign-in providers

If you sign in with Google or GitHub we receive your name or username, verified email address and profile picture URL from that provider. We do not receive your provider password.

Information collected automatically

• Technical data: IP address, browser and device type. We use it to keep the service secure (rate limiting, abuse prevention) and to tell you where a password change came from.
• Activity data: who you follow, what you save, notifications, and interest scores derived from posts you read, react to or comment on. These scores personalise your "For you" feed and are not shared or sold.

2. How we use it

• To create and run your account, verify your email and keep it secure.
• To display your content and public profile to other people.
• To personalise your feed, send notifications (mentions, replies, follows, new posts from people you follow) and calculate points and ranks.
• To send service emails: verification codes, welcome message, password-change and security alerts, password reset links. We do not send marketing email.
• To moderate content, enforce our Terms and protect users and the service.
• To comply with legal obligations.

Where privacy law requires a legal basis, we rely on: performing our contract with you (running your account), our legitimate interests (security, abuse prevention, improving the service), your consent (where you choose to provide optional data), and legal obligation.

3. What other people can see

Your username, profile picture, rank, points, badges, posts, comments and reactions are public. Your bio, portfolio, GitHub, role, interests and birthdate each have a public/private switch in Settings. Your birthdate is private by default. Your email address, IP address and password are never shown to other users.

4. Cookies and similar technologies

We use a single, strictly necessary cookie named token. It is an HTTP-only login cookie that keeps you signed in for up to 7 days. We do not use advertising or analytics cookies, and we do not track you across other sites. Because the cookie is essential to the service, no consent banner is required for it.

Embedded YouTube videos load from youtube-nocookie.com. Google may set its own cookies once you press play. Images and GIFs are loaded from the hosts listed below, which see your IP address when they are fetched.

5. Who we share data with

We never sell your personal data. We share it only with service providers that help us run HackQ, under their own privacy terms:

• Database hosting (MongoDB): stores account and content data.
• Cloudinary: stores and serves images and uploaded avatars.
• Resend: delivers our emails (receives your email address and the message).
• Giphy: GIF search. Your search terms are sent from our server to Giphy; GIFs you add load from Giphy.
• Google and GitHub: only if you choose to sign in with them.
• YouTube (Google): only when a post contains an embedded video.

We may also disclose information if required by law, to respond to valid legal requests, or to protect the rights, safety and security of users and the service.

Some providers process data in other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.

6. How long we keep data

• Account and content data: until you ask us to delete your account.
• Email verification codes and password reset links: automatically deleted when they expire (30 minutes for codes and reset links, 48 hours for security links).
• Unverified sign-ups are removed after 24 hours.
• Backups and security logs may keep data for a limited time after deletion.

7. Security

We use industry-standard measures: passwords are hashed with bcrypt, login cookies are HTTP-only, verification codes and tokens are stored only as hashes, connections use HTTPS, and sign-in attempts are rate limited. No system is perfectly secure, so please use a strong, unique password. If you believe your account was accessed without permission, use the "Secure my account" link in our security email or contact us.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or CCPA), you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, to withdraw consent, and to complain to your local data protection authority. You can edit most data yourself in Settings. For anything else, including account deletion or a copy of your data, email [email protected] from your account email address and we will respond within 30 days.

9. Children

HackQ is not intended for children under 13, and we do not knowingly collect their data. We ask for your birthdate at sign-up to enforce this. If you believe a child under 13 has an account, contact us and we will delete it.

10. Public content and third-party links

Anything you post is public and may be copied, indexed by search engines or shared by others. Think before you post personal details. Posts may link to other websites; their privacy practices are their own.

11. Changes

We may update this policy. When we make material changes we will update the date above and, where appropriate, notify you. Continued use after changes means you accept the updated policy.

12. Contact

Questions or requests: [email protected]