Privacy policy

Who is responsible

Data controller: [PENDING: controller details (name or company name, country and address)].

For any question about your data: privacidad@hack-me.app.

What data we store

• Your account: the username and name you choose, your avatar and the date you created it.
• Your email: it is required to sign up, but it is not verified. HACKME doesn’t send emails yet, so it doesn’t check that the email belongs to you, doesn’t use it to contact you or to recover your account, and doesn’t show it to any other user; only the main administrator (the person responsible for HACKME) sees it, in the account list.
• Your password: it is not stored; only a fingerprint is (PBKDF2-SHA256 with a salt unique to your account). For your recovery code, too, only its fingerprint is stored.
• Your progress: finished games and their best score, lessons read, your answers in reviews and tests, XP, streak and how much XP you earned each day. Also a log of each action that gave XP (what it was, how much XP and what you answered), used to avoid counting the same thing twice. And your diamonds: how many you have and every movement (the ones you earned each day and the ones used to save your streak).
• The country you connected from when you created your account (or the first time you log in, if your account is older): only the country (for example “Argentina”), as reported by Cloudflare from the connection. Your IP address is not stored. Only administrators see it, to know where HACKME is used from.
• Your profile, only if you fill it in: photo, city or country and a short bio.
• Your settings: whether your profile is visible or private, your study mode and the date you accepted the ethics pledge.
• Your sessions and trusted devices: when they were created and when they expire, plus a fingerprint of the cookie code. Which device or where you logged in from is not stored.
• The reports you make: which profile, the reason and what you wrote.
• Your IP address: it is not stored in your account. It is only part of temporary attempt counters (the limites table) that slow down anyone guessing passwords or creating accounts in bulk; those counters are deleted after one day at the latest.

Cookies and browser storage

• __Host-sid: your session. It lasts up to 30 days or until you log out. It is strictly necessary: without it you couldn’t log in.
• __Host-disp: marks the device as trusted for 90 days, so nobody can lock you out by guessing passwords from somewhere else.
• In your browser (local storage, it never leaves your device): your chosen language (idioma) and game settings (cj_ajustes: sound, vibration, voice and challenge view).

There are no advertising or tracking cookies and no third-party analytics. (Cloudflare tries to add a statistics script to the pages; the site’s security policy blocks it.)

What we use it for

• To make the course work: your account, your progress, streaks, daily review and the leaderboard.
• For security: sessions, attempt limits and trusted devices.
• For moderation: reviewing reported profiles.

We don’t sell, rent or share your data for advertising. HACKME has no ads.

Who can see what

• Your email: you and HACKME’s main administrator.
• With your profile visible to people with an account (the default): anyone with a HACKME account who is logged in can see your name, username, avatar or photo, city, bio, XP, streak, how many games and lessons you did and since when you’ve been here, and you appear on the weekly leaderboard. Since anyone can sign up, think of it as visible to anyone who registers.
• With a private profile: nobody else can see your profile page, photo, city or bio, and you don’t appear on the leaderboard. Private hides the content, not the fact that the account exists: usernames are unique, so anyone who tries to sign up with yours will know it is taken.
• Without an account: nobody can see anything of your profile.
• HACKME administrators can see reports and, to moderate, the name, city and bio of the reported profile (even if it is private). In the account list they see each account’s country, sign-up date and progress; the email, only the main administrator. Nobody sees your password: it is stored encrypted.
• Whoever runs the service has technical access to the database to maintain it and make backups.

Where it is stored

The site and the database run on Cloudflare (Cloudflare Workers and Cloudflare D1). Cloudflare processes connections, including your IP address, to deliver and protect the site, under its own privacy policy. Data may be on servers outside your country. [PENDING: database region and international transfers].

How long

• Your account, profile and progress: as long as the account exists.
• Sessions: up to 30 days; trusted devices: up to 90 days. Expired ones are deleted whenever someone logs in, logs out or signs up.
• Attempt counters (the ones that include the IP address): one day at most.
• What you answered in the action log: it is cleared after 30 days when you log in (only which action it was and how much XP it gave is kept).
• Email verification links: 24 hours.
• Reports: pending ones until they are reviewed; reviewed or dismissed ones are deleted after 180 days by the periodic cleanup. [PENDING: turn on the automatic periodic cleanup; until then, these periods are only partly met].
• If you delete your account, everything above is removed from the database right away. Backups (Cloudflare D1’s history of up to 30 days and backups made by whoever runs the service) may keep it for a while longer. [PENDING: backup retention period].

What you can do

• Download all your data: Profile → Privacy → “Download my data” (a JSON file).
• Correct it: Profile → My profile.
• Make your profile private: Profile → Privacy.
• Delete your account and all its data: Profile → “Delete my account” (it asks for your username and password).
• Write to us: privacidad@hack-me.app.

[PENDING: rights under the applicable law and which authority to complain to].

Minors

[PENDING: minimum age to use HACKME and consent from parents or guardians].

Changes

If what we store changes, we update this page and the date above.