privacy policy

who we are, and how to reach us

Hackathon France (francehackathons.com) is an independent directory of hackathons in France. Its operator is the data controller — in French, the responsable du traitement — for everything described below, under the RGPD, the règlement général sur la protection des données, which is the French name for what the rest of Europe calls the GDPR. This is one of seven national editions of the same directory; each edition runs on its own server with its own database, and no personal data moves between them.

We are not going to print a company name or a postal address here that we cannot stand behind: the operating entity's details are still being settled, and inventing them would be a strange way to open a privacy policy. Everything else on this page is a description of software that is running today, and can be checked against how the site behaves.

mentions légales

French law expects the publisher of a website to say who it is. That obligation comes from the loi pour la confiance dans l’économie numérique (LCEN, loi n° 2004-575 of 21 June 2004), whose article 6-III requires an online publisher to make its identity available to the public — and a French site discharges it on a page headed Mentions légales, carrying the publisher's identity, its directeur de la publication and its host: éditeur : … · directeur de la publication : … · hébergeur : …

That page does not exist here yet, and this is the honest reason why: the operating entity is not settled, so there is nothing truthful to put on it. We would rather say that plainly than publish a legal notice with invented details on it. A mentions légales page naming the operator — and, with it, the data controller identified above — will be published as soon as those details are provided, and this policy will be updated and re-dated to point at it. Until then, everything on this page that does not depend on knowing the entity's name is complete and accurate.

cookies

This site sets no cookies. Not for analytics, not for advertising, not for preferences. That is why you have never seen a cookie banner here — there is nothing to ask you to consent to.

Browsing the site stores two small values in your own browser instead, and neither is ever sent to us:

nl_shown

Session storage. Records that the newsletter popup has already appeared, so it does not reappear while you keep the tab open. Cleared when you close the tab.

nl_subscribed

Local storage. Records that you already subscribed, so the popup stops appearing for good. Cleared whenever you clear site data.

Both hold the literal value 1. They contain no identifier and are readable only by your browser on this site.

For completeness: there is a third value, admin_api_key, which the staff-only /admin console keeps in session storage so a reviewer does not retype their key on every action. This one is sent to us — the console attaches it to every admin request as an X-API-Key header, which is how the backend tells a reviewer from a stranger. It is a credential of ours rather than information about you, it only ever exists in the browser of someone who has typed that key in, and no public page of the site sets it or reads it.

analytics

There is no Google Analytics, no tag manager, no advertising pixel and no session-recording tool on this site. No third-party analytics service of any kind is loaded. The site also ships no JavaScript bundles — the handful of small scripts it does run (the search box, the subscribe forms, the submit wizard) are written inline and talk only to this site's own API.

how we count what's popular

We do measure which listings get looked at, so we know which events are worth featuring and whether the directory is useful. This happens on our server, not in your browser: there is no tracking script, no beacon and no cookie involved.

Each listing keeps four running counters, per day: times shown in a list, times clicked from a list, times its page was opened, and times its registration link was followed. What gets stored is:

Stored

Which event, which calendar date (UTC), which of the four counters, and a count.

Not stored

Your IP address. Your browser's user-agent string. The page you came from. Any session or visitor ID. The time of day. Any free-text field.

To avoid counting the same person twice in one day, the server takes your IP address and browser user-agent, combines them, and stores a shortened one-way SHA-256 hash of the result. It also uses them, in memory, to discard traffic from bots and crawlers. The IP address and user-agent themselves are never written to disk — only the hash is kept.

Mechanically: the page-rendering process passes the hit to our own counting endpoint over the server's internal network, authenticated with a shared secret, and does not wait for the answer. Your browser is not involved and never contacts it. That is also why blocking scripts or trackers makes no difference to these counters — there is nothing in the page to block.

We want to be precise rather than flattering here: that hash is pseudonymous, not anonymous. It cannot be read back to reveal an IP address, but the same visitor produces the same hash on the same day. That is enough for us to treat it as personal information and tell you it exists, what it is for, and when it disappears. Anything older than 90 days is deleted — to be exact about the mechanism, that cleanup runs when the service restarts rather than on a timer, so a hash can outlive 90 days by however long the service has been up. The daily counters that remain afterwards are plain totals with nothing personal in them, and we keep those indefinitely.

