Privacy
Most of what Sahaba Club does only works because people are willing to be themselves here — to put a real headline on a real profile, to say what they are trying to learn, to be findable by someone they have not met yet. That willingness is the thing this page is about. It is worth writing down exactly what we hold, exactly who can see it, and exactly what leaves the club, so that nobody has to take it on trust.
Everything below describes what the software actually does. The site is open source and public, so it can be checked rather than believed.
Last reviewed 6 September 2026 · Questions: info@sahabaclub.com
The short version
- Your email address and phone number are never shown to another member. Not on a profile, not in the directory, not in a message header. They are not in any of the tables other members can read.
- Nothing about a member is readable by someone who is not signed in — with one named exception, the EduHackAI roster, which is set out below.
- Avatars are drawings. A photo you supply is used to make one and is then destroyed. It is never stored.
- A CV or LinkedIn PDF is read once and thrown away. You review what was extracted before anything is saved. The document itself is never kept.
- Analytics only if you agree to it, and never on the member pages. Google Analytics counts page views on the public pages — after you say yes, not before; say no and the script is never even fetched. It is not on the signed-in pages at all. There is no tag manager and no advertising pixel. What it records, and how to change your mind.
- Your attending badge is private until you share it. We make you a picture when you register, but nobody can see it except you — there is no public link and nothing to find. You decide where it goes, and you can delete the file. What is on it, and how to remove it.
- There is no self-service delete button yet. We would rather say so than pretend. Email us and a person will do it. (Your attending badge is the exception — that one you can delete yourself.)
What we hold about you
If you have an account
Your profile is the part you write. It can hold your name, a headline, a short bio, your city and country, your industry, your company and position, how many years you have been at it, your experience level, your skills, interests and goals, what you are open to, your language and timezone, your work history, and links you choose to add — LinkedIn, GitHub, a site of your own. Every one of those is optional and every one of them is yours to change or empty at any time.
Alongside it we keep your membership tier, and — if you have one — your Sahaba Club Microsoft 365 mailbox address and the dates its licence runs between.
Your email address and phone number
These sit in the authentication system, separately from your profile, and they are deliberately not in the tables and views that members read from each other. That is not a setting; it is how the database is built. A query that tried to show another member your email would not return the wrong answer, it would fail.
What you do here
The club records the things it needs in order to be a club: which events you saved, which you said you were going to, and which you opened; who you follow; the messages you send to other members; your posts, likes and comments on the member feed; and — if you use PromptArena — the prompts you submitted, the score, and the written feedback on each one.
The record of which events you opened exists for one purpose, which is to put better suggestions in front of you. It is a count and a date per event, it is readable only by you and by staff, and it is not shown to anybody.
If you do not have an account
A separate list holds people who gave us their details at an event, an intern intake or a hackathon and never went on to sign up. Depending on which form it came from, that can include a name, an email address, a phone number, a city and country, a date of birth, a LinkedIn or GitHub link, a university or employer, and an occupation — plus a record of which events they came to.
That list is not part of the membership directory, no member can see it, and nothing in it is used to build a public profile. It is used to invite people to things. Every email sent from it carries an unsubscribe link, and more on that below.
If we send you a business proposal
When Sahaba Club proposes work to an organisation, the proposal is a page on this site rather than a document attached to an email. The link we send is personal: it is issued to one named person, so opening it tells us that it was opened, when, how long the page was open for, how far down it was read, and whether the PDF was downloaded. That exists so we know whether a proposal landed and what to follow up on. Only the founder can see it. It is not shown to members, to staff, or to anyone outside the club.
Stored beside the open: a one-way hash of the IP address and never the address itself, a coarse description of the device — phone or desktop, the operating system family, the browser family, and nothing finer than that — the country that hash resolved to, and the site the visit arrived from. We also hold whatever contact details the proposal was addressed to, which is usually a name, an email address, a phone number and a job title.
If the browser sends Do Not Track or Global Privacy Control, we record only that the link was opened and which sections were reached. No IP hash, no device description and no country are kept. The link still says who, because we are the ones who sent it.
To stop it, write to info@sahabaclub.com and we will revoke the link and delete the record of it having been read.
Who can see it
Someone who is not signed in: nothing
Every view that carries a member's details is granted to signed-in members only, and access for anonymous visitors is explicitly revoked. This is not a hidden button or a lock drawn in the page — it is enforced in the database, underneath the site, so it holds whatever a browser is told to do.
As Connect puts it to anyone who lands on it signed out: these are real people who chose to be findable, and we don't show them to strangers, which is also the promise that makes them willing to be here.
