Privacy policy

1. Who we are

The FrontierOR Challenge portal at frontieror-challenge.com (the “Portal”) is operated by Alpha Z (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us at frontieror.competition@gmail.com or contact@frontieror.org.

2. What we collect

We only collect what we need to run the competition and the Portal.

• Account details. Your name and email address, and, if you register with a password, a salted hash of that password. We never store the password itself.
• Google sign-in. If you choose “Continue with Google”, Google sends us your name, email address and profile picture URL, together with the tokens needed to confirm your identity. We request only basic profile and email scopes. We do not read your Gmail, contacts, calendar or any other Google data, and we do not post anything to your Google account.
• Session data. When you sign in we record the IP address and browser user agent of the session so that you can recognise and revoke sessions and so we can detect abuse.
• Profile. If you add them in your settings: your affiliation, whether you are a student, in academia or in industry, and links to your LinkedIn, GitHub, Google Scholar or website.
• Team data. Team name, description, chosen track, team membership and invitations you send or receive.
• Submissions. The files your team uploads, the results of evaluating them, and any error output produced during evaluation.
• Emails. We record the email address a verification or password-reset message was sent to, and the single-use token in that message, until the token expires.
• Usage data. Through PostHog, an analytics service: the pages you visit and what you click on them, your browser, device and IP address, the approximate location derived from it, page load times, and errors the Portal hits in your browser or on our servers. When you are signed in, this is linked to your account ID, name and email address.

Besides the cookies that keep you signed in, PostHog stores a random ID in a cookie and in your browser’s local storage, so that your visits can be counted together. We do not use advertising cookies.

3. How we use it

• To create and secure your account and keep you signed in.
• To send you transactional emails: email verification, password resets and, where necessary, notices about your account or the competition.
• To manage teams and invitations.
• To evaluate submissions and rank teams.
• To publish a leaderboard. The leaderboard shows team names and scores, never participant names or email addresses.
• To find and fix errors.
• To investigate cheating, abuse or security incidents, and to enforce the terms of service.

The legal bases under the GDPR are performance of our contract with you (running the competition you registered for) and our legitimate interest in keeping the Portal secure and working well, and the competition fair. We do not sell personal data and we do not use it for marketing.

4. Who we share it with

We share personal data only with service providers that process it on our behalf:

• Google for sign-in, if you use it, and for delivering the transactional emails we send through Gmail.
• Our hosting and database providers, which store the Portal’s data and run its code.
• PostHog for analytics and error tracking. It stores the usage data described above in the United States.

Your team-mates can see your name, email address, affiliation and profile links inside the team. We may disclose data if required by law. We do not otherwise share personal data with third parties.

5. How long we keep it

We keep account, team and submission data for the duration of the competition and for a reasonable period afterwards so that results can be verified and disputes resolved. Sessions expire automatically. Verification and reset tokens are deleted when they expire. If you ask us to delete your account we remove your personal data, except where we must keep it to comply with the law or to preserve the integrity of published results.

6. Your rights

You can view and update your name from the dashboard settings, and change your password there. You may also ask us to access, correct, export or delete your personal data, or object to our processing, by emailing frontieror.competition@gmail.com or contact@frontieror.org. If you signed in with Google you can revoke the Portal’s access at any time from your Google account permissions page. If you are in the EU or UK you also have the right to lodge a complaint with your data protection authority.

7. Security

Data is transferred over HTTPS and stored in access-controlled infrastructure. Passwords are hashed. Submitted solver code is executed in an isolated sandbox with no network access. No system is perfectly secure, so please report any concern to frontieror.competition@gmail.com or contact@frontieror.org.

8. Children

The Portal is not intended for anyone under 16, and we do not knowingly collect their data.

9. Changes

We may update this policy as the competition evolves. The date at the top shows the latest version. Material changes will be announced on the Portal.