privacy

controller

The operator of italyhackathons.com is the Hackathons network, reachable through the contact page. The site is hosted on a server in Frankfurt (Germany), inside the EU.

what we store

Newsletter

Your email address, the time you subscribed and a random unsubscribe token. Legal basis: your consent. Unsubscribing is one click from every issue and takes effect immediately.

Submitted events

Everything you enter in the submit form, including your contact email. The email is never published; it is only used to ask you about your listing.

View counts

Per event and per day we count impressions, clicks and redirects to the organiser. To count unique visitors a truncated hash of IP address and browser identifier is created and deleted after 90 days. The IP address itself is not stored.

Server logs

The web server logs requests with IP address for at most 14 days, solely for diagnostics and abuse prevention.

cookies and local storage

The site sets cookies of its own only when you answer the banner: hx_consent records your answer (granted or denied, six months, readable only by our server). Until you answer, nothing tracks you and no tracking cookie is set; if you decline, nothing ever does. Change it any time at cookie settings. The browser remembers locally whether you closed the newsletter popup or subscribed, so it does not reappear; that information never leaves your device.

If you accept, our server sets three more cookies. hx_id is a random visitor number that contains nothing about you (HttpOnly, six months, readable only by our server); Meta never receives it as it is — only its SHA-256 hash, as external_id. _fbp is a browser id set by this site, not by Meta: fb.1. followed by the time it was created and a random number (90 days, not HttpOnly); an _fbp left from an earlier visit is reused. When you arrive from a Meta ad, _fbc holds the ad's click id and the time you arrived (90 days). Declining, or withdrawing consent in cookie settings, deletes hx_id, _fbp and _fbc.

third-party services

• Google Fonts — the typeface is loaded from Google's servers, which receive your IP address.
• Meta Conversions API — measures whether our Facebook and Instagram ads lead to visits. No code from Meta runs in your browser, and nothing is reported until you accept the banner: from then on our server reports to Meta's Conversions API directly. It reports a page view, an event page opened, a registration link followed, a newsletter signup, an event you submit through the submit form (ListingSubmitted — the listing type, never your contact email) and a featured-listing payment (Purchase — the price and the PayPal order id). Each report carries your IP address, your browser's user-agent, the click id (_fbc) and browser id (_fbp) if they exist, and the SHA-256 hash of hx_id as external_id; a newsletter signup also carries your email address as a SHA-256 hash — never the address itself — and signups, submissions and payments carry a hash of this site's country code. Withdraw any time at cookie settings: that deletes hx_id, _fbp and _fbc and stops every report from the next page; what Meta already holds is governed by Meta's own tools.
• PayPal — only on the submit page for a featured listing. Payment details are processed exclusively by PayPal.
• Maileroo — sends the newsletter on our behalf and receives your email address for that purpose.
• Luma, Eventbrite, Meetup, Devpost — the sources of the listings. Clicking "register" takes you to the organiser's site; their rules apply from there.

organiser accounts

Organiser accounts are optional. You only have one if you made it yourself at /organiser/register, to list a hackathon or to claim one we already list. Browsing this site never creates an account and never needs one.

If you do have one, this is everything it holds:

The account

Your email address, the name you chose to give (optional) and the language you signed up in. The password itself is never stored — only an argon2id hash of it, which cannot be turned back into the password.

Sign-in sessions

One record per device you are signed in on: your browser's user-agent string, a truncated hash of your IP address rather than the address itself, and when the session was created and last used. A session expires 30 days after it was last used, and you can end any of them yourself.

Your organisation

Its name, website, description, contact address and logo link, plus who else is a member and at what role. An invitation you send holds the invited address until it is accepted, revoked or expires.

What you create

The listings you publish through the portal, and any claim you file on a listing we scraped — including the evidence you wrote and the decision made on it.

The numbers an organiser sees. The per-listing counts described above are broken down, for that listing's organiser, by city and by where the visit came from. The city is worked out from the visitor's IP address against a database file held on our own server (DB-IP City Lite, CC BY 4.0), so no lookup leaves this machine and the address itself is never written down: what is stored is the city name, one of five coarse traffic labels (search, social, this site, other, direct) and the same truncated 90-day hash of IP address and browser string the counters already use. None of it identifies a visitor, and none of it is shown to anyone but that listing's organiser.

The weekly summary email is off until you switch it on. An organiser can ask for a short weekly email of their own listing numbers from the portal dashboard, and switch it off again in the same place.

Who can see it. Your organisation's details and its listings are visible to the other members of that organisation. A claim you file is read by the person who runs this site, in order to approve or reject it. None of it is published — the contact address on a listing is never shown on the site — and none of it is sold, shared or handed to an advertiser.

A copy of it, or the door. /organiser/account downloads everything above as a JSON file, and deletes the account — with its sign-in sessions and any organisation you were the only member of — from one form. Deletion is refused while you are the last owner of an organisation that still has listings: hand ownership over, or remove those listings, first, so nothing goes dark by accident.

your rights

Under the GDPR and the Italian Privacy Code (Codice in materia di protezione dei dati personali) you may request access to, correction of, and deletion of your personal data, and object to its processing. Write to us through the contact page; we answer within a month. Complaints can be lodged with the Garante per la protezione dei dati personali.

changes

If this page changes, the date of the last update is at the top. Material changes are announced in the newsletter.