Nothing measures your visit until you say yes.

1 · What this site collects

Two separate things, and it is worth keeping them apart. Reading a page collects nothing at all until you accept analytics. A form collects what you type into it whatever you decide about analytics, and there are two forms: contact, and registration for the capture the flag.

If you accept analytics, two tools start, and only then. Neither one is loaded, and neither one sets anything, before you say yes:

• Google Analytics 4. Which pages you visit and in what order, roughly how long you stay, how you arrived, whether from a search engine, a link from somewhere else or directly, your rough location worked out from your IP address, which is city level and does not keep the address itself, and general device information: browser, operating system, screen size, language.
• Microsoft Clarity. The same kind of page-level picture, plus heatmaps built by adding many visits together and an anonymised recording of the session. A recording is mouse movement, scrolling, clicks and taps. Clarity is set to hide what you type, so form fields are masked and your name, email address, phone number and message do not appear in a recording.

Both tools set cookies in your browser. The next section names them and says how to be rid of them. Both are run by companies outside India, so this data may be processed and stored outside India, in whichever region each vendor uses.

We ask first, and that is the whole of the arrangement: nothing above happens until you accept it, declining loads neither tool, and the cookie settings link in the footer changes your mind either way, whenever you want.

What we do with it is unglamorous. Work out which pages people actually read, find the place where a form or a schedule loses them, and get a rough sense of how much interest there is before we book a room and count chairs. It is not used to profile you, to advertise at you, or to decide anything about you.

What you send us deliberately is the other half, and all three ways of doing it start with you deciding to:

• The contact form. Your name, your email address, an optional phone number, the subject you picked, and your message. The phone number is optional on purpose, most questions do not need one, and a required field that is rarely used is just a field that collects more than it needs.
• CTF registration. Your name, the handle you want on the scoreboard, your email address, your team's name, the team code if you were given one, roughly how many of you there are, how much capture the flag you have played, whether you already hold a pass, an optional ticket reference, whatever names you typed for the rest of the team, and anything you put in the last box. The handle is a separate field on purpose: a scoreboard is public, and nobody should have to put a legal name on one to compete. Registering is free and none of it is a payment.
• An email. If you write to info@bsidesdehradun.com or one of the other addresses, we have whatever your mail client sent, which is your address, your name as you have it configured, and your message.

2 · Cookies and consent

Until you accept analytics, this site sets no cookies at all. Not one, first-party or third-party. Decline and it stays that way, which is what makes declining a real choice here rather than a slower route to the same place.

Accept, and the two tools set their own:

• Google Analytics sets _ga and a companion cookie whose name begins _ga_. Between them they tell it that two page views came from the same browser. Both are first-party cookies, set on this domain.
• Microsoft Clarity sets _clck and _clsk, which do the same job across sessions and within a single session.

Two things stored on your device are not cookies. Your light or dark theme choice lives under the key bsd-theme in localStorage, and your analytics decision lives under bsd-consent. Neither is sent anywhere, neither is an identifier, and clearing site data removes both, after which the panel asks again. The decision is kept there rather than in a cookie for one plain reason: it is what makes the first sentence of this section true. If you never touch the theme toggle and never answer the panel, nothing is written at all.

Turning it off. The cookie settings link in the footer of every page reopens the panel. Turn analytics off there and we tell both tools to stop, expire the cookies listed above, and reload the page so nothing carries on running inside it. One honest limit: a cookie set on a vendor's own domain rather than on ours cannot be deleted by this site, or by any site. Clearing site data in your browser is the only way to be certain of those.

How long each tool keeps what it collected is set in that vendor's own console rather than here, and it is part of the same open question as the retention line in section 5. It gets written down when that number does.

There is no third category. No advertising cookie, no cross-site identifier, and nothing that follows you once you have left this domain.

3 · Why we ask for it

To answer you, or to put your team in a competition. Those are the whole purpose of the two forms and they have no others. What the two analytics tools are for, if you accepted them, is in section 1.

Each field earns its place: the email address is how a reply reaches you, the name is so a volunteer can address you properly, the subject routes the message to whichever organiser handles that area, and the message is the question. The optional phone number exists for the small number of threads where email is the wrong tool, such as a sponsorship call or a village that needs kit on the day.

The registration form is longer, because a competition needs more from you than a reply does. The handle is what the scoreboard prints. The team name and the code are how up to four separate submissions become one team, and the code exists because a site made of static files has nothing that could invent one at the moment you press the button, so a captain is emailed one instead. The experience question decides how many entry-level challenges get written and how many volunteers stand on the floor to help, which makes it the one answer that changes what we do before the day. The pass question is how a room for the final gets booked against a real number rather than a hope. None of it is scored and none of it puts you in a bracket.

