Privacy Policy

Last updated: 29 October 2026

This policy explains what personal data Hacker Blueprint ("we", "us") collects when you use hackerblueprint.com (the "Site"), how we use it, who we share it with, and what rights you have. We keep it as short and honest as we can.

Hacker Blueprint is the controller of the personal data described here. Contact: hacking.academy@protonmail.com.

1. The short version

• The Site has no user accounts. Your Academy account lives on Whop; your purchases of notes and labs happen on Buy Me a Coffee. Those companies are separate controllers of the data they collect at checkout.
• We collect personal data only when you send it to us through a form (newsletter, support, business or schools enquiry), or when you accept analytics cookies.
• We count visits, clicks and sales to see which videos and posts bring people here. Those counts don't include your name, email or IP address (section 2.2).
• We do not sell your personal data and we do not use it for advertising networks.
• You can ask us what we hold about you, ask us to fix or delete it, or object to how we use it, by emailing us.

2. What we collect and why

2.1 Forms you fill in

Every form is protected by Cloudflare Turnstile, which checks that you are not a bot. Turnstile processes your IP address and some browser characteristics for that check under Cloudflare's privacy policy.

Form submissions are delivered to our mailbox by Brevo (our email provider) and, for the newsletter, stored as a contact in Brevo. We do not enrich, score or profile you.

Marketing emails. If you tick the opt-in box on a sign-up form, we add you to the topics you chose in Brevo and send you a welcome email. After that you get product news, new releases, offers and discount codes. We do not sell, rent or share your address with anyone else, and we do not send you other companies' advertising. Every email has an unsubscribe link that takes effect immediately. You can also email us and we will remove you. Unsubscribing does not delete the record that you were subscribed and then opted out; we keep that so we do not email you again by mistake.

2.2 Data collected automatically

Server logs and security. The Site is hosted on Cloudflare Pages. Cloudflare processes your IP address, request headers and similar technical data to deliver the pages and to block attacks. We do not receive individual visitor logs from Cloudflare.

Analytics and session replay. We load Microsoft Clarity when you visit the Site. Clarity records how visitors move around the Site (clicks, scrolling, page paths, screen size, browser and country derived from IP) and can replay anonymised sessions so that we can improve the Site. Clarity masks text you type into forms. It sets the cookies listed in section 5.3. Microsoft processes this data under its own terms and privacy statement. We use Clarity's aggregate reports; we do not try to identify individual visitors.

Checkout attribution. We also load a small script from Whop that records that a visit to our Site led to a checkout on Whop. It helps us see which pages lead to sign-ups. It does not give us your name or payment details.

You can stop both scripts from your browser. Blocking cookies for this site, opting out of Clarity at Microsoft's opt-out page, or using a content blocker on clarity.ms and t.whop.tw all work, and the Site behaves the same either way. Section 5.3 lists every cookie the two scripts set.

Our own visit and click counts. A small script of ours notes where each visit comes from, so we can tell which of our videos and posts bring people to the Site. It records the tags on the link you followed (for example utm_source=youtube), the site that sent you if your browser shares it, the page you landed on, where your first visit in the last 90 days came from, and which checkout, shop and outside links you click. Our server adds your country, which Cloudflare works out from your IP address, and whether you are on a phone or a computer. We do not store your IP address, and the script sets no cookie and gives your browser no ID. We pass the same source tags to Clarity and add them to Whop checkout links, so those reports show where a visit came from too. Section 5.3 lists the two browser storage items the script uses, and section 5.1 explains how to turn it off.

Purchase notices. When someone buys on Whop or Buy Me a Coffee, starts a free trial, buys a coffee or joins a membership, the platform sends our server a notice. From it we keep only the product, amount, currency and time, and we link that to the most recent matching checkout click from the previous three hours. That tells us which video or post led to a sale. For the Academy we also keep Whop's membership number, so the first payment after a free trial is credited to the same click as the trial and later payments are counted as renewals. Your name, email and payment details stay with Whop or Buy Me a Coffee; we don't store them.

We rely on our legitimate interest in knowing which of our videos, posts and pages work (Art. 6(1)(f)). The counts and purchase records are stored in a Cloudflare database and deleted automatically after 24 months.

Functional storage. The Site stores a few values in your browser's local storage that are not personal data: whether you dismissed the offer pop-up, when we last nudged you about the FAQ widget, and a cached list of disposable-email domains used to validate newsletter sign-ups. Section 5.2 lists them.

