What we record, and what we don't.

If you only visit

We count page views ourselves. No cookie is set for this, and no outside analytics service is used. For each counted view of a public page we keep:

• the date, and the address of the page (without anything after a "?");
• your country, as two letters, as reported by our hosting provider;
• the site that linked you here, as a host name only (for example "reddit.com");
• any tags on the link you followed: ref or utm_source, and utm_medium, utm_campaign and utm_content. Whoever posted the link chooses these, usually to say where it was posted;
• whether you are on a phone, a tablet or a computer. Only that one word is kept, not your browser's name;
• the time, and a visitor code that is good for that day only.

The visitor code is a scrambled value made from the date, your IP address and your browser's name, using a key only our server has, and then cut short. It lets us count how many different people came on a given day, and which page views in a day belong together: the organizer can see that one visitor arrived from a certain link, landed on a certain page and opened certain pages in a certain order. Because the date is part of it, your code tomorrow is unrelated to today's, so we cannot follow you from one day to the next. Your IP address and browser name are not stored.

If you only visit, nothing in these rows says who you are. That changes if you sign up for something on the same day, as the next section explains.

A view is counted only when all of these are true:

• it reached the live site, and our hosting provider reported a country for it. Local and preview copies of the site count nothing;
• it is a browser opening one of the public pages: a request for a web page that says which languages you read. Requests for anything else, such as images, form posts and private pages, are not counted;
• it is not a crawler, a script, a headless browser, a link preview or an uptime check, as far as the request shows;
• it is not a page your browser fetched ahead of time without you opening it;
• it is not from a signed-in organizer.

If you sign up or do something: how it is linked to your visit

When you do any of the things listed below, we record that it happened, with the time, your country as two letters, and the same one-day visitor code your page views carry. The things are: signing in with GitHub, passing or not passing the builder checks, joining as a builder, joining or leaving the email list, pledging, posting an idea, hearting an idea, applying to the review panel, offering to help organize, and sending a sponsor inquiry.

Because the code is the same, the organizer can see, next to your account or your email address, the pages you viewed that day from the same browser and network, before and after: the link you arrived from and any tags on it, the page you landed on, each page you opened and when, your country, and whether you were on a phone, a tablet or a computer. He uses this to learn which posts and pages bring people who join.

• No cookie and no browser storage is used for this. It works only through the one-day code.
• It reaches no further than that day. Visits on other days, or the same day from another browser or network, cannot be tied to you.
• Only the organizer sees it, on his private page. It is never shown on the site, sold or shared.
• The record of an action holds a reference to your account, or to the list entry, inquiry, pledge or idea it was about. It does not hold your email address, your IP address, your browser's name, or anything you typed.
• A visit by a signed-in organizer is not recorded, and neither is anything away from the live site.
• If you press the unsubscribe button your mail app shows, the request comes from the mail app, so it is recorded without a visitor code and tied to no page views.

This began on November 12, 2026. Sign-ups before then are not linked to any page views, because nothing recorded the link at the time.

If you heart an idea

We set one cookie, apw_visitor, holding a random id, so that a browser can heart each idea once. It lasts a year, cannot be read by scripts on the page, and is not linked to a name or an account. We store that id next to the idea you hearted. The heart is also recorded as something done during your visit, as described above; if you signed up for something on the same day from the same browser, the organizer can see both in that visit.

If you join the email list

The email list is how we tell people when something real happens. You are on it if you typed your address into the join page, or if you signed in with GitHub (see below). We store the address, how it got there, your country as two letters, and the date. The address is seen by the organizer and never shown on the site.

An address typed into the join page is never linked to an account in the list itself, even if you are signed in when you type it. It is linked to that day's visit, as described above, so if you also signed in that day from the same browser the organizer can see both in the same visit. The form gives the same answer whether or not the address was already on the list, so it cannot be used to find out who is on it. We do not ask you to confirm a typed address, so someone could type yours; the first email says how it got there and how to leave.

Leaving takes two steps so that a mail scanner opening the link cannot do it for you: the link in an email opens a page that shows which address it is for, and a button there takes it off the list. Mail apps that show their own "unsubscribe" button can do it in one press. We keep the address, marked as unsubscribed, so that it is never emailed again and never added back: not by someone typing it into the form, and not by signing in with GitHub. Only the link in one of our own emails can put it back.

Limits on how often a form can be sent

To stop one connection flooding the email list or the sponsor form, each attempt is recorded as three things: which form it was, a code, and the time. The code is a scrambled value made from the date and your IP address only, with a key only our server has. It is made differently from the visitor code above, so the two cannot be matched to each other, and it is not stored with the address or the message you sent. These records are used only to count attempts, never to work out who did what. For the panel and organize forms, which need a sign-in, the record holds your account id instead. These records are deleted once they are a day old. The same table counts how many emails the site has sent in the last hour, without recording who they went to.

