the important bits
1. we only collect what we actually need.
that’s your name, email, a hashed password (we can’t see it), and your school status (just for stats).
we also get normal logs from the server + cloudflare.
teams are made by users.
everything lives on a bare metal ovhcloud server in france.
2. we don’t sell your data or do anything sketchy.
your info stays with the flagforge organizers.
challenge files might live on github or catbox.moe, but we never upload personal data there.
3. you can ask us to delete your data any time.
just email support@hackathons.pt and we’ll sort it out.
the lawyer-talk
last updated: 2nd of december, 2025
this is how hackathons.pt handles personal data for flagforge, which runs on a ctfd instance (“server a”) on a bare metal ovhcloud box in france.
hackathons.pt is fiscally sponsored by the hack foundation (d.b.a. hack club), a 501(c)(3) nonprofit (ein: 81-2908499).
information we collect
when you make an account for flagforge, we collect:
- name
- password (hashed, never plain text)
- school status (just for analytics + aggregated stats; doesn’t affect who can play)
teams are user-created, so if you join or create one, your teammates can see your name + email.
the server, ctfd, cloudflare, and ovhcloud also log:
- ip addresses
- browser/device info
- login timestamps
- basic security/diagnostic logs
challenge images/files might be hosted on:
- github
- catbox.moe
(but again, no personal data goes there)
how we use your data
we use your info to:
- make your account work
- let you log in securely
- run the scoreboard + challenges
- generate internal stats
- share only aggregated (non-identifiable) stats with partner schools
- catch cheating or weird activity
- fix bugs or crashes
we don’t sell your data. ever.
third-party services we use
flagforge relies on:
- cloudflare (security, caching, ddos protection)
- github (challenge file hosting)
- catbox.moe (static asset hosting)
- ovhcloud (hosting the actual physical server)
these services might see things like ip addresses because that’s how the internet works.
school status
we only use school status to:
- know roughly how many players are from which school
- share non-identifiable, aggregated stats with partner schools
we never share your name, email, or performance with any school.
school status does not affect your ability to play.
where your data lives
everything is stored on server a, a bare metal ovhcloud server in france, behind cloudflare.
only authorized organizers can access it.
how long we keep your data
we keep your data:
- for the duration of flagforge
- until the next event happens on server a
when we prep the next event, we wipe the server completely.
minors
flagforge is for ages 13–18.
we try to collect as little info as possible.
you can always ask for deletion.
who can see your data
your info might be visible to:
- flagforge organizers
- cloudflare + ovhcloud (metadata only)
- your teammates (name + email)
we don’t share personal data with anyone else unless legally required.
your rights
you can:
- ask us to delete your data
- ask what data we have
- ask us to fix incorrect info
just email support@hackathons.pt.
security
we use standard protections like:
- password hashing
- https
- cloudflare firewall/ddos protection
- limited admin access
- server logs + monitoring
nothing is 100% safe, but we do our best.
changes to this policy
if we update this, we’ll update the “last updated” date.
contact
if you have questions or want your data removed:
support@hackathons.pt