HackVillage

Privacy Policy

Last updated September 24, 2026

HackVillage (“HackVillage”, “we”, “us”) is an open-source hackathon platform operated by Technetium Kenya. This policy explains what data we collect when you use hackvillage.xyz, why we collect it, who we share it with, and the choices and rights you have over it.

HackVillage is built for radical transparency around prize money: escrow deposits and payouts are attested on a public ledger, and developer Proof-of-Work profiles are public by design. Sections below call out exactly which data is public and which is private.

1. Information We Collect

Account Information

When you sign up, we collect your name, email address, and a password (stored as a salted hash, and we never see or store it in plain text) or, if you sign in with Google or GitHub, the profile information those providers share with us (name, email, and public profile photo).

Profile And Proof-of-Work Data

Developer accounts have a public handle and profile page showing verified hackathon participation, win/loss record, judge endorsements, and (where you connect it) public GitHub contribution activity. We do not accept self-reported stats; profile metrics are derived only from verified platform activity.

Hackathon, Team, And Submission Data

Hackathon details, team rosters, project submissions, judge scores and feedback, and hiring introduction requests are stored to run the judging and payout workflow, and are shown to the relevant organizers, teammates, and judges for that hackathon.

Payment And Payout Data

HackVillage does not store your card, bank account, or M-Pesa number. Deposits and payouts are processed by Paystack, a licensed payment service provider, which independently verifies organizer businesses (KYB) and winner payout recipients (KYC) under its own privacy and compliance program. We store only the transaction references, amounts, and status needed to reconcile the ledger.

Technical Data

We use session cookies to keep you signed in (via Auth.js), and we log request metadata (IP address, user agent, timestamps) for security, rate-limiting, and abuse prevention. Each time you sign in, we email you the time, device, browser, IP address, and approximate location (estimated from your IP address) of that sign in, so you can spot one that wasn't you. We use Vercel Analytics for aggregate, privacy-respecting traffic metrics; it does not use cookies or track individuals across sites.

2. What's Public Vs. Private

Because trust is the product, some data is intentionally public once you opt in to it:

  • Developer Proof-of-Work profiles (handle, verified win rate, hackathons, endorsements).
  • The public trust ledger: every prize deposit and payout, with amount and a payment-provider reference, attested to a public blockchain.
  • Organizer trust scores and hackathon history.

Everything else (your email, password, payout account details, private messages, and draft submissions) is private and visible only to you, the relevant hackathon organizers and judges, and HackVillage staff where necessary to operate the service.

3. How We Use Your Information

  • To create and secure your account, and authenticate you on future visits.
  • To run hackathons: registration, team formation, judging, results, and payouts.
  • To verify prize pools are fully escrowed before a hackathon is marked Prize Verified.
  • To build and display your Proof-of-Work profile from verified activity.
  • To send transactional email (verification, password reset, hackathon and payout notices).
  • To detect fraud, enforce our Terms of Service, and keep the platform secure.
  • To comply with financial record-keeping and tax obligations.

We do not sell your personal data, and we do not run third-party advertising.

4. Who We Share Data With

We share the minimum data necessary with the following processors, each bound by their own data protection obligations:

  • Paystack: deposits, payouts, KYB/KYC verification.
  • Vercel: application hosting and analytics.
  • Neon: our PostgreSQL database.
  • Cloudflare: media storage (submission files, hackathon assets) and DNS.
  • Brevo: transactional email delivery (verification, password reset, notifications).
  • Google / GitHub: only if you choose to sign in with them.
  • Polygon (public blockchain): escrow and payout attestations. See the note on blockchain data below.

We disclose data to law enforcement or regulators only when legally required, and we never share your data with third parties for their own marketing purposes.

5. A Note On Blockchain Data

Escrow deposits and payouts are attested to the Polygon blockchain so anyone can verify that prize money was real. Entries on a public blockchain are immutable: once written, they cannot be edited or deleted, by us or anyone else. Attestations contain transaction amounts and references, not your name, email, or other personal identifiers.

6. Data Retention

We keep payout and financial records for at least seven years to meet financial record-keeping norms. Account and profile data is kept for as long as your account is active. Marketing communications data is deleted on request. Public ledger and Proof-of- Work records persist as a historical record of verified events even after an account is deleted, but are no longer linked to your private contact information.

7. Your Rights

Under Kenya's Data Protection Act, 2019 (and equivalent laws where you live), you have the right to:

  • Access a copy of the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Export your data in a portable format.
  • Delete your account and associated private data, subject to payout, tax, and fraud- prevention records we're legally required to retain.
  • Withdraw consent for optional communications at any time.

To exercise any of these rights, email info@hackvillage.xyz. We'll respond within 30 days.

8. Cookies

We use one essential session cookie to keep you signed in. It is not used for advertising or cross-site tracking, and it expires when you sign out or your session lapses.

9. Children's Privacy

HackVillage is not directed at children under 18. If you believe a minor has created an account, contact us and we'll remove it.

10. International Data Transfers

Our infrastructure providers (Vercel, Neon, Cloudflare) operate global networks, which means your data may be processed outside Kenya. Each provider maintains its own security and compliance program; we select processors that offer contractual data protection commitments equivalent to Kenya's Data Protection Act.

11. Security

Passwords are hashed with Argon2. Sessions use signed, httpOnly cookies. Data in transit is encrypted with TLS. Access to production data is limited to the people who need it to operate the platform.

12. Changes To This Policy

We'll update the “Last updated” date above whenever this policy changes, and post material changes prominently on the site before they take effect.

13. Contact

Questions about this policy or your data? Email info@hackvillage.xyz.