Another signed-in member
If you have Show me in Connect switched on, other members can see your name, avatar, headline, city and country, industry, company and position, experience, work history, skills, interests, links, and the events you have attended. That is the profile — it is meant to be read, by members.
They cannot see your email address, your phone number, or your Microsoft 365 mailbox, whichever way any setting is turned. Members reach each other through the club inbox or not at all.
What each switch does
| Setting | Default | What it controls |
|---|---|---|
| Show me in Connect | On | Whether you appear in the member directory at all. Off, and no other member can find you, open your profile, or message you. |
| Let members message me | On | Whether the Message button appears on your profile. Off, and new messages to you are refused by the database, not just hidden. Conversations you already have stay where they are. |
| Show me in who's going | On | Whether your name and avatar appear on an event card among the people attending. |
| Newsletter | On | Whether you are in the audience for club newsletters. |
| PromptArena leaderboard | Off | Whether you are ranked publicly. Off unless you switch it on. Turned on it shows your name, avatar, rating, challenges completed and highest score — and nothing else. Your prompts, the judge's feedback and when you play are never shown to anyone either way. |
Messages
A message is readable by the two people in the conversation and by nobody else — staff included. "Delete" on a conversation hides it from your side; it does not destroy the other person's copy, and the page says so rather than implying otherwise.
The one thing that is public
The EduHackAI roster can be read without signing in. It carries participants' full names, their team, and whether they mentored or judged — including for people who never created an account. It carries no email address, no phone number and no employer or university. A participant's avatar, headline and link to their profile appear only if they have an account and have switched Connect on.
It is public because a hackathon result that nobody can point at is not a result. If you were on that roster and would rather not be named, email info@sahabaclub.com and we will take you off it.
Staff
Club staff can read member profiles and the marketing contact list, because running the club needs it. Changes staff make to people's records are written to an audit log, and so is every export, including whether the export contained email addresses or phone numbers. Staff cannot read members' messages to each other.
Avatars are drawings by default — but the choice is yours
The circular picture next to a member's name is normally illustrated art in the club style. It is generated from a photo you supply — uploaded, or taken from the account you signed in with — and when you take that route the photo does not survive the process.
Concretely, for a drawing: the image arrives in the request, is held in memory, is sent to OpenAI's image API to be redrawn, and the memory holding it is wiped. It is never written to storage and never written to a column. Only the drawing is kept, and the moment the drawing is saved the record notes that the source was destroyed.
Avatars can be regenerated three times a month. Past that you get a drawn pattern instead, made in your browser with nothing sent anywhere.
If you choose to keep a real photograph, we store it. You can decide the drawing is not for you and keep a photo as your picture instead. That is a deliberate choice with a button of its own, and it changes what we hold:
- A photo you upload and keep is stored, in the avatars bucket, under a folder only your account can write to. It is the picture other members see. This is the one case where a photograph of you is held on our storage, and it is held because you asked for it to be.
- Your Google, Microsoft or LinkedIn picture is never copied. We store the link; the image stays on their server. This is also what happens automatically when you first sign in with one of those providers and have not yet set a picture — so until you do, the image beside your name may already be the photograph they hold.
Either way you can change your mind: generate a drawing, choose a tile of your initials, or clear the picture entirely from Dashboard → Your profile. Clearing it removes the stored file. A photo you have chosen to keep is never redrawn behind your back — the monthly avatar refresh skips it.
The attending badge
When you register for a club event we make you a badge to share — a picture that says you are attending, with your name and your photo on it. It is made automatically, and it is private to you until you choose to send it somewhere.
What is on it
Your name, your role and company as they appear on your profile, your picture — the same avatar the site already shows, or a tile of your initials if you have not set one — and the event's title, date and format. Nothing else about you. No email address, no phone number, and nothing about any other member.
The picture is drawn in your own browser, not on our servers.
Who can see it
Nobody but you, until you share it. The image is kept in private storage. There is no public link to it, no page carrying it, and nothing for a search engine to find. Opening it needs your own signed-in session.
When you press Share, your phone's own share sheet opens and you choose where the picture goes. We are not involved in that step and we are not told what you picked. On a computer the image downloads to your machine instead, and you attach it yourself.
Club staff can see the list of who has a badge, which is how a complaint about one can be answered.
Removing it
Open the event page, press Your attending badge, then Delete my badge. The picture is deleted from our storage — the file goes, not a flag. That cannot be undone, though anything you have already posted stays wherever you posted it, as with any other picture.
Deleting the badge does not touch your registration. You are still going to the event.
