Privacy Policy

When you create an account and use the platform, we collect:

• Name and email address — required for account creation and communications
• Phone number — required for account creation and event communications
• Country of residence — required during account setup, used for participant statistics and event logistics
• Session data — IP address and browser user agent, stored temporarily to maintain your login session
• Hashed password — stored securely for email/password accounts; we never store your password in plain text. OAuth users (Google or GitHub) have no password stored.
• Check-in code — a unique alphanumeric code generated when your account is created, used as a backup identifier for on-site event check-in

When you apply to a hackathon, we additionally collect the following as part of your application:

• MLH registration details — first and last name, age, school, current level of study, phone number and country of residence, which Major League Hacking requires of every member event (see section 11). We ask for your age, not your date of birth.
• MLH choices — whether you accepted the MLH Code of Conduct and the sharing of your registration information with MLH, whether you opted in to emails from MLH and DEV, and which version of that wording you accepted and when
• Professional background — current role, years of experience, applicant type (student / professional / etc.), and organisation or institution
• Profile links — LinkedIn and GitHub profile URLs
• Builder profile — a link to and description of your best recent project, and a list of your technical skills
• Motivation — free-text answer explaining why you want to participate and which challenges interest you
• Team preferences — whether you want to join or form a team or participate solo
• Logistics — in-person attendance, whether you are travelling from abroad, whether you need a visa invitation letter
• Dietary requirements — used solely for catering purposes
• Recruiting consent — whether you consent to sponsors viewing your profile for recruiting purposes
• Custom application questions — per-event questions configured by the event organisers, if any; answers are stored alongside your application
• Event registrations — which hackathons you have registered for and your registration status

When you connect your Discord account for team verification, we additionally collect:

• Discord username — your unique Discord handle, stored on your account and used across all events
• Discord user ID — your unique Discord account identifier, used to verify server membership

When you participate in a hackathon, we additionally collect:

• Project submissions — project name, description, URLs, technologies used, team member names, schools, AI tools used, and any files you choose to upload to our file storage: a pitch deck (PDF or PowerPoint), up to five supporting documents, and a demo video
• Challenge entry details — the selected challenge, its Challenge Partner, the names of the participant or team members who created the submission, and for each of them the date, version and IP model (ownership transfer or licence) of the Challenge Partner terms they accepted
• Votes — your pairwise votes between submissions (used to calculate ELO rankings)

We process your personal data on the following legal bases under GDPR:

• Contract performance — to provide you with access to the platform and hackathon services
• Legitimate interests — to operate and improve the platform, manage events, and ensure fair voting
• Legal obligation — to comply with applicable Finnish and EU law

We do not sell your personal data or share it with third parties for marketing purposes, except where you have explicitly consented to your profile being shared with event partners for recruiting purposes, or to your registration information being shared with Major League Hacking (section 11).

• To create and manage your account
• To evaluate hackathon applications and manage participant admission
• To send event confirmations and platform-related communications
• To display leaderboards and results within the platform
• To export participant and submission data for hackathon administration (admin only)
• To deliver participant names and challenge submission materials to the relevant Challenge Partner when you enter its challenge
• To share your profile with event sponsors for recruiting purposes, if you have consented to this
• To contact prize winners and coordinate event logistics

We retain your account data for as long as your account is active. Session data (IP address, user agent) is stored only for the duration of your active login session. If you request deletion of your account, your personal data is removed from our systems, except where retention is required by law.

Two records have their own, shorter limits:

• Sent email — the queue we use to deliver transactional email keeps a record of each message so that a failed delivery can be retried. The message body is deleted as soon as the message is sent, and the record itself is deleted 30 days later.
• Failed sign-in attempts — to protect accounts against password guessing we count consecutive failures. The record is keyed to a one-way hash and contains no email address or IP address. It is deleted as soon as you sign in successfully, and otherwise cleared automatically once it can no longer affect a sign-in.

One record outlives your account, and we think you should know why. We keep a security audit log of administrative actions — who changed a role, who exported data, who deleted an account. If your account is deleted, the entries you caused are detached from you, and the log keeps no name, email address or other identifier for you. What remains is the action itself, so an organiser can still answer “what happened to this account?” without being able to tell whose it was.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Passwords are stored using secure hashing. The platform is served over HTTPS.

As an EU resident, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your personal data (“right to be forgotten”)
• Restriction — request that we limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

You may choose to sign in using your Google or GitHub account. When you do, we receive the following data from those providers:

• Name and email address — used to create or match your Since AI account
• Profile picture URL — optionally provided by the OAuth provider

We do not receive your password from Google or GitHub. Your use of those services is also subject to their respective privacy policies: policies.google.com/privacy and docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.

