Editing Privacy concerns and data handling at Hack Club (section)

== Security Incidents ==
The internal debates were compounded by a series of public incidents documented in external blog posts. In July 2025, a former member of Hack Club disclosed multiple unprotected API endpoints across Hack Club programs. One endpoint in the Neighbourhood program allegedly exposed participants' full legal names using only their Slack ID, without any authentication. Internal communications provided by the researcher suggested this lack of protection was an intentional design decision by a developer, despite being warned by another team member that it constituted a GDPR breach.

Subsequently, in September 2025, a separate incident occurred where a developer committed a log file containing three minors' full names, email addresses, home addresses, dates of birth, and phone numbers to a public repository. The response from Hack Club was described as attempting to overwrite the data and later making the repository private, but the data reportedly persisted in forks and web archives. The former member characterized this as a pattern of "gross, willful negligence" rather than an isolated error.

A third area of concern involved "Orpheus Engine," an internal analytics pipeline. According to a technical analysis, this system was used to profile grant applicants by scraping their activity across various social platforms and using third-party APIs to infer demographic data like gender. Critics argued this constituted extensive profiling without opt-in or transparency.