Lawful basis: legitimate interests — knowing which listings are actually useful, using the least identifying method we could implement, with no cookie and no third party involved. You can object and ask us to stop counting you at any time, through the route above.

the newsletter

If you subscribe, here is the entire record we create:

Your email address

Lowercased and trimmed.

A timestamp

When you subscribed.

That is genuinely all of it — the database table has three columns and the third is an ID number. We do not record your IP address, your browser, or which page you subscribed from, and the three signup forms on the site all behave identically in this respect.

Your address is stored in this site's own database on our own server. It is not sent to a mailing-list provider, not shared, not sold, and not used to build a profile. If we later start sending through an email provider, that provider will be named here before any address reaches it.

Lawful basis: consent, given by entering your address. Withdraw it at any time through the submit form — we will delete the record, not merely flag it. We keep addresses until you unsubscribe.

submitting an event

The submit form collects the event's details — name, URL, description, organisation, topic tags, format, city, région, venue, street address, code postal, start and end dates, ticket name and price, prize value and description, and a link to a banner image — plus acontact email address, which is the only part that is necessarily personal data. If you buy a featured listing, we also record the PayPal order ID and the date you want the banner to start. There is no file upload anywhere in the form: the image is a link to a picture that already exists on your own page.

Event details are published on this site, which is the point of submitting them. Your contact email is not published — it is used to reach you about the listing.

Lawful basis: legitimate interests, and the steps necessary to list an event at your request. Submissions are kept as our record of what was published and why.

other companies that see something

We deliberately keep this list as short as we can, but it is not empty, and pretending otherwise would be the easiest thing in this policy to get wrong:

Google Fonts

Every page loads two typefaces from Google's font servers, so Google receives your IP address, your user-agent and the address of the page you are viewing — on every page view, before you interact with anything, and without our asking you first. This is by some distance the most significant third-party data flow on the site, and the one a French reader is most likely to care about: an IP address is personal data, and the CNIL has been among the strictest regulators in Europe about European visitors' IP addresses reaching a US-based service without a proper basis — that was the whole substance of its 2022 decisions on Google Analytics. Serving the same two fonts from our own server removes the flow completely; that is the change we want to make, and until it is made this paragraph stays here saying so.

PayPal

The /submit page loads PayPal's payment script, so PayPal receives the IP address and user-agent of everyone who opens that page, whether or not they pay, and sets its own cookies under paypal.com. No other page loads it. Payment is handled entirely on PayPal's side — we never see or store card details, only an order ID.

Bunny.net

Hosts the endpoint that receives event submissions, as described above — it sees the form's JSON and the IP address it arrives from, and nothing else. It is not involved in ordinary browsing, and no file is ever uploaded to it.

Each of these companies processes data under its own privacy policy and on its own global infrastructure. All three are US-headquartered, so where they receive your IP address that is an international transfer outside the EEA, made under whatever safeguards each of them operates — we are not in a position to audit those, and we are not going to claim we have. The honest summary is that avoiding the transfer means self-hosting the fonts (planned) and not opening /submit. Beyond these three, no third party receives anything about you.

Two more companies sit near the site without receiving anything about your browsing: the server provider that hosts it, and the DNS provider that answers the name lookup turning francehackathons.com into an address before your browser ever contacts us. A DNS answer is a name, not a page: that provider is told which domain was looked up, never which listing you read. Nothing else sits in between — the site is not behind a proxy or content network on the page-serving path, so no such intermediary sees your page views either.

links out to organisers

Registration links go through a /go/ address on this site. That step adds one to the "registration link followed" counter described above and then immediately forwards you to the organiser's own page — usually on Eventbrite, Devpost, Luma or Meetup, sometimes the organiser's own site. It stores nothing else. The links are marked so that the destination is not told which page you came from.

