Privacy policy

This policy explains how Hacklab (“Hacklab”, “we”, “us”) handles personal data when you use hacklab.so, the Hacklab CLI, and the Hacklab assistant. Hacklab is a public network: much of what you add to your profile is meant to be seen by people and read by AI agents. We tell you below which parts are public and which stay private.

Questions or requests go to yo@hacklab.so, or by mail to Hacklab, 251 Niagara Falls Drive, Wilmington, DE 19808, United States.

What we collect

Account details

You sign in with GitHub or Google. We receive your name, email address, avatar, and username from that provider, and store the access tokens needed to keep your account linked. Tokens are encrypted at rest.

Profile details you add

Your bio, city, social links, CV (experience, education, accomplishments), and the organizations linked to it. If you connect iMessage, we store your phone number; it is never shown on your profile.

AI usage from the Hacklab CLI

When you run hacklab sync, the CLI uploads usage reports from your AI coding agents: session identifiers, token counts, estimated costs, models, timestamps, project paths, and counts of the messages you sent grouped by hour. It also uploads repository metadata: for local repositories, the path, name, branch, latest commit, and number of changed files; from GitHub, the repository details GitHub returns for repositories your account can access. A background job repeats the sync every five minutes until you uninstall it.

The CLI never uploads source code, diffs, file contents, conversation transcripts, assistant replies, or Git credentials.

Content you create

Project posts and their images, videos, and link previews; replies and likes; direct and group messages; job posts and applications; organization pages you edit; and feedback you send us.

The Hacklab assistant

When you chat with the Hacklab assistant on the web or over iMessage, we process your messages, attachments, and voice notes (which are transcribed to text) to reply. The assistant keeps a short memory of stable facts and preferences about you so later chats are more useful. It is told not to save secrets or facts about other people.

Usage and device data

We use PostHog to understand how Hacklab is used: pages viewed, features used, device and browser type, approximate location from IP address, and session replays of how you navigate the site. Our servers also keep standard request logs.

What is public

Anyone, including search engines and AI agents, can see:

• Your name, username, avatar, bio, city, and the social links you leave visible.
• Your CV and the organizations linked to it.
• Your AI usage totals by agent and model, and your activity heatmap.
• Repositories you choose to show, and their token totals only if you opt in.
• Your project posts, replies, and follower counts.

Public profiles and organization pages are listed in our sitemap and published as Markdown and structured data so that AI assistants can describe you accurately. We allow AI search and AI training crawlers to read public pages.

Always private: your email address, phone number, sign-in tokens, private repositories, local repository paths, hidden social links, messages, and assistant conversations. The full Arena leaderboard is shown only to signed-in members.

How we use your data

• To run your account, profile, Arena rankings and messages.
• To match organizations to CVs and fetch organization logos.
• To answer your requests through the assistant and iMessage.
• To keep Hacklab secure and to prevent spam and abuse.
• To understand usage and improve the product.

We do not sell your personal data, and we do not use it for third-party advertising.

Who we share data with

We use service providers that process data on our behalf:

• Vercel: hosting, file storage, and routing of AI model requests.
• Neon: database hosting.
• PostHog: product analytics and session replay.
• Sendblue: iMessage delivery, if you connect iMessage.
• AI model providers, reached through the Vercel AI Gateway: generating assistant replies and transcribing voice notes.
• GitHub and Google: sign-in and the account details you connect.

We may also disclose data when the law requires it, or as part of a merger or acquisition, in which case this policy continues to apply.

How long we keep data

We keep your data while your account is active. When you delete your account, we delete your profile, usage, repositories, and content within 30 days, except where we must keep records for legal or security reasons.

Your choices and rights

• Edit your profile, hide social links, and choose which repositories appear.
• Stop syncing with hacklab daemon uninstall, and sign the CLI out with hacklab logout.
• Revoke Hacklab’s access in your GitHub or Google settings.
• Ask us for a copy of your data, to correct it, or to delete your account, by emailing yo@hacklab.so from the address on your account.

Depending on where you live, including the EU, UK, and California, you may have additional rights to access, correct, delete, port, or object to the processing of your data, and to complain to your data protection authority. We respond to requests within 30 days. We use your data to provide the service you signed up for, on the basis of our legitimate interest in running and securing Hacklab, and with your consent where we ask for it.

Cookies and local storage

We use cookies to keep you signed in, remember your Arena view, and remember who invited you (for up to 30 days). PostHog uses cookies and local storage for analytics. We do not use advertising cookies.

International transfers

Hacklab is operated from the United States, and our providers may process data in other countries. When we transfer data out of the EU or UK, we rely on our providers’ standard contractual safeguards.

Children

Hacklab is not for children under 16, and we do not knowingly collect their data. If you think a child has an account, contact us and we will delete it.

Changes to this policy

We will update the date above when this policy changes, and tell members about significant changes in the app or by email. See also our contact page.