HACKUP
Login

Privacy Policy

Last updated: March 28, 2026

HACKUP ("we", "us", "our") is a learn-to-code platform operated by Arthur Joubin. This privacy policy explains what data we collect, how we use it, and your rights regarding that data.

1. Data We Collect

Account information

When you sign up or log in via Google OAuth, we receive and store:

  • Your email address
  • Your display name
  • Your Google profile avatar URL

Learning progress

As you use HACKUP, we store your:

  • Experience points (XP) and level
  • Completed lessons and exercises
  • Module and lab progress
  • Daily streak data

Code submissions

When you use AI-powered features (code validation, chat tutor, hints), the code and messages you submit are sent to our backend and forwarded to a third-party AI provider for processing. We do not permanently store the content of these submissions on our servers - they are processed in real time and discarded.

Technical data

Cloudflare, our hosting provider, may automatically collect standard connection data (IP address, browser type, request timestamps) as part of its infrastructure. We do not operate any first-party analytics or tracking tools.

2. How We Use Your Data

  • Authentication: To create and manage your account.
  • Learning experience: To track your progress, calculate XP, maintain streaks, and display leaderboard rankings.
  • AI features: To validate your code, provide hints, and power the chat tutor by sending your inputs to the DeepSeek API.
  • Service operation: To maintain, secure, and improve the platform.

We do not sell your data. We do not use your data for advertising.

3. Third-Party Services

HACKUP relies on the following third-party services that may process your data:

Google (Authentication)

We use Google OAuth 2.0 for login. When you authenticate, Google shares your basic profile information (name, email, avatar) with us. Google's handling of your data is governed by Google's Privacy Policy.

DeepSeek (AI Processing)

Code you submit for validation, chat messages, and hint requests are sent to the DeepSeek API for processing. DeepSeek may process this data according to their own privacy policy. We recommend not including personal or sensitive information in your code submissions.

Cloudflare (Hosting & Infrastructure)

Our frontend is hosted on Cloudflare Pages, our API runs on Cloudflare Workers, and our database is Cloudflare D1 (SQLite). All data in transit is encrypted via HTTPS. Cloudflare may process connection metadata (IP addresses, request headers) as part of its CDN and security services. See Cloudflare's Privacy Policy.

Stripe (Payments)

If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store your credit card number or full payment details. Stripe receives your email address and payment information directly. See Stripe's Privacy Policy.

4. Cookies

We use a single session cookie to keep you logged in. This cookie is:

  • HttpOnly: not accessible to JavaScript, protecting against XSS attacks
  • Secure: only transmitted over HTTPS
  • SameSite=Lax: provides CSRF protection
  • 30-day expiry: automatically expires after 30 days of inactivity

We do not use third-party tracking cookies, advertising cookies, or any analytics cookies.

5. Data Retention

Your account data and learning progress are retained for as long as your account exists. AI interactions (code validation, chat, hints) are processed in real time and are not stored on our servers after the response is delivered.

If you delete your account, all associated data (profile information, progress, session data) will be permanently removed from our database.

6. Data Security

All data in transit is encrypted with TLS/HTTPS. Passwords (for email-based accounts) are hashed using SHA-256 with a unique salt before storage. Session tokens are random and stored as HttpOnly cookies. Our database is hosted on Cloudflare's infrastructure with their security protections.

7. Your Rights

Under applicable data protection laws (including the EU GDPR), you have the right to:

  • Access your personal data - you can view your profile and progress in your account settings.
  • Rectify inaccurate data - contact us to correct any information.
  • Delete your account and all associated data - contact us at the email below.
  • Export your data - contact us to request a copy of your data.
  • Object to processing - contact us if you have concerns about how your data is used.

We will respond to any data rights request within 30 days.

8. Children's Privacy

HACKUP is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child under 16 has created an account, please contact us and we will delete it.

9. Changes to This Policy

We may update this privacy policy as the platform evolves. Significant changes will be communicated via a notice on the platform. Continued use of HACKUP after changes constitutes acceptance of the updated policy.

10. Contact

For any questions about this privacy policy or to exercise your data rights, contact:

Arthur Joubin
Email: arthurjoubin@gmail.com