Core principles:
- We will never sell your data to third parties.
- We only share your personal data when you ask us to and give us explicit permission.
- (this looks like clicking "Continue" on a consent screen or third-party app authorization)
The only exceptions to the above are:
- We may share your data with law enforcement if required by law.
- (if we were served with a valid legal process, like a subpoena or court order, for example)
Some guarantees specifically about ID documents:
(Only relevant if you're submitting a student verification)
Immediately after upload
Access is limited to a small number of Hack Club/HCB team members who have all signed comprehensive NDAs. They can view your identity document solely for verification purposes.
After review
Access is limited to core Hack Club HQ staff and only in exceptional circumstances
Right now, only the following people have access to historical documents:
- Nora (@nora) – Platform creator, full-time HQ staff
- Zach (@zrl) – Hack Club founder & executive director
- Leo (@Leo) – Event operations & identity team lead
This "break-the-glass" access is reserved exclusively for exceptional cases such as fraud investigation. Every instance is logged in an audit trail and requires specific written justification.
Your data is stored on a server separate from the rest of Hack Club's infrastructure. See the Security page for more technical details.
Data Retention
Right now, we retain identity documents in encrypted, restricted-access form to support fraud prevention and investigation.
As a nonprofit, we unfortunately face a small but persistent group of individuals attempting to defraud our programs. Historically, our identity verification system has been key to protecting resources intended for teenagers.
Only three individuals can access historical documents, and only in extreme cases with full audit logging. If you're not comfortable with this tradeoff, we understand - but we won't be able to offer you resources through our YSWS grant programs. No hard feelings.
Slack Integration
TODO: For Slack SAML: We will never read your DMs.