Privacy Policy

This notice describes the service's baseline practices. Local laws apply according to their scope; naming a law does not claim certification, registration, or guaranteed compliance in every country.

1. Who controls your information

Try Hack My AI operates this service and is the controller or business responsible for the personal information described here. Contact us at [email protected] or at Dhaka-1230, Bangladesh..

2. Information we collect

• Account data: email address, display name, avatar, OAuth provider, user ID, and sign-in timestamps supplied by Google, GitHub, and email sign-in.
• Service data: lab progress, account preferences, terms/adult confirmation records, and optional promotional-email consent.
• Device and usage data: IP-derived region, browser/device information, pages and interactions, diagnostics, and security logs. Google Analytics and Microsoft Clarity are enabled only after permission.
• Applications to build with us: your account identity, name, U.S. city and state, optional public profile link, availability, experience, strategy, motivation, and application acknowledgments. We use these to assess your introduction and contact you about the opportunity. Application answers are encrypted in our database, restricted to authorized administrators with two-factor verification, and deleted when your account is deleted. You can also request earlier deletion using the privacy contact below.
• Optional feedback: the message, name and email you submit through Sentry, plus the lesson or lab identifier when relevant. Signed-in account details prefill the editable contact fields.
• Local browser data: theme, authentication session, pending sign-in consent, and privacy preferences.

Do not submit sensitive personal information in lab prompts, terminals, editors, community channels, or support messages.

3. Why and on what basis we process it

• Provide accounts, labs, progress, authentication, and support as necessary to perform our agreement with you.
• Protect the service, prevent abuse, debug faults, and establish legal claims based on legitimate interests or applicable legal duties.
• Maintain consent and terms records to demonstrate compliance with legal obligations.
• Run optional analytics and send promotional email only with consent, which you may withdraw without affecting prior lawful processing.

Where local law uses different lawful grounds, we apply the ground required in that jurisdiction and do not rely on consent for processing that is not optional.

4. Providers and disclosures

We disclose only what is needed to service providers: Contabo for hosting and database storage, our email provider for sign-in messages, Cloudflare for delivery and security, Google or GitHub when you choose their OAuth login, and Google Analytics and Microsoft Clarity for consented analytics, and Sentry for diagnostics and feedback you choose to submit. We may also disclose information when lawfully required, to protect rights and safety, or in a business reorganization with appropriate notice and safeguards. We do not sell personal information for money.

5. International transfers and service availability

Providers may process information outside your country. Where required, transfers must use an adequacy decision, approved contractual clauses, certification, consent that meets local standards, or another lawful mechanism. Service may be restricted where required registrations, local representation, security assessments, or data-localization arrangements have not been established, including requirements that may apply in China or Russia.

6. Retention and security

We retain account and progress data while the account is active and then only as long as needed for deletion processing, backups, fraud prevention, disputes, and legal obligations. Consent records may be kept as evidence of compliance. Retention is reviewed according to purpose, sensitivity, risk, and legal requirements. We use access controls, encrypted transport, least-privilege credentials, row-level database rules, and service-provider security controls, but no internet service can guarantee absolute security.

7. Your rights and choices

Depending on where you live, you may request access, correction, deletion, restriction, portability, withdrawal of consent, or objection; opt out of targeted advertising, sale, or sharing; limit certain sensitive-data uses; appeal a decision; and complain to your local regulator. You will not receive discriminatory treatment for exercising applicable rights. We honor browser Global Privacy Control signals for non-essential analytics.

These rights cover frameworks including GDPR/UK GDPR/Swiss law, US state privacy laws, Canada's PIPEDA and provincial laws, Brazil's LGPD, Australia's Privacy Act, New Zealand's Privacy Act, and applicable laws in Japan, South Korea, Singapore, China, Russia, and other served markets. Rights and exceptions vary by jurisdiction.

Submit a request to [email protected]. State your country and request type. We may verify identity before acting and will respond within the deadline required by applicable law. You may also contact the supervisory authority where you live.

8. Children

The service and its analytics implementations are not directed to anyone under 18. We do not knowingly create accounts for minors. Contact us if you believe a minor provided personal information so we can investigate and delete it.

9. Changes and complaints

We will post material policy changes and request fresh consent where required. Contact us first with concerns; this does not limit your right to complain to a regulator or seek another remedy.