Once you land on an organiser's site — or any other site we link to — you are covered by their privacy policy, not ours. Banner images on the listings we collect ourselves are downloaded and served from our own domain rather than hotlinked, so viewing one of those listings does not announce you to the organiser. The exception is an event submitted through our form with an image hosted elsewhere: that stays a link, and your browser fetches it from whichever server it lives on, the same as any image on any web page. Every listing here today is in the first category.

logs

The application itself keeps no visitor log files: no access log, no request log, no record of which pages you viewed. As with any website, the web server and network provider in front of it may hold short-lived operational logs for security and reliability.

how long we keep things

Newsletter address

Until you ask to be removed. There is no expiry — we would rather hold an address you still want on the list than quietly drop it.

Event submission

Kept after it is processed, as the record of what was published and why, including a rejected one. Deleted on request; nothing purges it automatically.

Counting hash

90 days — see the note above about the cleanup running at restart rather than on a timer.

Daily counters

Indefinitely. They are plain totals per event per day with nothing personal in them.

your rights

Under the RGPD (the GDPR, introduced by its French name at the top of this page) and the French loi n° 78-17 Informatique et Libertés, you have the right to:

• Access — get a copy of what we hold about you, and be told what we do with it.
• Rectification — have anything inaccurate corrected.
• Erasure — have it deleted. For the newsletter this is unconditional: we delete the row rather than flag it.
• Restriction — have us hold data without using it while a dispute about it is resolved.
• Portability — receive what you gave us in a machine-readable form. In practice that is your email address and, if you submitted an event, the submission JSON.
• Objection — object to processing based on our legitimate interests, which here means the view and click counting.

You may also withdraw consent for the newsletter at any time, which does not affect anything done before you withdrew it. We do not carry out automated decision-making or profiling. We do not sell personal information to anyone, and we have never disclosed any of it for money or for anyone else’s advertising.

What each of those means concretely, given how little there is:

• Your newsletter subscription — we can confirm whether an address is on the list, export it, and delete it.
• An event submission — we can send you what was submitted, correct it, or remove it.
• The 90-day counting hash — it is not searchable by name or email, so we cannot single yours out to show you or delete only yours; it expires on the schedule described above, and you can object to the counting entirely.

Ask through the submit form — that is the working route while there is no published address. There is no charge, we do not require a particular form of words, we will not treat you differently for asking, and we aim to answer well inside the one month the RGPD allows. We honour these rights for everyone who asks, wherever they live.

If you think we have handled your data badly, tell us first — we would rather put it right than have you take it elsewhere. But you also have the right to complain to a supervisory authority, and you can do that without coming to us at all. France has exactly one, which makes this simpler than it is in some member states: the Commission nationale de l’informatique et des libertés (CNIL, cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. It takes complaints online, and you do not need a lawyer or a particular form of words.

The CNIL is the authority we expect to be answerable to, on the basis that this edition is aimed at France. We have stopped short of writing that it is formally our lead authority, because which one is competent follows from where the operator is established — and that is exactly the detail this page cannot yet state, for the reason given under mentions légales above. It will be confirmed here once the entity is settled.

None of which stops you complaining in the meantime. Take it to the CNIL; or, if you live or work in another EU member state, to that country's own supervisory authority, which is equally entitled to receive it. Working out which authority is technically competent is their job, not yours — they pass cases between themselves, and you do not lose anything by starting at the wrong one.

children

This is a listings site for public events and is not directed at children. The RGPD lets each member state fix the age at which a young person can consent to an online service on their own somewhere between 13 and 16, and France set it at 15 — so the French threshold is 15, not the Regulation’s default of 16, and certainly not the 13 that American sites use. We do not knowingly collect data from anyone younger, and if you are under 15 please do not subscribe to the newsletter or submit an event without a parent or guardian. Some listed hackathons are student or school events with their own age rules — those are set by the organiser, not by us.

changes

This policy describes the site as it works on the date shown at the top. If what the site does changes — a mailing provider, self-hosted fonts, a different submission endpoint — this page gets updated to match, and the date changes with it. We make no claim to hold any privacy certification or third-party audit; this is a plain description of the system, and you are welcome to ask us about any part of it.