the stupid ideas hackathon community

1. who this policy covers

SIH is responsible for the personal information described here. This policy applies to this website, event forms and mailing lists operated by SIH, and messages sent directly to us. It does not apply to a sponsor, event platform, or other outside website after you choose to visit it. The SIH Privacy Lead is the person accountable for questions and requests under this policy.

2. information we collect

when you visit the website

We host this website with Vercel. Like most hosting providers, Vercel automatically processes limited request and diagnostic information needed to deliver and protect the site. This can include your IP address, approximate city or country derived from it, browser and device information, requested page, date and time, referring page, and security or performance records. We may have access to some of these operational logs.

when you submit an event form

Depending on the event and form, we may ask for:

your name and email address;
school, company, or other affiliation;
LinkedIn and an optional additional profile or portfolio link;
your answers to application questions;
T-shirt size and dietary restrictions;
event preferences, RSVP, whether you are local to Ottawa, and travel plans; and
uploaded files such as an optional résumé, along with your consent and sponsor-sharing choices.

When you press a form's submit button, the information and files you provided are transmitted through our server to the form, application-management, or storage provider selected for that event. Before a live form accepts submissions, its notice will identify that provider and link to the provider's privacy information. We will also update this policy when a new provider or materially different processing arrangement is introduced.

For Ottawa applications, we store your answers, consent choices, submission time, and email delivery status in a private Supabase database, with any uploaded résumé in private Supabase file storage. We use Resend to email a copy of your answers and any uploaded résumé to the address you provide, with a private copy to the SIH organizer inbox. These application emails are for event administration and do not subscribe you to a mailing list. We also send the application details and any uploaded résumé to a private organizer channel on Discord to notify the team of new applications.

when you use the participant portal

Accepted applicants can request a one-time email sign-in link. Supabase Auth verifies your identity, and Resend delivers the sign-in email. Essential, secure sign-in cookies keep you signed in; they are not used for advertising. We check your current acceptance status before showing your dashboard or saving an RSVP. Your RSVP and travel plans are stored privately with your application and used to coordinate attendance and the stupidest journey award. Short-lived hashed email and IP counters help limit sign-in email abuse.

We also record whether you will be 18 or older on the event date, your electronic signature, the versions and times of your Code of Conduct and liability-waiver acceptance, and your separate optional photo/video choice. For participants under 18, we collect the parent or legal guardian's name, email, contact phone number, relationship, signature, and consent choices on the signed form you upload. An approved organizer reviews the signed form before it is marked approved for check-in.

These records are stored privately in Supabase and used to document consent, coordinate safeguarding and check-in, and address event-related questions or claims. Automated application notifications do not send guardian contact details or signatures to Discord or sponsors. Signed parent forms are kept in private file storage, with access checked by our server for the applicant and approved organizers. You can request a copy of your signed version or withdraw optional media permission by contacting applications@stupideas.com.

when you interact with our Discord bots

When sih-inator (overlord bob), overlord rick, overlord squd, overlord sand, or overlord plank generates a reply, we send your question and up to 25 recent messages from the same Discord channel or thread, plus up to 10 earlier messages from you across server channels the bot can access, to OpenAI to generate a reply.

The bots also check messages in server channels they can access for the standalone, case-sensitive names bob or spongebob, rick or patrick, squd, sand or sandy, and plank or plankton. When one appears, we may send that message and up to 25 recent messages from the same channel or thread to OpenAI to decide whether it clearly refers to the bot and whether to reply. The bot can stay silent. These name checks do not include your messages from other channels.

When a message summons several bots, only the first one addressed can reply normally. The others add fixed emoji reactions without sending the message or conversation to OpenAI.

