Course Privacy Policy

This policy explains what data the HacksinCodigos online courses use when you create an account, study, pay for a course or use the AI lab assistant. For the rest of the website, the general privacy policy (in Spanish) applies.

1. Data controller

Your data is controlled by HacksinCodigos, based in Heredia, Costa Rica. Contact: administrador@hacksincodigos.com, or WhatsApp at +506 8942 8988.

2. What data we use and why

Your account: email, name and preferred language. Used to sign you in, assign courses to you and write to you about your account.
The sign-in code: stored only as a hash (never the code itself), expires after 10 minutes and is deleted the next day.
Your session: device and browser type, approximate country and a hash of your IP address (not the full address). Used to keep a single open session and to email you if someone signs in to your account from another device.
Your progress: lessons viewed, lab tasks completed, the commands you typed to complete them, review and practice exam scores, and the date of each attempt. Used so you can pick up where you left off on any device and to issue your certificate of completion.
Your purchases: the PayPal order number, course, amount, date, and the payer's name and email that PayPal reports to us, plus the date you accepted the terms. Used to grant access, send your receipt and meet accounting obligations. We never receive or store your card details: PayPal processes the charge. If you pay by SINPE Móvil or bank transfer, the receipt you send us on WhatsApp is used only to confirm the payment.
Help messages: if you use the "Help or report an error" button, your message, email, the course page and your device type reach us by email so we can reply. They are not stored in the course database.

3. The AI lab assistant

In the labs that use it, the text you write for the assistant is sent to an artificial intelligence provider (currently OpenModel, which processes the request with a third-party language model) to generate the answer. To protect your privacy:

Before anything is sent, the system checks whether the text contains ID numbers, phone numbers, cards or email addresses, and if so it is not sent.
We do not send the provider your email or name, only a hashed account identifier, and we ask it not to store the conversation.
HacksinCodigos does not store the text of your prompts or the answers: it only counts how many requests you make, to apply usage limits.

Even so, do not type personal data, passwords or confidential information into the assistant.

4. Cookies and browser storage

Session cookie (hsc_s): strictly necessary to keep you signed in. It lasts 30 days and renews while you use the courses. It is not used for advertising or to track you on other sites.
Local storage: your browser keeps a copy of your progress, lab state and some preferences (such as language or whether the menu is collapsed). It stays on your device and you can clear it from your browser settings.
Bot check: when you sign in, or ask for help without signing in, we use Cloudflare Turnstile to check that a person is writing.
If you arrive from a Google ad: we keep the click identifier that Google adds to the address (gclid) in your browser for 90 days, to know whether the ad led to a purchase. If you buy, that identifier is stored with the order and deleted after 120 days. We do not use Google cookies or Google scripts.

The courses do not use advertising cookies. To measure usage we only count events (for example, how many payments were started), without data that identifies you.

5. Who receives your data

We do not sell or rent your data. Only the providers we need to run the service receive it, each one only what is necessary:

Cloudflare: website hosting, the course database and the bot check.
PayPal: course payments, under its own terms and privacy policy.
Google (Google Ads): if you came from one of our ads and made a purchase, the click identifier, the date and the amount of the purchase, to measure the ad. Never your name or email.
Resend: delivery of the course emails (sign-in code, welcome and security alerts).
OpenModel and the provider of the language model it uses: the AI lab assistant, as described in section 3.
Zoho: our business email, where we receive your questions.
WhatsApp (Meta): if you choose to contact us or pay that way.

These providers may process data on servers outside Costa Rica, for example in the United States. We would also disclose data to an authority that requests it under the law.

6. How long we keep it

Account data and progress, for as long as the account exists. If you ask us to delete it, we delete them.
Purchase records, for the period required by Costa Rican tax and accounting rules, even if the account is deleted.
Sign-in codes, one day. Sessions, until they expire or are closed.

7. Your rights

Under Costa Rica's Law No. 8968 on the Protection of Individuals with regard to the Processing of their Personal Data, you may ask us at any time to access, correct or delete your data, or to stop using it. Write from your account email to administrador@hacksincodigos.com. We reply within the period set by law. If you believe we did not handle your request properly, you can contact Costa Rica's data protection agency (Prodhab). If you live outside Costa Rica, you also keep the rights the law of your country gives you.

8. Minors

Purchases through PayPal are for adults. If you are a minor, use the courses with the permission and supervision of a parent or guardian.

9. Security

The courses always run over HTTPS, use no passwords, store codes and session identifiers only as hashes, and email you when someone signs in from another device. No system is infallible: if you notice anything unusual in your account, let us know.

10. Changes to this policy

If we update it, we change the date above. If the change is significant, we let you know at your account email.