Privacy Policy

1. Introduction

HackQuest, Inc. ("the Company," "we," "us," or "our") operates gethackquest.com (the "Service"), an AI-adaptive developer training platform that grades real pull requests and builds personalised learning paths for working developers switching tech stacks. This Privacy Policy explains what personal information we collect through the Service, how we use it, who we share it with, and the choices you have.

We are based at 88 Kearny Street, Suite 1600, San Francisco, CA 94104, and can be reached at [email protected].

This Policy covers information collected through the Service and through direct communications with us. It applies to all visitors to gethackquest.com as well as registered learners who use the HackQuest platform.

2. Information We Collect

2.1 Information You Provide Directly

We collect information you submit directly, including:

• Account registration details: your name, email address, and password when you create a HackQuest account;
• Learning preferences: the tech stack you choose when registering, and any stack preferences you update later;
• Submitted code and pull requests: the code diffs, PR descriptions, and repository content you submit to HackQuest for AI grading. This is the core input the Service processes to generate feedback and lesson assignments;
• Contact and inquiry content: name, email, and message text when you contact us via the contact form or by email;
• Billing information: for paid plans, payment details processed by our third-party payment provider (we do not store full card numbers).

2.2 Information Collected Automatically

When you visit gethackquest.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5).

2.3 Learning Progress Data

As you use the Service, we generate and retain learning progress data tied to your account, including: graded PR history, concept gap records, adaptive lesson assignments, completion status, and code quality trend scores over time. This data is the basis on which the adaptive learning path is calculated and updated.

2.4 We Do Not Knowingly Collect Children's Data

gethackquest.com is intended for working developers and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it promptly.

3. How We Use Information

We use the information we collect to:

• Deliver the core Service: process submitted pull requests through the AI grading engine, identify concept gaps in the diff, and assign the next adaptive lesson;
• Maintain your learning profile: track progress over time, generate trend reports, and personalise the lesson queue to your actual error patterns rather than a fixed syllabus;
• Operate and improve the platform: diagnose technical issues, improve grading accuracy, and develop new stack support;
• Communicate with you: respond to support inquiries, send transactional notifications (grade ready, lesson assigned), and, where you have opted in, send product updates;
• Process payments: charge the applicable subscription tier and manage billing;
• Detect, investigate, and prevent abuse or fraudulent use of the Service;
• Comply with applicable legal obligations.

We do not use your submitted code or pull request content to train machine learning models without your explicit written consent. Grading operations process your code transiently for feedback generation; we do not retain code content beyond what is necessary to display your graded PR history to you.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the California section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf, such as cloud hosting infrastructure, email delivery, payment processing, and anonymised analytics, each under contractual confidentiality terms that restrict their use of data to providing services to us;
• Legal authorities, when required by law, court order, or to protect the rights, safety, or property of the Company, our users, or the public;
• A successor entity in the event of a merger, acquisition, or asset sale, where the acquiring party agrees to be bound by this Policy or one offering equivalent protection.

We do not sell personal information to third parties. We do not share your submitted code or learning data with other learners or with employers without your explicit action.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, maintain your logged-in session, remember stack preferences, and measure aggregate usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain your account and learning progress data for as long as your account is active and for a reasonable period thereafter to allow account reactivation or respond to legal obligations. If you delete your account, we remove your personal profile and learning data within 30 days, except where retention is required by law or to resolve outstanding disputes.

Contact form messages and inquiry content are retained for up to 24 months. Server access logs are retained 90 days, then aggregated and stripped of identifiers.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, access-controlled databases, and least-privilege access policies for the Company's engineering and operations team. No system is perfectly secure; we cannot guarantee absolute security, and we encourage you to use a strong, unique password for your HackQuest account.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access to, correction of, or deletion of personal information the Company holds about you, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy. Because HackQuest serves California-based developers and accepts accounts from California residents, these rights apply to you if you reside in California.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, email address, IP address); account credentials; commercial information (subscription tier, payment records); professional or employment-related information (developer role, stack experience you describe); internet or electronic network activity information (browsing on gethackquest.com, graded PR history, adaptive lesson interaction records); and inferences drawn from learning progress data to generate your personalised concept map and lesson queue.

We do not collect government-issued identifiers, precise geolocation, financial account access credentials, health data, biometric data, or other sensitive personal information categories beyond those described above.

9.2 Sources, Purposes, Disclosure

We obtain this information directly from you (at registration, through PR submissions, and via contact forms) and through automatic site instrumentation (server logs, cookies). We use it to operate and improve the Service, maintain your adaptive learning profile, communicate with you, process payments, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required. We do not sell it or share it for cross-context behavioural advertising.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new effective date at the top of this page and, where appropriate, a notice on the Service or by email to registered users.

11. Contact

Questions, requests, or complaints regarding this Policy can be sent to: