Privacy Policy

Last updated: 6 October 2026

This policy explains what personal data hackingtools.ai collects, why, and what rights you have. hackingtools.ai is a public directory of cybersecurity tools, platforms and training resources. You can browse it without an account.

Who is responsible

The controller of your personal data is hackingtools, Athens ("we", "us"). Contact us about privacy at hello@hackingtools.ai.

What we collect

If you only browse: we do not ask for any personal data. Our hosting provider processes technical data that every website receives, such as your IP address, browser type and the pages requested, to deliver the site and keep it secure.

If you create an account:

your email address and whether it is verified;
your password, which is stored only in hashed form by our authentication service, never in plain text;
the display name you choose;
the date you joined and how you sign in (email and password, or Google).

If you sign in with Google: Google shares your email address and basic profile information (such as your name and profile picture) with us. We use the email address to identify your account. We never publish your Google name or picture; you choose a separate display name.

If you participate:

votes: we store which listings you voted on and how. Other people see only totals, never who voted;
reviews, ratings, comments and replies: these are public and show your display name and the date;
reports you submit about other contributions.

If you subscribe to the newsletter: your email address and subscription details (see Newsletter below).

For safety and moderation: account status (for example, suspended), moderation decisions about your contributions, and timestamps used to apply posting limits.

In your browser: we store a sign-in session so you stay signed in, and a short-lived draft of anything you are typing (with the page to return to) so it survives signing in. Drafts are kept for up to 24 hours and are cleared when you sign out. We do not use advertising or tracking cookies, and we do not currently use analytics. Our hosting providers may set short-lived technical cookies that are strictly necessary to deliver the site securely, for example for bot protection. If you tick the newsletter box when you create an account, your browser keeps that choice for up to 24 hours, until your email is verified.

Why we use it

To run your account and let you vote, review, comment and reply. Legal basis: performance of our contract with you (Article 6(1)(b) GDPR).
To keep the site secure, prevent spam and abuse, enforce our Terms of Use and moderate content. Legal basis: our legitimate interest in a safe and trustworthy service (Article 6(1)(f) GDPR).
To meet legal obligations, for example responding to lawful requests from authorities. Legal basis: Article 6(1)(c) GDPR.

We send account holders service emails: verification codes and password resets. We send the newsletter only to people who asked for it and confirmed by email. We do not sell your personal data or use it for advertising.

What is public

Your display name and your reviews, ratings, comments and replies are visible to everyone, including people without an account, and may appear in search engine results. Your email address is never public. Individual votes are never public; only totals are shown.

The newsletter is optional and sent about once a month. You can sign up in the site footer, when you create an account, or on your account page (/account).

Double opt-in: after you sign up, we email you a link to confirm. You are subscribed only once you confirm. If you don't confirm, you won't receive the newsletter, and we delete the unconfirmed sign-up within 60 days.
What we keep: your email address, your subscription status, when you signed up and confirmed (MailerLite records technical details of the confirmation, such as the IP address, as proof of your consent), and which links in the newsletter you click.
We count clicks on links in newsletter emails to learn which content is useful. We do not track whether you open our emails.
Legal basis: your consent for receiving the newsletter (Article 6(1)(a) GDPR), and our legitimate interest in learning which content is useful for counting link clicks (Article 6(1)(f) GDPR).
Unsubscribe anytime with the link in any newsletter email, or on your account page. Unsubscribing does not affect emails sent before.
After you unsubscribe, MailerLite keeps your email address marked as unsubscribed, so that we never email you again by mistake. Ask us at hello@hackingtools.ai to erase it entirely. Deleting your account also erases your newsletter record at MailerLite; MailerLite completes the erasure within 30 days.
To limit abuse of the footer form, we keep a pseudonymized (hashed) form of your IP address for up to 24 hours.

Who processes data for us

We use service providers that process personal data on our behalf, under data processing terms:

Lovable, which hosts the website and provides our database, authentication, file storage and email delivery, together with its own infrastructure subprocessors;
MailerLite, which stores newsletter subscribers and sends the newsletter (data hosted in the EU);
Cloudflare, which provides our domain name (DNS) service and forwards email sent to our contact address to a mailbox hosted by Google.

If you choose Google sign-in, Google processes your Google account data under its own privacy policy.

Some of these providers may process data outside the European Economic Area, including in the United States. Where they do, the transfer is covered by safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

We may also disclose data where the law requires it, or to protect the rights and safety of our users and the site.

How long we keep it

Account data: for as long as your account exists.
Contributions: until you delete them or your account.
When your account is deleted, we delete or anonymize your personal data within 30 days. Your votes, ratings and contributions are removed from public view and from all totals. If other people replied to your post, their replies stay visible under a neutral placeholder that shows nothing of your post.
Newsletter: see Newsletter above.
Technical logs and backups are kept by our providers for a limited period for security and recovery, and are then deleted.

Your rights

Under the GDPR you have the right to access your personal data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. You can change your display name on your account page (/account). You can delete your account yourself on your account page (/account). You can turn the newsletter off on your account page or with the link in any newsletter email. To use any other right, email hello@hackingtools.ai from the address linked to your account. We will reply within one month.

You also have the right to lodge a complaint with a data protection authority. Ours is the Hellenic Data Protection Authority, www.dpa.gr.

Children

hackingtools.ai accounts are for people aged 16 or over. If you are younger, please do not create an account. If we learn that an account belongs to someone under 16, we will delete it.

Security

We protect data with encrypted connections (HTTPS), hashed passwords and access controls that limit what each person and system can see. No system is perfectly secure; if a breach affects your data, we will act and notify you and the authorities as the law requires.

Changes to this policy

We will post any change on this page and update the date at the top. If a change materially affects how we use your data, we will also email account holders before it takes effect.

Contact

hackingtools, Athens. Email: hello@hackingtools.ai.