privacy

controller

The operator of taiwanhackathons.com is the Hackathons network, reachable through the contact page. The site is hosted on a server in Frankfurt (Germany).

what we store

Newsletter

Your email address, the time you subscribed and a random unsubscribe token. Legal basis: your consent. Unsubscribing is one click from every issue and takes effect immediately.

Submitted events

Everything you enter in the submit form, including your contact email. The email is never published; it is only used to ask you about your listing.

View counts

Per event and per day we count impressions, clicks and redirects to the organiser. To count unique visitors a truncated hash of IP address and browser identifier is created and deleted after 90 days. The IP address itself is not stored.

Server logs

The web server logs requests with IP address for at most 14 days, solely for diagnostics and abuse prevention.

cookies and local storage

This site sets a few cookies of its own, and there is no banner: on this site, ad measurement with Meta is on unless you switch it off at cookie settings. Your answer there is stored as hx_consent (granted or denied, six months, readable only by our server). The browser remembers locally whether you closed the newsletter popup or subscribed, so it does not reappear; that information never leaves your device.

Unless you have switched it off, our server sets three more cookies on your first visit. hx_id is a random visitor number that contains nothing about you (HttpOnly, six months, readable only by our server); Meta never receives it as it is — only its SHA-256 hash, as external_id. _fbp is a browser id set by this site, not by Meta: fb.1. followed by the time it was created and a random number (90 days, not HttpOnly); an _fbp left from an earlier visit is reused. When you arrive from a Meta ad, _fbc holds the ad's click id and the time you arrived (90 days). Switching it off in cookie settings deletes hx_id, _fbp and _fbc.

third-party services

• Google Fonts — the typeface is loaded from Google's servers, which receive your IP address.
• Meta Conversions API — measures whether our Facebook and Instagram ads lead to visits. No code from Meta runs in your browser: our server reports to Meta's Conversions API directly, and on this site it does so unless you opt out at cookie settings. It reports a page view, an event page opened, a registration link followed, a newsletter signup, an event you submit through the submit form (ListingSubmitted — the listing type, never your contact email) and a featured-listing payment (Purchase — the price and the PayPal order id). Each report carries your IP address, your browser's user-agent, the click id (_fbc) and browser id (_fbp) if they exist, and the SHA-256 hash of hx_id as external_id; a newsletter signup also carries your email address as a SHA-256 hash — never the address itself — and signups, submissions and payments carry a hash of this site's country code. Opting out deletes hx_id, _fbp and _fbc and stops every report from the next page; what Meta already holds is governed by Meta's own tools.
• PayPal — only on the submit page for a featured listing. Payment details are processed exclusively by PayPal.
• Maileroo — sends the newsletter on our behalf and receives your email address for that purpose.
• Luma, Eventbrite, Meetup, Devpost — the sources of the listings. Clicking "register" takes you to the organiser's site; their rules apply from there.

organiser accounts

Organiser accounts are optional. You only have one if you made it yourself at /organiser/register, to list a hackathon or to claim one we already list. Browsing this site never creates an account and never needs one.

If you do have one, this is everything it holds:

The account

Your email address, the name you chose to give (optional) and the language you signed up in. The password itself is never stored — only an argon2id hash of it, which cannot be turned back into the password.

Sign-in sessions

One record per device you are signed in on: your browser's user-agent string, a truncated hash of your IP address rather than the address itself, and when the session was created and last used. A session expires 30 days after it was last used, and you can end any of them yourself.

Your organisation

Its name, website, description, contact address and logo link, plus who else is a member and at what role. An invitation you send holds the invited address until it is accepted, revoked or expires.

What you create

The listings you publish through the portal, and any claim you file on a listing we scraped — including the evidence you wrote and the decision made on it.

The numbers an organiser sees. The per-listing counts described above are broken down, for that listing's organiser, by city and by where the visit came from. The city is worked out from the visitor's IP address against a database file held on our own server (DB-IP City Lite, CC BY 4.0), so no lookup leaves this machine and the address itself is never written down: what is stored is the city name, one of five coarse traffic labels (search, social, this site, other, direct) and the same truncated 90-day hash of IP address and browser string the counters already use. None of it identifies a visitor, and none of it is shown to anyone but that listing's organiser.

The weekly summary email is off until you switch it on. An organiser can ask for a short weekly email of their own listing numbers from the portal dashboard, and switch it off again in the same place.

Who can see it. Your organisation's details and its listings are visible to the other members of that organisation. A claim you file is read by the person who runs this site, in order to approve or reject it. None of it is published — the contact address on a listing is never shown on the site — and none of it is sold, shared or handed to an advertiser.

A copy of it, or the door. /organiser/account downloads everything above as a JSON file, and deletes the account — with its sign-in sessions and any organisation you were the only member of — from one form. Deletion is refused while you are the last owner of an organisation that still has listings: hand ownership over, or remove those listings, first, so nothing goes dark by accident.

your rights

Under the Personal Data Protection Act (個人資料保護法) you may request access to, correction of, and deletion of your personal data, and object to its processing. Write to us through the contact page; we answer within a month. Complaints can be lodged with the Personal Data Protection Commission.

changes

If this page changes, the date of the last update is at the top. Material changes are announced in the newsletter.