This context can include other participants' messages and the overlords' replies. Bob and Rick can tag each other or Krab for a short conversation in that channel, and can tag you or people mentioned in the current exchange. Bob can also search or list small pages of members in this server to identify someone to tag. Each lookup includes at most 20 members, with up to two lookups per reply. We send only their Discord IDs, usernames, display names, server nicknames, and bot status to OpenAI for that reply. We do not store or cache these directory results. If you ask for an image, we also send a short image description to OpenAI and post the generated image back to Discord. Images are not saved in our website database. When you ask Sand or Plank for rendered LaTeX or a Manim animation, we send only the generated document source or animation scene to an isolated renderer on Vercel and attach the resulting PNG preview, PDF or MP4 in Discord. Temporary render files are removed after the job. SVG and LaTeX source can also be sent directly as attachments. Bob, Rick, Squd, Sand, and Plank can also send OpenAI up to four uploaded PNG, JPEG, or WebP images per reply, up to 8 MB each, from your current message or human messages in the same channel context. A message you reply to may be fetched outside the recent window and included within the 25-message channel limit. Image attachments use temporary Discord links and are not saved in our website database. Other attachment types and images from other channels are excluded. We use temporary speaker labels to distinguish participants. We do not include other participants' messages from other channels, or private application notifications in this context. We keep message, server, and user IDs, timestamps, reply IDs, and delivery status, bot identity, conversation depth, image usage, and render usage in our private database for duplicate handling and usage limits. Metadata older than two days is removed on the next request. We also keep a server-level monthly request count until the next month. Conversation context is fetched when needed; we do not store message, question, or answer text in that database.

Overlord krab replies to direct tags and standalone, case-sensitive krab or krabs in human messages. His replies contain the word money repeated 1–32 times, or occasionally one of seven fixed money photos. Overlord gerald replies to direct tags and the standalone, case-sensitive name gerald with a random sequence of meow, miau, and mrow, between 1 and 32 words. Both bots favour shorter text replies and determine their response from the message ID, so retries produce the same response. Neither bot sends messages to OpenAI or fetches conversation history. The same private metadata tracking and usage limits apply to their replies.

Overlord squd can also ask the text model to select a short melody reference for an instrumental voice message. Requests without a matching playable score are refused. Our server plays the notes using sampled clarinet and encodes the audio locally; there is no additional audio-generation service. Song titles are searched in a locally cached public catalog. We fetch public catalog files and MIDI byte ranges from GitHub and Hugging Face using file identifiers and byte ranges, without sending your Discord messages or user IDs to those hosts. Selected score bytes and rendered clips are used temporarily to answer the request.

when you email us

Our host-an-event, sponsor, and community links also open your email app. If you send a message, we receive your email address, the message, and any other information or files you choose to include.

when you join a mailing list

We collect the email address you submit and the event list you selected. The form sends this information through our server to Resend, our mailing-list provider, which stores the address as a contact in the relevant event segment.

We do not ask for payment-card details, government identification, or precise location through this website. Please do not include unnecessary sensitive information in an application or email.

3. how we use information

We use personal information to:

review applications and select participants;
communicate about application status, event logistics, safety, accessibility requests that you choose to raise, and event updates;
plan and administer the event, including catering and any event merch;
send opening announcements and related updates for an event mailing list you chose to join;
respond to hosting, sponsorship, and community inquiries;
operate, troubleshoot, secure, and prevent misuse of the site; and
meet legal obligations and protect people, rights, and property.

We limit collection, use, and disclosure to purposes a reasonable person would consider appropriate in the circumstances. We do not use application information for unrelated marketing.

4. consent and sponsor sharing

Joining an event mailing list is optional. You may withdraw your consent and stop future messages at any time by using the unsubscribe option in an email or contacting us.

Information marked required on an event form is needed to review the submission or administer participation. You do not have to provide fields marked optional, such as an additional link or résumé.

Sponsor sharing is a separate, optional opt-in and does not affect how we assess your application. If you opt in, we may give the sponsors identified for that event your name, email, affiliation, LinkedIn or other profile link, and the résumé you uploaded so they can review your profile and contact you about recruiting or professional opportunities. We do not share your written application answers with sponsors for this purpose.