CVs and LinkedIn exports
Onboarding offers to fill in your profile from a CV or a LinkedIn "Save to PDF" export, so you do not have to retype a career you have already written down once.
That document is sent to OpenAI to have the fields read out of it, and the result comes straight back to the form for you to check and correct. The extraction step writes nothing to your profile — you do, when you press save, and you can edit every field first. The document itself is never stored: there is no bucket for it and no column that holds one.
Worth being plain about one thing: the LinkedIn import is the PDF you export yourself. Nothing here reads your LinkedIn page, and signing in with LinkedIn gives the club your name, email and picture and nothing more — no positions, no skills, no connections.
Email we send, and stopping it
If you have an account
Signing up gets you a welcome email. After that, the newsletter is a switch on your profile — Send me the Sahaba Club newsletter — which starts on and which you can turn off at any time and back on again later. Newsletters go out one message per person, so no recipient ever sees another person's address.
Messages about your own membership — your mailbox, your licence, a password reset — are not marketing and are not covered by that switch.
If you do not have an account
Every campaign email carries an unsubscribe link, and the one-click unsubscribe header that mail clients use to put the button in their own interface. Following the link opens unsubscribe.html, which asks you to confirm rather than acting the moment the page loads — mail clients and security scanners fetch links automatically, and a page that acted on being opened would unsubscribe people who never read the message.
The opt-out is checked again at the moment of sending, not only when the list is built, so unsubscribing while a campaign is going out still stops it reaching you.
What we learn about the email itself
Our emails go out through Resend, and it reports back to us about each one: that it was delivered or bounced, that it was marked as spam, that it was opened — measured by a tiny invisible image in the message — and that a link in it was clicked, which works by routing the link through Resend's servers on its way to the destination. These reports are tied to your email address and we keep them.
What they are for: knowing whether a campaign was worth sending, and protecting your inbox — an address whose mail bounces stops being written to, and marking one of our emails as spam stops all of them, permanently. What they are not for: nothing here is sold, shared or joined to advertising, and none of it changes what any member sees on the site.
Two honest limits. Open counts overstate reality — Apple Mail and several other clients fetch the images in mail automatically, which registers as an open you never made, so we treat that number as rough at best. And this measurement comes with the email rather than with a question: the way to not be measured is the same as the way to not be mailed — the unsubscribe link in every message, honoured immediately.
Analytics, and the question we ask first
There is no analytics on this site at the moment. No measurement id is configured, so no analytics script is fetched, no cookie is set and you are never asked anything. Everything below the next heading describes what happens when it is switched on — it is written down in advance so that turning it on is not a change nobody was told about.
We use Google Analytics 4 on the public pages — the home page, events, hackathons, the podcast, membership, the sign-in page and this one. It is there to tell us which pages people actually read, so that we spend our time on the ones they do. That is the whole of the reason.
Nothing loads until you say yes
The first time you arrive, a bar at the bottom of the page asks you. Until you answer, Google's script is not fetched — not fetched and held back, not fetched and ignored: the request does not happen and there is nothing in your browser to make it happen. Say no and it still does not happen, and we remember the no, so the next page does not ask you again.
Yes and no are the same button with a different word on it — same size, same weight, same colour, side by side. There is nothing to untick and no longer road to no than to yes.
If your browser sends a Do Not Track or Global Privacy Control signal, we treat that as a no you have already given: analytics never loads and you are never shown the bar.
Your answer is kept in your browser's own local storage, under
sc_analytics_consent. It is deliberately not a cookie —
setting a cookie to record that you may not want cookies would be an
odd way to begin — and it never leaves your browser, because there is
no server here to send it to.
What it records, if you say yes
- The address of the page, cut off at the first
?or#. That cut is deliberate and it is the sign-in page it was written for: that page can carry where you were headed next, and a failed sign-in can come back with an error or a one-time token in the part after the#. Google's default is to send the whole address. Ours sends the site and the page name and stops. - The page title, and the page you arrived from, trimmed the same way — and if you arrived from one of the signed-in pages, no referring page is sent at all. Excluding those pages would not mean much if following the footer link off one of them announced that you had been there.
- Google's standard set about the visit: an approximate location worked out from your IP address, your device, browser, screen size and language, and whether you have been here before. We have not added anything to it.
- Nothing you type. No name, no email address, no phone number, no member id, nothing out of any form on this site. Google's own terms forbid sending them, and it is a rule here separately from that.
