← BACK TO HACKLINGO

Privacy Policy

Last updated: May 17, 2026

This Privacy Policy describes how Hacklingo ("we," "us," or "our") collects, uses, and shares information when you use our website at hacklingo.tech, our mobile application, or any related service (collectively, the "Services"). By using the Services, you agree to the practices described here. If you disagree, please stop using the Services and delete your account.

1. What Information We Collect

Information you provide directly

• Email address — required to create and log in to your account.
• Username — a handle you choose when you sign up. This is publicly visible on leaderboards.
• Password — stored as a secure hash by Supabase (our database provider). We never see your password in plain text.

Information we collect automatically when you use the app

• Game progress data — your XP, streak, completed lessons, hashes (in-app currency), rank, squad membership, and other in-app activity.
• Device & technical data — your IP address, browser type, operating system, device model, and app version. We use this to diagnose bugs and keep the service running.
• Usage logs — which screens you visit and when. Used for internal analytics and improving the product. We do not sell or share this for advertising.

Information from third parties

If you sign in using GitHub or Google OAuth, we receive basic profile information from that provider (typically your email address and name). See Section 5 for details.

What we do NOT collect

• We do not collect your phone number, mailing address, or date of birth.
• We do not collect biometric data, racial or ethnic origin, health data, or any other "sensitive" category under GDPR.
• We do not collect your payment card details. All payment processing is handled directly by Stripe. See Section 6.

2. How We Use Your Information

• To operate the service — running your account, tracking your progress, awarding XP and streaks, processing in-app purchases.
• To communicate with you — sending streak reminder emails (if you opt in), account-related notifications, and responding to support requests.
• To improve the product — understanding which lessons are being completed, where people drop off, and how the app performs on different devices.
• To prevent fraud and abuse — detecting cheating, spam, or misuse of the platform.
• To comply with law — responding to legal requests when required.

We process your information on the following legal bases (for users in the EU/UK): performance of our contract with you; our legitimate interests in operating and improving the service; your consent (for optional communications); and legal obligation where applicable.

3. When We Share Information

We do not sell your personal information. We do not share it for third-party advertising. We share data only in these circumstances:

• Service providers — Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Resend (transactional email). Each processes data on our behalf under contract. None are permitted to use your data for their own marketing.
• Public leaderboards — your username, rank (XP), streak, and team alignment are publicly visible to other users on the in-app leaderboard. Your email address is never made public.
• Legal requirements — we will disclose information if required by law, court order, or to protect the safety of our users or the public.
• Business transfer — if Hacklingo is acquired or merges with another company, your data may transfer as part of that transaction. We will notify you before this happens.

5. Social Logins (GitHub & Google)

If you choose to register or log in using GitHub or Google, we receive from those providers only the information needed to create your account: typically your email address and (if available) a display name. We do not receive your social media contacts, posts, or any other data beyond what is strictly needed for authentication.

Your use of GitHub or Google's OAuth is subject to their respective privacy policies. We are not responsible for their data practices.

6. Payments (Stripe)

All payments for Root Access subscriptions are processed by Stripe, Inc. When you pay, you enter your card details directly on Stripe's secure form. We never receive, store, or have access to your card number, CVV, or billing address. What we do receive from Stripe is a confirmation that your payment was successful and a customer reference ID, which we use to activate your subscription in our database.

Stripe's privacy policy is available at stripe.com/privacy.

7. Cookies & Tracking

We use minimal cookies. The primary cookie we set is a Supabase authentication token that keeps you logged in between sessions. We do not use third-party advertising cookies or cross-site tracking cookies.

If you use the web version of Hacklingo, your browser may also store standard items like localStorage keys for session management. None of this data is shared with advertisers.

If and when we add analytics (such as Plausible or PostHog), we will update this section and ensure any analytics tool used is privacy-respecting and does not share your data with advertising networks.

8. How Long We Keep Your Data

We keep your account data for as long as your account is active. If you delete your account, we will delete your profile, game data, and email address from our active systems within a reasonable time (typically within 30 days). We may retain anonymized usage statistics (which cannot be linked back to you) indefinitely for product research.

Supabase may retain backups for up to 30 days after deletion. Stripe retains transaction records for up to 7 years as required by financial regulations, but this data is held by Stripe and governed by their policy.

9. Security

We take reasonable technical steps to protect your data: all communication is encrypted in transit (HTTPS/TLS), passwords are hashed before storage, and database access is protected by row-level security policies. We use Supabase's auth infrastructure, which is purpose-built for secure user management.

However, no system is completely secure. We cannot guarantee that unauthorized parties will never circumvent our measures. If you have reason to believe your account has been compromised, contact us immediately at security@hacklingo.tech.

10. Your Rights

Everyone

• Access — you can export your data from your Operator profile screen at any time.
• Correction — you can update your username and email in the app settings.
• Deletion — you can delete your account from the Operator screen. This removes your profile and associated data from our active systems.
• Opt-out of emails — every email we send includes an unsubscribe link. You can also toggle email notifications off in your profile settings.

EU / UK users (GDPR)

In addition to the above, you have the right to data portability, the right to restrict processing, and the right to object to processing based on our legitimate interests. You may also lodge a complaint with your national data protection authority. To exercise any of these rights, email privacy@hacklingo.tech.

California residents (CCPA)

You have the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, email privacy@hacklingo.tech or use the account deletion feature in the app.

11. Children (Under 13)

Hacklingo is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. Our signup flow requires users to confirm they are 13 or older. If we discover we have inadvertently collected information from a child under 13, we will delete it promptly. If you believe a child under 13 has created an account, contact us at privacy@hacklingo.tech.

12. Changes to This Policy

We may update this Privacy Policy as we add new features, integrate new services, or as legal requirements change. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or an in-app notice. Continued use of the Services after changes take effect constitutes acceptance of the revised policy.

13. Contact Us