Privacy Policy

This policy covers HackerAcademy at hackeracademy.io. It explains what we hold about you, why we hold it, how long for, and what you can make us do about it. If anything here does not match your experience of the product, tell us through the contact page and we will fix the product or the policy, whichever is wrong.

Your account. The email address and username you choose, your password in hashed form (we never see it), and anything else you choose to add such as a country, a short bio, and the look of your operative.

What you do in the product. Lessons and labs you start and finish, scores, XP, level, streak, league standing, chests, rivals and the people you follow. This is the service itself: without it there is no progress to show you.

Payments. Card payments are handled entirely by Stripe. We never receive or store your card number. We keep the email used for the purchase, which plan you are on, whether a trial is running, renewal and cancellation dates, and the outcome of payment attempts, because that is what decides your access and what tax law makes us keep.

Support and contact. Messages you send us, and the email address you send them from.

Analytics, only if you allow it. If you accept the analytics banner we store a random identifier on your device and record which pages you open, how far you scroll, which buttons you press, roughly how long things take, plus your IP address, browser and device type. We do not record what you type. If you decline, none of that identifier is written and none of those records are sent.

To run the account and give you what you paid for, which is our contract with you. Because you consented, for analytics and for marketing email, and you may withdraw that at any time. Because we have a legitimate interest in keeping the service working and stopping abuse, fake accounts and automated cheating. And because the law requires it, for the records that go with a payment.

Necessary, always on. A sign-in token so you stay logged in, and your own saved progress and settings. Without these the product cannot work, so they are not optional and we do not ask about them.

Analytics, off until you say yes. The random identifier described above. It is never written before you accept, and you can change your mind at any time in Settings, which stops it immediately.

We do not sell your data and we do not share it for anyone else's advertising. We use a small number of providers to run the service: Stripe for payments, Resend for sending email, and Supabase and Lovable for hosting, the database and file storage. Each handles the data only to provide that service to us.

Account and progress data is kept while your account exists, and is deleted when you delete the account. Analytics records are kept for up to 12 months. Records tied to a payment, such as invoices, are kept for as long as tax law requires, which is longer than the account itself and is the one thing deleting your account does not remove.

You can delete your account from Settings. If you have a running paid subscription you need to cancel it first and let the paid period finish. That is deliberate: deleting an account with a live subscription is how people end up still being charged for something that no longer exists. You keep everything you paid for until the period ends, and then the account can go.

Deleting removes your profile, progress, XP, streak, cosmetics, social connections and support messages. Payment records required by law are kept, with the personal detail in them reduced to what the law actually requires.

Some of the profiles you see on leaderboards, in the activity feed and among suggested people are simulated accounts that we create and run. They exist so a new learner does not arrive at an empty product. They are not real people, and a message, reaction, follow or invitation that comes from one is generated by our software, not sent by a human. Real people and simulated profiles appear in the same lists. Nothing you do with a simulated profile is shared with anyone, because there is nobody on the other end.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, ask for it in a portable form, and withdraw any consent you have given. Ask through the contact page and we will answer within one month. If you are in the UK or the EU and you think we have handled this badly, you can complain to your national data protection authority.

If we change how any of this works we will change this page and update the date at the top. If a change materially affects you, we will tell you in the product rather than quietly editing the page.

Reach us through the contact page and we will get back to you.