Beyond page views, we record three named events on the sign-in page only, because it is the busiest page on the site and we could not tell whether people arriving there managed to join: that the sign-in page was opened, that a sign-in button was pressed — recording which method (Google, Microsoft, LinkedIn, email or phone), never any detail of the account — and that a new account was completed. That is the entire list. There is no click tracking anywhere else, no scroll tracking, no capture of what you searched for, and nothing you typed into the sign-in form — no email address, no phone number — is ever part of these events. Like everything else here, they do not exist until you have said yes to the bar.
It sets cookies
Once you agree, Google sets its _ga cookies in your
browser. They hold a random id, and their job is to let two page views
in a row be counted as one visit rather than two strangers. The
advertising side is switched off in how the tag is set up here: no
Google Signals, no ad personalisation, no advertising cookie.
Not on the member pages
Everything behind the login carries no analytics at all — your dashboard, your profile, Connect, another member's profile, the inbox, PromptArena and the staff tools. This is a decision rather than an omission. Those pages are about named people: which member's profile you opened, whose messages you are reading, which hackathon placing belongs to whom. What members do here stays in the club's own database and does not go to Google.
How long Google keeps it
Retention is a setting on the Analytics property itself, chosen in Google's admin rather than written into this site, so this page is not going to quote you a number it cannot check. If you need to know what it is set to, ask at info@sahabaclub.com and we will read it off and tell you.
Changing your mind
That clears your answer, stops the tag on this page immediately —
no reload needed — expires the _ga cookies it can reach,
and puts the question back so you can answer it again. One honest
limit: a page can only expire a cookie it could have set, so your
browser's own site-data controls remain the complete way to clear
everything Google has left there.
Who else touches your details
This is the complete list, and it is short because there is no advertising anywhere in this site and the single analytics tool on it does not load unless you have agreed to it.
| Who | What for |
|---|---|
| Supabase | The database, sign-in, file storage and the server-side functions. Everything the club knows lives here. |
| OpenAI | Drawing avatars, reading CVs, judging PromptArena submissions, and writing drafts staff review before sending. |
| Microsoft | Creating and licensing your @sahabaclub.com mailbox. Only your name is sent — no email address, no phone number, nothing from your profile. |
| Resend | Delivering email: welcome messages, credentials, newsletters and campaigns. |
| Google, Microsoft, LinkedIn | Only if you choose one of them to sign in with. They confirm who you are and hand back your name, email and picture. |
| Google Analytics | Counting page views on the public pages, and only once you have agreed — the section above is the detail. Never loaded on the signed-in member pages, and never sent anything you typed. |
| Google Fonts | One typeface, loaded by your browser on every page. |
| YouTube | Video embeds. The homepage uses the no-cookie player; the podcast page uses the standard one. |
| esm.sh | Serves the database client library to your browser. It carries no data of yours; it is code, not content. |
Outbound links to event organisers, our social accounts and members' own sites are ordinary links. Following one takes you to somebody else's site under somebody else's rules, and nothing about you goes with you.
Changing or removing your details
Change anything
Open your profile. Every field on it is editable, including clearing one entirely.
Disappear without leaving
Turn off Show me in Connect and you are out of the directory immediately: no member can find you, open your profile or start a conversation with you. Your account, your events and your history stay exactly as they are.
Delete the account
There is no delete-my-account button yet. We would rather write that down than build a page implying otherwise.
What to do instead: email info@sahabaclub.com from the address on the account, or from your club mailbox, and say you want it deleted. A member of staff does it by hand. Deleting the account removes your profile, your registrations, favourites, follows, messages, feed posts and PromptArena history along with it — that is a cascade in the database, not a list somebody has to remember to work through.
Two things it does not reach, so that nobody is surprised. Your Microsoft 365 mailbox is an account in Microsoft's directory and has to be closed separately — say in the same email if you want that too. And if you were sent a club newsletter or campaign before you asked, the record that it was sent stays in the sending log.
If you never signed up
Unsubscribing stops the email. If you would rather we deleted the record altogether, ask at info@sahabaclub.com and we will.
A profile written about you before you joined
Some EduHackAI participants have a profile the club assembled from what they typed into the hackathon's own forms, waiting for them to claim it. Nothing in it was invented and nothing was fetched from anywhere else — a LinkedIn address somebody typed into a form is an address, not a page we read. If one of those is yours and you would like it changed or taken down, whether or not you want to join, email info@sahabaclub.com.
What this page does not tell you
It describes the system as built, and it stops there deliberately. We have not set fixed retention periods, so this page does not claim any — records are kept until they are deleted, and the paragraphs above say how to get that done. If you need something more formal than this for your own compliance, ask and we will answer a specific question honestly rather than publish a generic one.
If any of this turns out to be wrong, that is a bug and we would like to know. info@sahabaclub.com.