Privacy.

hackerblue.dev is served through Cloudflare, which provides our DNS, TLS, content delivery and hosting. The public pages are static and carry two small scripts of our own, one for the copy buttons and one for the header style switch, plus Cloudflare Web Analytics, served by Cloudflare itself. Cloudflare Web Analytics counts visits in aggregate, sets no cookies and does not follow you to other sites; there is no advertising on the site.

Like any web host, Cloudflare processes technical request data, such as IP address, user agent and the page requested, to serve the site and protect it from abuse. It does this as our hosting and security provider.

Public pages set no advertising or analytics cookies. One small preference cookie keeps the switch-on animation to once per visit, and signing in, buying and managing your account use the session and security cookies described under “Your Hacker Blue account”.

The site loads in a plain look and switches into the Hacker Blue design a moment later. The switch in the header turns that off and on for the page you are on, and it stores no choice. One first-party cookie keeps that switch-on animation to one playing per visit. It is strictly necessary for that: it holds nothing about you, it is not used to identify you or to track you across sites, and it is set only when you open a page.

• hb_seen: a marker that you have already seen the switch-on animation in this browsing session, so the next page does not repeat it. It is deleted when you close the browser.

If you block cookies the site still works in full; it simply shows the animation on every page.

Buying a theme runs through Whop. Whop collects the payment and contact details you provide at checkout, and handles receipts, tax, fraud checks and payment support. Whop’s Privacy Policy applies to what Whop collects for its own purposes.

Hacker Blue receives the order details needed to deliver a purchase and support it, the Whop payment reference, the product bought, the amount, currency, status and date. We do not receive or store your full card number, card details stay with Whop and its payment partners.

A theme page shows the reviews Whop publishes for that theme’s product: the average, how many there are, and the newest few. Hacker Blue reads them from Whop’s API while serving the page and keeps no copy; it collects no review data of its own, writes no review, and shows nothing for a theme that has none. Writing a review happens on Whop, under Whop’s own Privacy Policy, and a review appears here only after Whop has published it.

A review is shown with the reviewer’s first name as Whop reports it, their rating, their comment, and the day it was published. No email address, and no other detail about the reviewer, is ever shown.

An email-and-password account is held by Supabase Auth. Supabase stores the email address you register and a hashed form of your password, never the password itself. When you register, sign in or set a new password, the password you type travels over TLS to Hacker Blue’s server and is passed straight to Supabase Auth to create the account, verify the sign-in or store the new hash; Hacker Blue handles it only for that request and never stores it. Supabase sends the two account emails; confirm your address, and reset a forgotten password; and they leave through Resend from no-reply@mail.hackerblue.dev. The address is used for those account emails only: this site runs no mailing list and sends no marketing email.

If you choose Continue with Google, the sign-in runs through Supabase Auth and Google: Google tells Hacker Blue your email address, your name and the URL of your profile picture, and nothing else about your Google account. Hacker Blue never sees your Google password, and Google learns that you signed in to Hacker Blue. Google’s Privacy Policy applies to what Google itself records.

A Hacker Blue account is created when you sign in; with Google, or with an email address and a password. Supabase Auth holds the session that keeps you signed in, and the account pages are served only to a signed-in session. The site uses a small set of cookies to run your account: one keeps you signed in, one protects the account and checkout forms from cross-site requests, and short-lived ones carry the sign-in hand-off and a checkout you started. They are there to run the account, not for analytics or advertising.

Your account stores your profile; your email address, display name, avatar if available, and when the account was created and last used; your purchases; the Whop payment reference, the product bought, amount, currency, status and date; and your licences; which Hacker Blue products you own and whether each is active, including a free theme you claimed, which is recorded as a licence with no payment behind it. It never stores card numbers or your password. Accounts created before 23 September 2026 through Whop’s former sign-in option also keep the Whop account ID that sign-in recorded, used only to look up that buyer’s own payments; nothing new is written to it.

The HackerBlue CLI generates a random device identifier for each installation; it is not derived from your hardware. To authorise a device we store its name, operating system family (Linux, macOS or Windows), CLI version, that identifier, a hashed device token, and when it was authorised and last seen. Hacker Blue does not collect hardware serial numbers, MAC addresses or invasive fingerprints. An account can have up to three active devices, and you can deactivate one from your account page.

Theme releases live in a private store and are served only to a signed-in, licensed account through an authorised device; the files are never public. Serving a page, a download or an API request produces ordinary technical records, such as IP address, user agent and the time, in our logs, used to run the service, prevent abuse and investigate problems.