When you connect your Discord account for team participation, we authenticate via Discord's OAuth2 service. We receive your Discord username and user ID. If the event requires membership in a specific Discord server, our bot will automatically add you to that server using the access token obtained during the OAuth flow. Your use of Discord is subject to Discord's privacy policy at discord.com/privacy.

We use Google Analytics (provided by Google LLC) to understand how visitors use the platform. Google Analytics collects anonymised usage data including pages visited, session duration, device type, and approximate location (country/city level). This data is used solely to improve the platform — we do not use it for advertising or share it with third parties.

Google Analytics uses cookies — small text files stored in your browser — to distinguish visitors and track sessions across page views. These cookies are only set after you explicitly accept analytics cookies.

You can accept or decline analytics cookies at any time using the banner shown on your first visit, or by clicking Manage cookie preferences. If you decline, no analytics cookies are set and no data is sent to Google Analytics.

For more information on how Google processes this data, see policies.google.com/privacy.

The platform uses the following third-party services that may process personal data on our behalf:

• Hetzner — cloud infrastructure provider hosting the platform and database
• Resend — transactional email delivery service used to send registration confirmations and event communications. Emails are sent from [email protected].
• Cloudflare Turnstile — CAPTCHA service used on the sign-up, bug report, and incident report forms to prevent automated abuse. Turnstile processes your browser and network signals to verify you are human; no personal data is stored by Since AI as a result of this check.
• Backblaze B2 — cloud object storage used to store the files uploaded with project submissions: pitch decks, supporting documents and demo videos. Files are stored in Backblaze's EU Central region. Files are uploaded from your browser directly to this service and are not readable without a short-lived link we issue to you, your team, the judges assigned to your challenge, and organisers. Only files you explicitly upload are sent to this service.
• Google Analytics — analytics service used to understand how visitors use the platform. Only active if you have accepted analytics cookies. See section 8 for details.
• Sentry — error diagnostics, used only when the platform is configured with a Sentry project. It receives the error message, a truncated stack trace and the page path. It does not receive your name, email address, cookies, request bodies or query strings; where an error can be tied to a signed-in account, only the account identifier is sent.

All third-party processors are bound by data processing agreements and may not use your data for their own purposes. We do not use third-party advertising services.

If you enter a challenge set by a Challenge Partner, Since AI will share the names of the participant or team members who created the submission and the materials submitted to that challenge with the relevant Challenge Partner. These materials may include project descriptions, code-repository and demo links, documentation, presentation materials, and any pitch deck, supporting documents or demo video you uploaded.

The purpose of this disclosure is to administer and evaluate the challenge, deliver the challenge Outputs to the relevant Challenge Partner, and enable the Challenge Partner to exercise the rights granted under section 5 of the Terms of Service. The legal basis is performance of the participation contract under Article 6(1)(b) GDPR. This disclosure applies only when you choose to enter a Challenge Partner's challenge; you may participate in the event without doing so.

Since AI Hackathon is a Major League Hacking (MLH) Member Event. MLH requires every member event to collect a standard set of registration details and three checkboxes. The application form shows them in MLH's exact wording.

• MLH Code of Conduct (required): you agree to the MLH Code of Conduct, which applies at the event alongside our own.
• Event logistics information (required): you authorize us to share your application/registration information with MLH for event administration, ranking, and MLH/DEV administration, including the creation of linked accounts on MLH and DEV (dev.to), and you agree to the MLH Contest Terms and Conditions and the MLH Privacy Policy.
• Communication from MLH (optional, off unless you tick it): you authorize MLH and DEV to send you occasional emails about relevant events, career opportunities and community announcements.

What is shared: your first and last name, age, email address, phone number, school, current level of study, country of residence, your answers to the three checkboxes, and your registration status. After the event we also share whether you checked in, and for project submissions the project details and each team member's name, email address and school. We share nothing about anyone who has not accepted the current wording of both required checkboxes.

Why and on what basis: MLH uses this data to administer and rank the event and to provide its benefits, such as prizes. The legal basis is your consent (Article 6(1)(a) GDPR), given with the checkboxes. MLH is based in the United States, so this data is transferred outside the EU/EEA. MLH processes it as a separate controller under its own privacy policy. You can withdraw your consent at any time by contacting us. This does not affect data already shared, which MLH handles under its own privacy policy.

How: only organisers with administrator access can export this data, and every export is logged. We send it to MLH through a secure channel.

We may update this policy from time to time. We will notify users of significant changes and update the date at the top of this page. Where required, we will provide an additional notice or ask you to acknowledge the change before the affected processing occurs.

This policy is governed by Finnish law and the EU General Data Protection Regulation (GDPR). Any disputes shall be resolved in the courts of Turku, Finland. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).