If you ask about sponsoring

The inquiry form needs no account. We store the company, your name, your email address, the rough amount and what it is for if you said, your message, and your country as two letters. It is emailed to the organizer and shown on his private page. It is not published, and the address is not added to the email list.

If you apply to the review panel or offer to help organize

Both need a GitHub or GitLab sign-in. We store what you wrote, your country as two letters, and the date, linked to your account. It is emailed to the organizer and shown on his private page. What you wrote is not published. When a review panel is proposed, the usernames of everyone who applied to it will be listed publicly.

If you sign in with GitHub or GitLab

• GitHub or GitLab tells us your user id, username, avatar and email address. We store the id, username and avatar. The email address is added to the email list described above; the sign-in button says so before you click. It is never shown on the site.
• Our sign-in provider, Supabase, keeps its own record of your sign-in: the profile GitHub or GitLab returned (including your name and email address), and for each session your IP address and your browser's name, with the times you signed in.
• To run the builder checks we read when your account was created and how many contributions your profile shows for the last year. For GitLab, the count comes from the activity calendar on your public profile page. We store those two facts, whether each check passed, and when it was run. The checks run again every time you sign in.
• We store your country, as two letters, from the moment you signed in.
• If you join as a builder we store which version of the rules you accepted, and when.
• Signing in sets cookies that keep you signed in. Scripts on the page cannot read them, and they are sent over a secure connection only. Signing out removes them.
• We never see your private repositories. We use the access GitHub or GitLab gives us during sign-in, to run the checks, and do not save it in our database.

What you choose to make public

• If you join as a builder: your username and avatar on the builders list, plus an X handle and a site address if you give them.
• If you post an idea: the idea, with your username. While you type the idea's name, and again when you post it, our server sends that name to GitHub's search to find existing projects. GitHub sees the words and our server, not you.
• If you pledge: the name you choose, the amount, whether it is from you or a company, and your GitHub username. If you choose to add them: an X username and, for a company, its website. These are shown publicly once the pledge is listed. If you tick "Keep me anonymous", the public list shows only "Anonymous" and the amount; the organizer still sees who pledged.
• If you pledge: your email address, so the organizer can reach you when the pool opens. It is never shown on the site, and it does not add you to the email list.

Emails we send

• One welcome email when an address first joins the list, saying what the list is for and how to leave it.
• After that, only news about this hackathon: the dates being set, the pool opening, the results.
• A notice to the organizer each time someone sends a sponsor inquiry, a panel application or an offer to help. It contains what was sent.

Every email this site sends to the list carries that address's own unsubscribe link. The list is only ever emailed in a way that honours it: when the organizer exports the list, each row includes that link and marks the addresses that have unsubscribed.

Email is sent through Resend, which receives the address and the message in order to deliver it. The site sends at most a fixed number of emails an hour; past that, what you submitted is still saved and the organizer reads it on his private page.

Who else is involved

• The site runs on Vercel, and its database and sign-in run on Supabase. Both process requests on our behalf, and both keep their own request logs, which include IP addresses and browser names, for as long as their own policies say. We do not copy those logs anywhere.
• Email is delivered by Resend, as described above.
• Fonts are loaded from Fontshare, and avatars from GitHub, so your browser contacts those services when a page shows them.
• If a pledger added an X username, that account's picture is loaded from unavatar.io by the browser of everyone who views the pledge. The page you came from is not passed along.
• A sponsor's logo, when there is one, is loaded from the address the sponsor gave.

How long things are kept

• Records used to limit form sending: one day.
• Page-view rows: kept so that totals can be compared over time. On their own they hold nothing that identifies you.
• The record of what you did, which is what ties a day's page views to you: until you ask us to delete your account or address. When that is deleted, the record goes with it and those page views are tied to nobody.
• A pledge you replaced, or one that was hidden: kept in the database and not shown, so the organizer can see what was changed. It is deleted with the rest of your data if you ask.
• Your account, ideas, pledge, applications and email address: until you ask us to delete them.
• Hosting and sign-in logs: set by Vercel and Supabase, as above.

What we don't do

• No advertising or tracking scripts, and no outside analytics.
• No cookie or stored id for counting visits or for linking a sign-up to a visit, and no following anyone from one day to the next.
• No selling or sharing of anything above. Sponsors see totals, such as visitors and builders by country, never a list of people.
• No email about anything other than this hackathon.

Removing your data

Email privacy@antipaywall.org from the address on your GitHub or GitLab account, or tell us your username, and we will delete your account, ideas, pledges, panel application and offer to help, along with the record of what you did. To leave the email list, use the link in any of our emails. To have an address or a sponsor inquiry erased entirely, email from that address and we will delete it and the record of it. Once that record is gone, nothing ties any page view to you: the page-view rows that remain hold a date, a page, a country, a device kind and a code that cannot be turned back into an address.