Privacy notice

This describes what HackMatch collects and why. It is updated as features are added. HackMatch is for people 18 and older.

What we collect

• Account: your name, your email address, and either a salted hash of your password (we never store the password itself) or, if you sign in with Google, Google's identifier for your account. We keep your email address for as long as your account exists, so we can reach you (see "Email" below).
• Sign in with Google (optional): we receive your name, your email address and whether Google has verified it, plus the link to your Google profile picture, which HackMatch doesn't show. We don't get your Google password and we don't read your Gmail, contacts or files. The sign-in tokens Google gives us are stored encrypted. Google handles the sign-in under its own privacy policy.
• Sign-in records: session tokens, plus the IP address and browser string of each session so you and we can spot unfamiliar sign-ins.

• Profile and events: what you enter in your profile, the events you join, and your connections. You choose, field by field, what other people in your events can see. Contact details are shown only to people you have connected with.
• Profile photo (optional): shown next to your name to people who can see your profile, which means people in your events unless you hide your profile, and your connections. Your browser crops and re-saves the photo before upload, so camera and location details in the original file are not sent. Removing it, or deleting your account, deletes the file.
• Resume (optional): private unless you choose to share it with people in your events or with your connections.
• Import from GitHub (optional): if you type a GitHub username, HackMatch asks GitHub for that account's public profile and repository languages to suggest skills. Nothing is stored until you save your profile, and it doesn't sign you in to GitHub or mark the account as verified.
• Where you stand: on a connection you can mark Interested, Chatting, Committed or Not moving forward. The person you're connected with sees your choice and gets an alert when it changes. Event organizers see only totals for their event, never who.
• Keep in touch notes: if you mark a connection as someone to keep in touch with, or write a note about them, only you can see it. It is deleted with the connection or your account.
• Messages: the text you send to people you are connected with, when it was sent, and whether it has been read.
• Notifications and settings: short alerts (for example, "you have a new message") that contain no names or message text, and which alerts you turned off.
• Safety records: people you block, and reports you file.

Who can see it

Profile details are visible to the audience you pick for each field. Event organizers see who joined their event and what you have made visible to event members.

The people who run HackMatch can see account details (name and email address), who is connected to whom, how many messages a conversation has, and reports, so they can keep the service safe and contact you. The admin tools do not show message text.

Messages

• Only you and the person you are messaging can read a conversation in the app. Event organizers cannot read it and have no page that shows it.
• Messages are not end-to-end encrypted. They are protected in transit and stored in the HackMatch database, so the people who operate that database can technically read them. They are not read as part of normal operation, and message text is kept out of logs and analytics.
• If you report a message, a copy of that one message and your note are shared with the people who review reports for the event. They do not see the rest of the conversation.
• If you disconnect, you can both still read the history but not send new messages. If you block someone, they can no longer reach you; you can still read the history, and they can't see the conversation at all. They are not told they were blocked.
• Messages are kept until the connection is removed or either account is deleted. Deleting an account deletes the messages in its conversations, for both people.

Email

• Account emails (confirming your address, resetting your password, security notices) are sent as needed.
• Alerts tell you that someone asked to connect, accepted your request, messaged you, or that a team invited you or replied. They say that something happened and link to the app; they never include names or message text. You can switch each kind off on the Notifications page.
• Now and then we may also email you something about HackMatch, for example to ask for feedback. This is occasional, not a regular newsletter. By creating an account you agree to that. If we send more than a one-off, the email will say how to stop receiving it.
• We keep the email address on your account for as long as the account exists, so we can reach you. We don't sell it or share it with advertisers.

Third parties

We do not send your data to advertising or AI services, and we do not use it to train models. Emails are delivered through an email provider (currently Brevo), which handles your email address and the message so it can be delivered. If you choose Sign in with Google, Google handles that sign-in.

Deleting your account and what we keep

You can delete your account from the Account page. Deleting is permanent. It needs your password. If you only sign in with Google, we email a one-time link to your account address, and you open it and type DELETE to confirm.

• Deleted right away: your account and email address (so you leave our email list), your profile, photo and resume files, sign-in sessions, event memberships, connections and the messages in them, blocks, team offers and notifications. Teams you were on go to another member, or are closed if you were the only one.
• Kept without your identity: reports about you or filed by you, and the record of moderation actions, so deleting an account can't erase a safety report. Closed reports and these records are removed after 12 months.
• Read notifications are removed after 90 days. Backups, if the operator keeps any, expire on the operator's schedule.
• If you own an event that hasn't been archived you must archive it first, so no event is left without an organizer.