Privacy & data storage

This page explains what is stored, where it is stored, who can see it, and how reviewer actions work. No lawyer speak, just the actual setup.

What gets stored

When you submit through the form, these fields are saved:

Field	Purpose	Visibility
Submission metadata	Timestamp and internal ID for ordering and review.	Private
Contact info	Name, email, Slack ID, phone, and Hack Club verification status.	Private
Project info	Project name, live URL, source repo URL, file size, description, and tier.	Private
Shipping info	Name, address lines, city, state, postal code, and country.	Private
Deadline	Optional deadline set by the reviewer for shipping.	Private
Shipping ID / status	Tracking number and status like “Shipped”, “In transit”, or “Delivered”.	Private
Admin note	Internal reviewer notes attached to a submission.	Admin only

Where it is stored

Submissions are stored in Cloudflare KV under keys prefixed with order:. The KV namespace is named ORDERS. Each record is a JSON object. Keys are generated from a timestamp plus a random UUID, so they are not guessable from the outside.

The admin login token is also stored in KV under the key admin_api_token. On successful login, the server sets an HttpOnly cookie named admin_token to authenticate later admin requests.

There is no external database. Everything lives in the Workers KV binding configured for this project.

Who can see it

Public visitors: cannot see any submissions. There is no public order list or public API for orders.

Logged-in admins: can see all submissions in the admin review board, including contact info, project info, and shipping info. They can also add admin notes and update shipping status.

Reviewer/training role: not yet implemented. Right now, admin access is all-or-nothing via the configured admin credentials.

How reviewers handle submissions

Reviewers check each submission by hand against the rules. They can:

Mark a submission as accepted or not.
Add a private admin note with context for shipping.
Set a deadline by which the project should be ready to ship.
Update shipping ID and status once the parcel is mailed.
Cancel an order if needed.
Delete a cancelled order record.

Reviewer actions are not exposed publicly. Only admins can see and change submission state.

Data retention

Order records do not expire unless explicitly deleted. The admin token and order records are written without TTL so they persist until manually removed.

Rate-limit keys still expire after 1 hour as part of normal abuse prevention.

Contact

If you want your data removed, or have questions about how it is handled, ask @sami9889 in #ship on Hack Club Slack.