Privacy Policy
Effective Date: April 11, 2026
The Hack Pack ("we", "us", "our") is a student organization at the University of Georgia dedicated to practical and competitive cybersecurity. This Privacy Policy describes how we collect, use, and protect your information when you use our website at thehackpack.org (the "Site").
1. Information We Collect
Account Information
When you create an account, we collect:
- Username and display name
- Email address
- Password (stored only as a secure hash - we never store or see your plaintext password)
Profile Information (Optional)
You may choose to provide:
- Bio, website URL, GitHub URL, LinkedIn URL
- Profile picture
- UGA email address (for official affiliation verification)
Activity Data
When you use the Site, we automatically collect:
- Challenge solve history, bookmarks, and ratings
- Competition participation and scores
- Login timestamps and account activity (e.g., password changes)
- IP addresses (for rate limiting and security - retained for up to 90 days)
Analytics Data
If you consent to analytics cookies, we use Google Analytics to collect anonymized usage data including pages visited, session duration, and general geographic region. IP addresses are anonymized before processing. You can withdraw consent at any time by clicking the cookie preferences link in the site footer.
2. How We Use Your Information
- To provide and operate the practice platform, competitions, and leaderboards
- To authenticate your identity and maintain your session
- To send account-related emails (verification, password reset)
- To track your progress, points, and solve history
- To prevent abuse via rate limiting and security logging
- To improve the Site through anonymized analytics (with your consent)
3. How We Share Your Information
We do not sell your personal information. We may share limited data with:
- Google Analytics - anonymized usage data (only with your consent)
- Your mail provider - your email address is transmitted via our server's email system for verification and password reset emails
Your public profile (username, display name, bio, avatar, and links you choose to share) is visible to other authenticated users of the Site.
4. Cookies
| Cookie | Purpose | Required |
|---|---|---|
| Session cookie | Maintains your login session | Yes (strictly necessary) |
| Cookie consent preference | Remembers your analytics cookie choice | Yes (strictly necessary) |
| Google Analytics (_ga, _ga_*) | Anonymized site usage analytics | No - requires your consent |
5. Data Retention
- Account data: Retained while your account is active. You may delete your account at any time from your profile settings.
- Activity logs (IP addresses): Automatically purged after 90 days.
- Rate limiting data: Automatically purged after the rate window expires.
- Analytics data: Subject to Google Analytics retention settings (currently 14 months).
6. Your Rights
You have the right to:
- Access your data - use the "Export My Data" option on your profile page
- Delete your account and associated data - use the "Delete Account" option on your profile page
- Withdraw consent for analytics cookies at any time
- Correct your profile information via the edit profile form
7. Security
We implement security measures including password hashing, CSRF protection, rate limiting, secure session cookies, and security headers. For details on reporting security vulnerabilities, see our Security Policy.
8. Children's Privacy
The Site is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated effective date. Continued use of the Site after changes constitutes acceptance of the updated policy.
10. Contact Us
For privacy-related questions or data requests, email us at thehackpack.uga@gmail.com.