How Vibe Forge collects, uses, shares and protects your personal data — and how to exercise your rights.
Who we are
Vibe Forge is a free online coding contest. The organizer is responsible for your personal data. Until the organizer's legal identity and privacy contact are published in the contact details on this page, they are to be announced; you can reach us through the contact e-mail shown below.
What we collect and why
Account details — your name and e-mail address, and, if you sign in with Google, the basic profile information Google shares (name, e-mail, profile identifier). Purpose: to create and secure your account and contact you about your entry.
Age group — whether you are 13–17 or 18+, and, for under-18s, a record that a parent or guardian agreed. We do not ask for your date of birth. Purpose: to check eligibility and apply the safeguards required for minors.
Contact mobile number — one number per entry (the team leader's for teams). Purpose: to reach you about your entry if e-mail fails. It is visible only to authorized administrators and is never used for advertising or unsolicited promotions.
Team details — your team name and your teammates' names. We do not collect teammates' e-mail addresses or numbers.
Your entry — category, idea, project details, links, the tools you used and your video pitch (which shows your image and voice if you appear in it).
Account actions and security logs — records of important actions (for example "submission made") containing ids and codes, not your messages; and short-lived, pseudonymized (hashed) IP addresses for rate limiting.
E-mail delivery records — which service e-mails were queued and sent to you. Message bodies are deleted once delivered.
Optional marketing consent — only if you tick the separate, unticked box. You can withdraw it at any time in your account.
Legal basis and consent
We process your data to run the contest you asked to join (performance of the contest terms), to meet legal obligations, and — for optional marketing — with your consent. For participants under 18, we rely on the consent of a parent or guardian. Today this is a declaration made in the registration form; it does not by itself verify the guardian's identity, and we will request verifiable parental consent before any processing that requires it under the law that applies to you (including India's Digital Personal Data Protection framework and the US Children's Online Privacy Protection Rule where applicable). We do not track, profile or target advertising at children.
Who processes your data
We use these service providers ("processors") to run the platform. They process data only on our instructions:
Supabase — database and authentication (accounts, registrations, projects, judging).
Vercel — hosts the website and processes requests (standard server logs).
Cloudflare R2 — stores uploaded video pitches privately, when video uploads are enabled.
Google — Google sign-in (if you choose it); the Gmail API, which sends our service e-mails from the contest's own Google account; and Google Drive, which holds uploaded video pitches privately in that account when our main video storage is full. If you sign in with Google, we request only basic sign-in information — never access to your own Gmail, contacts or Drive.
Resend — sends account verification and password-reset codes (if configured by the organizer).
Cookies and browser storage
We use only necessary cookies: your sign-in session (HttpOnly, SameSite=Lax, and Secure on our live site) and short-lived cookies used while you verify your e-mail or reset your password. If a video upload is interrupted, your browser keeps a small record (an upload id, file size and a fingerprint of the file name and date — not the video or your details) so it can resume. We do not use advertising pixels, analytics trackers or third-party cookies. The "Ask the Forge" helper runs entirely in your browser. Fonts are served from our own site.
International transfers
These providers may store or process data outside your country, including in the United States, the European Union and Australia, depending on the regions the organizer selects. Where the law requires, we rely on the providers' standard contractual safeguards.
Who can see what
Public: nothing you provide at registration is published. Only if you are shortlisted or win may your project name, team or display name, category and short description be shown to announce results (see the contest rules).
Judges: only the entries assigned to them — your project details, links and video pitch, and your team or display name. Judges never see your e-mail, phone number or age group.
Administrators: the details needed to run the contest, with access recorded in the audit log.
How long we keep data
Your account and entry: until the contest ends and results are final, plus up to 12 months for complaints and appeals, unless you delete your account sooner.
Replaced video files: deleted after the retention period set by the organizer (30 days by default).
E-mail message bodies: deleted once delivered; failed messages after 30 days; delivery records after 12 months.
Rate-limit records: hours to one day.
Audit records: kept for accountability, but they no longer identify you after your account is deleted.
Your rights
You can access, correct, export and delete your data:
Access / export: Dashboard → Account → "Download my data" gives you a copy of what we hold about you.
Correction: edit your details in the dashboard, or contact us.
Deletion: Dashboard → Account → "Delete account" permanently deletes your account, registration, team details, project, submission and uploaded videos. Backups held by our database provider expire on their normal schedule (typically within days) and are not restored except to recover from a disaster.
Withdraw consent for marketing at any time in your account. For under-18s, a parent or guardian may ask us to stop processing and delete their child's data.
To make a request we cannot handle in the dashboard, or to complain, contact the privacy contact below. You may also complain to your local data-protection authority.
Security
Data is encrypted in transit (HTTPS). Access is limited by role and enforced in the database (row-level security). Passwords are hashed by our authentication provider and never stored by us. If a security incident affects your personal data, we will notify you and the relevant authorities as the law requires.
What we will never do
We do not sell your personal data.
We do not use your data for advertising or build advertising profiles.
We do not use your contact details for unsolicited promotions.
We do not publish your registration details just because you provided them.
Changes
We publish changes to this policy here as a new version, keep previous versions available, and tell participants about material changes.
Organizer identity: to be announced. A contact e-mail will be published here before registrations open.
Manage your data in Account settings — download a copy, update details, or delete your account.