2.3 Embedded content

The homepage embeds a video from Vimeo, with YouTube as a fallback. The video loads only when it comes into view (desktop) or when you press play (mobile). Blog posts with a video show our own still image of it, and the YouTube player loads only when you press play, from YouTube's privacy-enhanced address (youtube-nocookie.com). Once a player loads, Vimeo or YouTube may set their own cookies and receive your IP address under their own privacy policies. The newsletter form also fetches a public blocklist file from GitHub, which means GitHub sees your IP address when the form loads. Fonts are served by Google Fonts, which receives your IP address when the font files are requested.

2.4 Data we do not collect on the Site

We never see your card number, bank details or Whop or Buy Me a Coffee password. We do not collect special-category data (health, politics, religion and so on) and ask you not to send it to us in a message.

3. Third parties: platforms and processors

Independent controllers (they decide how they use the data they collect from you directly):

• Whop (whop.com): Academy accounts, subscriptions, payments, tax collection. Whop Privacy Policy
• Buy Me a Coffee (buymeacoffee.com): purchases of notes, labs and bundles. Buy Me a Coffee Privacy Policy
• Discord: our community server. Discord Privacy Policy
• Vimeo, YouTube (Google) and Google Fonts: embedded media and fonts, as described above.

Processors (they act on our instructions):

• Cloudflare, Inc. (hosting, CDN, Turnstile, serverless form handlers, the database for our visit and purchase counts)
• Brevo (Sendinblue SAS, France) (newsletter contacts, transactional email delivery of form submissions)
• Microsoft Corporation (Clarity analytics)
• Whop, Inc. (attribution script)
• Proton AG (Switzerland) (our mailbox, where form submissions arrive)

We share personal data only with these providers, or where the law requires it (for example a valid legal order), or to protect someone's safety or our rights.

4. International transfers

Some of these providers are outside the European Economic Area, mainly in the United States. Where that is the case, the transfer relies on the safeguards the provider offers, such as the European Commission's Standard Contractual Clauses or certification under the EU-US Data Privacy Framework. Each provider's privacy policy, linked above, explains the mechanism it uses.

5. Cookies and browser storage

This section lists every cookie and every piece of browser storage that hackerblueprint.com uses.

5.1 How to control them

The analytics and attribution items in section 5.3 load when you visit. There is no on-site cookie banner, so the controls available to you are the ones in your own browser:

• Block or delete cookies for this site in your browser settings. Section 5.5 links to the instructions for Chrome, Firefox, Safari and Edge.
• Opt out of Microsoft Clarity across every site that uses it at Microsoft's opt-out page.
• Use a content blocker. Blocking clarity.ms and t.whop.tw stops both scripts. The Site works exactly the same with them blocked.
• Turn off our own visit counter by opening hackerblueprint.com/?notrack=1 once. It stays off in that browser until you clear site data or open hackerblueprint.com/?notrack=0.

The storage items in section 5.2 are set by the Site itself, are needed for it to work, and do not track you.

5.2 Strictly necessary

These are needed for the Site to work and do not require consent.

None of the local storage items above identify you.

5.3 Analytics and attribution

Source for the Clarity list: Microsoft Clarity cookie documentation.

5.4 Third-party embeds

These only load in specific situations and set cookies under their owner's policies:

Whop, Buy Me a Coffee and Discord are separate websites. Their cookies are set when you visit them, not here.

5.5 Controlling cookies in your browser

Every modern browser lets you view, block and delete cookies and site data. Blocking all cookies may stop the Turnstile check on our forms from working. Instructions: Chrome, Firefox, Safari, Edge.

6. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is wrong;
• delete your data ("right to be forgotten");
• restrict or object to processing, including objecting to processing based on legitimate interest;
• port data you gave us to another provider in a machine-readable format;
• withdraw consent at any time (this does not affect processing that already happened);
• complain to a supervisory authority.

To use any of these rights, email hacking.academy@protonmail.com from the address you used with us, or tell us which address you used. We will reply within one month. We may ask you to confirm your identity where the request concerns data that we cannot link to your email alone. There is no charge unless a request is clearly unfounded or excessive.

For Academy account data, purchase history and payment details, please also contact Whop or Buy Me a Coffee directly, as they hold that data.

If you are in the EU or EEA you can complain to the data protection authority in your country; a list is at edpb.europa.eu. In the UK, the authority is the Information Commissioner's Office. If you are a California resident, you have similar rights under the CCPA/CPRA, including the right to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined in California law.

7. Children

The Site and the Services are for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, email us and we will delete it.

8. Security

The Site is served over HTTPS only. Form submissions travel encrypted to Cloudflare and then to Brevo and our mailbox. Our provider accounts are protected with strong, unique passwords and two-factor authentication. No system is perfectly secure; if we ever learn of a breach affecting your data we will tell you and the relevant authority as the law requires.

9. Changes

We will update this policy when our practices change. The date at the top tells you when. For significant changes we will post a notice on the Site.

10. Contact

hacking.academy@protonmail.com