You may withdraw this consent by emailing us before we disclose the information. Withdrawal cannot reverse a disclosure already made, but we will stop new disclosures and can pass your request to a sponsor that already received the information.

5. who receives information

We may disclose personal information to:

SIH organizers who need it to review applications or run the event;
service providers that support website hosting, form delivery, application management, mailing-list delivery, file storage, communications, and security, including Vercel as our website host, Supabase for application and file storage, and Resend for application emails and mailing-list delivery, and Discord for private organizer application notifications, and OpenAI for Discord bot replies;
sponsors identified for the relevant event, only for the optional sharing described above and only if you opt in; and
authorities or other parties when reasonably necessary to comply with law, respond to legal process, protect safety, or investigate misuse.

We do not sell or rent personal information, and we do not share it for targeted advertising.

6. cookies, analytics, and outside links

The participant portal uses essential, HttpOnly sign-in cookies to maintain your session. We do not use advertising trackers, pixels, session-replay tools, or website analytics. The website serves its fonts and images from the site itself.

The website links to Google Maps, Devpost event pages, sponsors, and other outside websites. We do not send your application to those sites. If you choose a link, the destination may receive ordinary request information and may use cookies under its own privacy policy. This policy does not govern those third parties.

If we add a new tracking or cookie-based service, we will update this notice and ask for consent where required before using it.

7. storage and processing locations

SIH is based in Ontario, but our hosting, form, application-management, storage, and communications providers may process information in Canada, the United States, or other countries. Information handled outside Ontario may be subject to the laws and lawful access rules of those places. Our Ottawa application database and résumé storage are hosted in Supabase's Canada Central region. Email delivery, hosting, Discord notifications, and provider support may involve processing elsewhere. See our providers' notices for more detail: Vercel Privacy Notice, Supabase Privacy Policy, Resend Privacy Policy, and Discord Privacy Policy, and OpenAI Privacy Policy.

8. how long we keep it

We keep event submissions and uploaded files only as long as needed to review them, run the relevant event, complete necessary follow-up, and address legal or safety issues. Unless you are selected for an ongoing role, ask us to keep your materials on file, or an ongoing legal or safety matter requires them, we delete or de-identify application material within 12 months after the relevant event. You may request earlier deletion.

We keep direct correspondence only while it remains useful for the inquiry or relationship. We keep mailing-list information until you unsubscribe or the relevant updates are complete, then delete or de-identify it according to our provider settings. Hosting records are retained under our Vercel settings and Vercel's applicable service terms. Other providers retain information under our configuration and their applicable service terms. Sponsors that received information with your consent control their own copies under their privacy practices and retention requirements.

9. how we protect it

We use safeguards appropriate to the information, including encrypted website connections, access controls on organizer accounts, and limiting application access to organizers who need it. No email or online system is completely secure, so please send only what the application asks for.

10. your choices and requests

You may ask what personal information we hold about you, how we used or disclosed it, and request access, correction, or deletion. You may also withdraw consent for future optional uses. Email our Privacy Lead at stupidideashackathon@gmail.com. We may need to verify your identity before completing a request, and legal exceptions may apply. We aim to respond within 30 days.

11. children and younger participants

Our event forms are intended for participants aged 13 or older. Individual events may require permission from a parent or legal guardian for participants who have not reached the age of majority; those requirements will be stated with the event. If we learn that we collected information from a child under 13 without appropriate authorization, we will delete it.

12. changes to this policy

We may update this policy when our practices or legal requirements change. We will post the new version here and change the date above. We will ask for new consent before materially changing how we use or disclose information already collected when consent is required.

13. contact and complaints

The SIH Privacy Lead is accountable for this policy. Send questions, requests, or complaints to stupidideashackathon@gmail.com. We will investigate and explain the outcome. If PIPEDA applies and your concern is not resolved, you may contact the Office of the Privacy Commissioner of Canada.