What we collect,
and what we do
with it.

Who is responsible

DASHATHON (“we”) is run by Neev Kumar and Kavin Singh, who are together the controllers of the personal data described here. DASHATHON is not an incorporated company.

Questions, requests, and complaints go to neevkumar09@gmail.com, which we both monitor. If you need a postal address in order to make a formal request or a complaint, email us and we will provide one.

What your account collects

The managed authentication service stores the identity information needed to create and protect your account, including your verified email address, sign-in method, security records, and active sessions. DASHATHON stores the reusable profile you give when you create your account: full name, an optional preferred name, city and country, time zone, age-eligibility confirmation, and account role. Your applications start prefilled from it, so the same details are asked once. We do not collect your exact birth date.

What the private team portal collects

Accepted teams receive a private code. We store only a salted hash of that code, then use it to let the team submit and update its project title, summary, team-member list, project or repository link, private demo link, and optional judging notes.

Demo recordings and demo links are never published unless the team opts in. They are visible only to Neev Kumar, Kavin Singh, and invited judges. Everything else a team submits is covered by What we may publish below.

What we may publish

Your team keeps ownership of what it makes. Taking part transfers no intellectual property, and nothing here limits what you do with your own work afterwards.

By taking part you grant DASHATHON a perpetual, worldwide, royalty-free, non-exclusive license to host, reproduce, publish, display, and adapt the material your team submits or produces for the event — including but not limited to source code and repositories, project titles and summaries, written answers, screenshots, images, photographs, and event recordings you appear in — for the purposes of running, judging, documenting, archiving, and promoting DASHATHON. We decide at our discretion whether and when to publish any of it, and we are under no obligation to publish anything. Where it is practical we credit the team.

Your demo is the exception. We never publish a team’s demo unless every confirmed member of that team opts in from the dashboard, and any member can withdraw at any time, including after results are out — which takes it back down immediately. Opting in is never required to take part or to win.

Individual member names are not published with results; a team can also keep its team name out of the public results. If something you submitted genuinely cannot be published — a client’s confidential code, for instance — email neevkumar09@gmail.com and we will sort it out with you.

What the application form collects

Everything in this list comes from you, and only from the form:

• Identity and contact — your name and email address.
• Context — your city and country, your time zone, primary role, hackathon experience, and an optional portfolio link.
• Your application — the edition you applied for, your written answer about the problem space, whether you are applying solo or with a team, and any teammate names or emails you enter.
• Access needs — optional, free text.
• Your consent record — which statements you agreed to, when, and which version of this notice was in force.

Access needs can reveal a disability or health condition. That is a special category of data, so we ask for your explicit consent before storing it, we use it only to run the event, and you can leave the field empty and still apply.

If you enter a teammate’s name or email, you are sharing someone else’s data with us. Please only do that with their agreement. We use it solely to connect your applications, and the same rights and retention below apply to them.

What the site collects automatically

• A hashed form of your IP address, to stop automated flooding of the form. We do not store the address itself — it is combined with a secret salt and hashed, the result cannot be reversed back to your IP, and it is deleted after 24 hours.
• A bot check (Cloudflare Turnstile) runs when you submit. Cloudflare processes the challenge on our behalf. Turnstile does not use tracking cookies.
• A local draft of your answers is saved in your own browser so you do not lose your work if the form closes. It never leaves your device, we cannot read it, and it is cleared when you submit. Clearing your browser data removes it.
• Aggregate page analytics, if enabled, via Cloudflare Web Analytics — which is cookieless and does not profile or track individual visitors.

We do not use advertising cookies, and we do not sell or share data with advertisers.

Why we are allowed to hold it

For your application, our legal basis is your consent, given by the checkboxes on the last step of the form. For access needs, it is your explicit consent to processing that special category of data. For the anti-abuse measures above, it is our legitimate interest in keeping the form usable and free of automated submissions.

Consent is not a condition of anything except applying, and you can withdraw it at any time — see Your rights. Withdrawing it does not affect processing that already happened while it was in force.

Who else processes it

• Cloudflare — hosts the site, stores the application database, and runs the bot check and analytics.
• Supabase — provides managed account authentication, email verification, password recovery, magic links, and Google sign-in.
• Resend — delivers your confirmation email. It receives your name, email address, application reference, and the edition you applied for.

These providers process data to operate DASHATHON. Data may be processed outside your country, including in the United States, under the safeguards those providers offer. We do not sell your data or use it to train anything.

The event is online

DASHATHON runs entirely over video calls and chat. We do not collect travel details, identity documents, dietary requirements, or anything else a physical venue would need. Live attendance is recommended rather than required; essential materials remain available through participant accounts.

How long we keep it

Applications are deleted 12 months after the event they were submitted for. Anti-abuse hashes are deleted after 24 hours. If you ask us to erase your application sooner, we do it — see below.

Your rights

You can ask for a copy of your data, correct it, have it deleted, withdraw your consent, or receive it in a portable format. Email neevkumar09@gmail.com from the address you applied with, or tell us the reference from your confirmation email. We answer within 30 days.

If you are in the UK, EU, or EEA and you think we have handled your data badly, you can complain to your national data protection authority. This notice is governed by the law of the State of Texas.

Changes

If we change how we use application data, we publish a new version here and record the version each applicant agreed to. This is version 2026-09-09.