Your message is not used for anything else. It is not added to a mailing list, it is not used to profile you, it is not used to advertise at you, and it is not the basis of any automated decision. If we ever wanted to send you conference news, we would have to ask you separately and you would have to say yes.

4 · Who can see it

The volunteers on the organising team, with one exception, and the exception has its own paragraph below rather than a footnote. A form submission arrives in two places: a list in our hosting dashboard, and an email notification to info@bsidesdehradun.com. A small number of organisers can read both.

The exception is the capture the flag. The online round runs on LevelUpCTF, our CTF partner, so what a scoreboard needs from your registration goes to them: your handle, your team name, and an email address to attach the account to. What you told us about experience, about access, and anything you wrote in the last box does not, because a scoreboard has no use for any of it. Section 7 names the company and says what that means.

A message about conduct is different, and deliberately so. Please write to conference@bsidesdehradun.com rather than using the form. Two things change. That address is read by the founding team and the team leads rather than by every organiser, so fewer people see it. And a form submission is stored in our Netlify dashboard as well as emailed to us, while an email is only ever an email, so a report leaves one copy fewer behind it. That is also why the form has no "code of conduct" subject option. The code of conduct says what happens to a report once it arrives.

Analytics is the one thing that sentence does not cover. If you accepted it, Google and Microsoft hold what they collected on their own systems, and what we see is their dashboards: page lists, charts, heatmaps, and session recordings we cannot tie to a name. Section 7 names them both and says what that means.

We do not sell, rent, share or trade any of it. No sponsor gets it, in any tier, at any price. That is written into the terms as well as here.

5 · How long we keep it

To be confirmed

A retention period has not been set, and we are not going to write "as long as necessary" here and call that an answer. India's Digital Personal Data Protection Act, 2023 does not allow personal data to be kept past the purpose it was collected for, and both purposes here are narrow: answering your message, and running a competition. Once a thread is finished the message has done its job, and once the final has been played so has the registration behind it.

What that means in practice is a specific number of months, applied to both the dashboard list and the mailbox, with somebody responsible for actually running the deletion. Deciding the number is easy; committing to the routine that makes it true is the part worth being honest about not having done yet.

You do not have to wait for us to settle it. Ask us to delete your message and we will, and we will confirm that we have. See your rights below.

6 · What we still do not do

The site itself is deliberately plain: hand-written HTML, CSS and a little JavaScript, with no build step and no dependencies. The two analytics tools in section 1 are the only things it loads from anywhere else, and they load only if you let them. Everything below is still true, and this list is the part of the old version of this page that survived unchanged.

• No advertising. No ad script, no ad cookie, no remarketing list, nothing sold on this site or through it. Google Analytics can be wired into Google's advertising products, and this one deliberately is not: advertising features and Google Signals are switched off in the code that starts it, and the site's content security policy does not allow the ad domains they would need.
• No selling or sharing. Nothing collected here is sold, rented or traded, and no sponsor gets any of it, in any tier, at any price.
• No profiling and no automated decisions. Nothing here builds a picture of you as a person, scores you, or decides anything about you. The analytics we read is about pages, not about people.
• No other third-party scripts. The two analytics tags are the only ones. There is no tag manager container that somebody could quietly add a third tool to later, no embedded video, no social widget, no chat bubble and no A/B testing tool.
• No third-party fonts. The type is your system's own fonts. Nothing is fetched from a font CDN, which is a common and invisible way an IP address leaves a page.
• No fingerprinting. We do not measure your device, your canvas or your installed fonts to identify you. What the two tools record about your browser is listed in section 1, and it is not that.
• No referer leakage past the origin. Outbound links send only bsidesdehradun.com, never the page you were on.

7 · Third parties

Five, and we name all of them. Two only exist if you accepted analytics, two are infrastructure rather than partners, and the fifth is the platform the online capture the flag round runs on.