Records are kept only for as long as they are needed, or as long as the law requires:

• Purchase and tax records: the Whop payment reference, the product bought, the amount, currency, status and date; are kept as long as tax and accounting law requires, and minimised to what those laws need. This is the one record that survives account deletion.
• Account and licence records: your email address, your password hash if you set a password, your profile, your licences and whether each is active; are kept while your account exists, and removed when the account is deleted.
• Device records: the name, operating system family, CLI version, device identifier and hashed device token; are kept while the device is authorised. Deactivating a device marks it revoked and stops it working; its record stays so the account can still see it and support can trace it, and it is removed when the account is deleted.
• Technical logs: request records such as IP address, user agent and time, and authentication events; are kept for a short, fixed window set at the provider and then removed. They are not kept for marketing or profiling, and they are not used to build a profile of you.

The providers that hold data for Hacker Blue process it across national borders: Cloudflare serves this site from a global network, so request data is handled outside your country; Supabase keeps the account database and the private release storage in Singapore (ap-southeast-1); Whop handles checkout and payments from the United States; Resend delivers the confirmation and password-reset emails from the United States; and, only if you choose Continue with Google, Google authenticates you from its own global network.

So a customer in the UK or the EEA has personal data processed outside the UK or EEA. Where data crosses a border that way, we rely on the safeguards in each provider’s data-protection terms, the standard contractual clauses and equivalent mechanisms those providers make available for transfers out of the UK, the EEA and Switzerland, and we choose providers that publish them. Before a new provider can hold personal data, it has to meet the same bar.

Traffic to this site is served over TLS. Public pages are static and carry the two small scripts of our own and the cookie-free visit count described above; they set no cookies for advertising or analytics. Theme files live in a private store, and a download is issued as a short-lived signed link only after the account’s licence and the device are checked. Account data is behind database rules enforced in the database itself; an account can read its own records and nothing else. Hacker Blue never stores card numbers or passwords: a password is passed straight to Supabase Auth to create, verify or update the account, which keeps only a hash of it. Hacker Blue never sees your Whop credentials; card details stay with Whop and its payment partners, and the server-side keys that reach Supabase, Whop or Resend exist only as encrypted secrets and never reach a page or a customer.

If personal data is breached, we contain it and establish what was affected. Where the law requires it, we report the breach to the relevant data-protection authority within 72 hours of becoming aware of it, and we tell the people affected when the breach puts their rights at real risk, saying what happened and what to do. A report is never delayed because the cause is still being investigated; an investigation being open is not a reason to stay silent.

Buying a theme runs on Whop, and Whop’s Terms of Service require a user to be at least 13 years old, or older where the law where you live sets a higher minimum age. That is the floor for a Hacker Blue account as well: Hacker Blue does not knowingly collect personal data from anyone below it, and if we learn that we hold data belonging to a child below that age, we delete it.

If you are between 13 and 18, Whop’s terms require a parent or guardian to have reviewed and agreed to them and to supervise your use, and Whop’s Youth Safety Policy treats your purchase as made with parental consent. The terms of sale state the same requirement, and Legal has the full wording.

• Cloudflare: DNS, TLS, content delivery and hosting for this website, the cookie-free Web Analytics that counts its visits, and the email routing that carries mail sent to the addresses on Contact.
• Whop: checkout, payment processing, receipts and tax handling.
• Google: only if you choose Continue with Google: it authenticates you and tells Supabase your email address, name and profile picture URL. Google’s own Privacy Policy applies to what it records.
• Supabase: authentication (Google and email-and-password accounts, password hashes, sessions and sign-in identities), the account database (profile, purchases, licences and devices), records of published theme releases, and private storage for the release files.
• Resend: delivery of the two account emails: confirm your email address, and reset a forgotten password.

No other company runs this site or sells these themes. Cloudflare Web Analytics, part of the Cloudflare service above, is the only analytics; there is no other analytics provider, no advertising network and no mailing list attached to this site.

If you are in the EEA or the UK, you have the right to access, correct, delete, restrict or object to the processing of your personal data, and to receive it in a portable form. You also have the right to complain to your national data protection authority. “How long records are kept” above says when each kind of record is deleted. A data-subject request is answered within one month of reaching us, the period the GDPR allows, and if a request is complex enough to need longer we will say so inside that month and give the reason.

Where we process data, we rely on our legitimate interest in running and protecting this site, the performance of a purchase contract when you buy, and our legal obligations such as keeping tax records.

Email privacy@hackerblue.dev for a data request or any privacy question. A request that reaches us is answered within one month, the period the GDPR allows. A request can also travel through Whop’s help centre, which routes it to Hacker Blue, but the address above is the direct route.

Do not post a data request in public. We may ask you to confirm your identity before we act on it, so that one person cannot obtain another person’s data.