Editing Privacy concerns and data handling at Hack Club (section)

== Debates on Data Practices ==
Internal discussions within the Hack Club Slack have highlighted privacy concerns. Community members have repeatedly questioned GDPR compliance, citing the lack of a formal privacy policy for an extended period and the indefinite retention of government-issued identification documents used for YSWS verification. In response, staff members acknowledged the complexity of GDPR for an organization of Hack Club's structure and the challenges of verifying the identities of international high schoolers at scale. They stated that a privacy policy was being developed and that IDs were set to be automatically deleted after 90 days, though this was debated as a balance between privacy and the "legitimate interest" of preventing fraud.

Further concerns were raised about marketing practices, with users noting that signing up for programs like HCB automatically enrolled them in organizational newsletters, a practice that critics argued should be opt-in rather than opt-out under regulations like PECR and CAN-SPAM. Staff acknowledged the issue and pointed to functional unsubscribe links in marketing emails.