• Google, for Google Analytics 4. Only if you accepted analytics. Google receives the page-level data listed in section 1 and handles it under its own terms, on its own systems, which are not in India. Advertising features and Google Signals are off, so none of it feeds an advertising profile. Turn analytics off and the tag stops sending.
• Microsoft, for Clarity. Only if you accepted analytics. Microsoft receives the same page-level data plus the anonymised session recording, with what you type masked, again under its own terms and on its own systems. The project id is not a secret, it is in the page source, and it identifies this site rather than you.
• The host. This site is served by a static hosting provider, and like every web server theirs records the ordinary connection metadata such as your IP address, the time, the page requested and your browser's user-agent string. Those sit in access logs we do not read and cannot query. That is a property of how the web works, not a choice we made on top of it.
• Netlify, for both forms. The contact form and the CTF registration form are Netlify Forms: the submission is stored in our Netlify dashboard and emailed to us. Netlify processes it on our behalf and does not use it for anything of its own. When you submit either form your browser only ever talks to bsidesdehradun.com, because Netlify intercepts the submission at the edge, so nothing is posted to a third-party domain.
• LevelUpCTF, for the online CTF round. The capture the flag qualifier runs on their platform, which is what makes them a partner rather than a vendor we bought a licence from: they generate the base challenges, our own team modifies and tunes every one of them, and their scoreboard is the one you play against. A registration is passed to them so that your team exists on it, which means your handle, your team name and an email address for the account. Not your experience answer, not your access notes, not the free-text box. Ask us to withdraw before the round opens and nothing is passed on at all.

That is the complete list. There is no CRM, no email marketing platform, no spreadsheet in someone's personal cloud drive, and no AI service reading your message. If that ever changes, it changes here first, and the version number at the bottom of this page moves.

Outbound links to X, Instagram, LinkedIn, YouTube, Google Maps, bsides.org and the CFP platform are links, not embeds. Nothing loads from those domains until you click, and once you do you are on their site under their policy.

8 · Registration and tickets

Registration is not open yet, so no attendee data exists. When it opens it will run through KonfHub, which means they collect your details and take your payment under their own privacy policy. Read it at that point, because it will govern more of your data than this page does. Card details never reach us in any form.

What we expect to receive from them is an attendee list: name, email address, ticket tier, and whatever you tell us about accessibility or dietary needs. That list is used to run the event, checking you in at the desk, emailing you a schedule change, counting chairs. It is not shared with sponsors and it is not sold. The terms say the same thing in the sponsorship section, because that is where somebody would think to ask.

A badge photograph, a CCTV camera in a university building, and a sign-in register at the gate are the venue's arrangements rather than ours. Whatever UPES Bidholi Campus, Dehradun requires of visitors on the day is theirs to disclose, and we will point at their policy from the joining email once it exists.

9 · Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us what personal data of yours we hold, ask us to correct it, ask us to delete it, and withdraw a consent you previously gave. Those rights apply to a contact-form message and, once registration opens, to your attendee record.

Withdrawing analytics consent needs no email at all. The cookie settings link in the footer does it the moment you click, and section 2 says exactly what that stops and what it clears. Anything Google or Microsoft already holds is governed by their own policies from that point on, and we will point you at the right one if you ask.

In practice this is one email. Write to conference@bsidesdehradun.com and say what you want done. There is no form to fill in, no identity-verification gauntlet beyond replying from the address the data is about, and no fee. We will do it and tell you it is done. We are aiming at days, not the statutory maximum.

Two honest limits. We cannot delete something from a mailbox we do not control, so if you emailed a personal address rather than a project one, tell us which. And if a message has already been acted on, a village agreed or a sponsorship taken forward, it may leave a trace in notes about the event itself; we will tell you plainly if that is the case rather than claiming a clean erase.

10 · Questions and complaints

To be confirmed

The Act expects a named, reachable person to answer questions about personal data, and we have not yet decided which organiser that is. Naming a role nobody has agreed to hold, or publishing a privacy@ address that does not exist, would be worse than admitting the gap, an unanswered address is a broken promise with a professional veneer on it.

Until it is settled, everything on this page goes to conference@bsidesdehradun.com, which is read by the founding team and the team leads and is a working address today. It will be answered. What is missing is the name rather than the mailbox, so the chip stays until an organiser has agreed both to hold the role and to have their name on this page. When that happens the name and the address appear here and the chip goes.

If we get it wrong and you are not satisfied with how we handled it, the Act gives you a route to the Data Protection Board of India. We would much rather you came back to us first and gave us the chance to fix it.

11 · About this document

Version 0.10, last updated 27 August 2026. It is versioned separately from the terms, because the two change for different reasons and it should be possible to see which one moved. 0.10 replaced 0.9 when analytics and consent were added, which is a change of substance rather than of wording: the previous version described a site that measured nothing.

It was written by the organising team, not by a lawyer, and nobody qualified has read it yet. An advocate will, before this site is announced, and the reviewed text replaces this page rather than sitting beside it. That matters more now than it did: asking for consent and handing data to two companies outside India carries real obligations, and a page describing them is not the same as a practice that meets them. Nothing here is legal advice, and nobody organising this conference is in a position to give any.

If a claim on this page is wrong, that is worth more to us than a polite correction to the prose. Tell us and we will fix the page or fix the practice. Use the contact form, or the address above.