These terms sit alongside the ethics agreement, the privacy policy and the refund policy. I've kept them as short and plain as I can.
Who these terms are between
BugClub HQ is run by me, Josh [FACT: surname], through [FACT: legal entity name], based in [FACT: city and state]. These terms are between that business and the parent or guardian of each student. A student can fill in the application, but a parent or guardian is part of every application, and they're the one agreeing to these terms. [FACT: confirm who the contracting party is with counsel]
Applying and getting a seat
- Applying is free and takes about five minutes. Nothing is charged and no account is created when you apply.
- BugClub HQ is for students who are 14 to 17 when the cohort starts.
- I read every application and reply by email within 5 business days. If it looks like a fit, I set up a short call with the student and a parent or guardian.
- Class size is 6, and applying doesn't guarantee a seat. Offering one is my decision. If the cohort is full, you're first in line for the next one.
- A seat is confirmed when [FACT: when a seat is confirmed, e.g. when payment arrives].
- Before week 1, the student and a parent or guardian both sign the ethics agreement. Week 1 stays locked until both signatures are in.
Paying
The course costs $349, paid once, in US dollars, and only if your kid is accepted. No subscription, nothing else to buy.
Once your kid is accepted, I'll send you an invoice. [FACT: payment method] Payment is due [FACT: when payment is due].
The parent or guardian who's the billing contact sees every charge, payment and receipt in their parent account.
If a school or sponsor pays for a seat, [FACT: how sponsored seats are invoiced and paid].
If $349 is a problem, tell me on the call or email hello@bugclubhq.com. It has no effect on whether your kid is accepted. [FACT: what help looks like, e.g. lower price or sponsored seat]
Refunds
Full refund any time during the first four weeks (through [FACT: refund deadline]), including before the course starts. I'll ask why, but the answer doesn't change whether you get it. The details are in the refund policy.
The ethics agreement and the rules
The ethics agreement is part of these terms. In short, a student agrees to:
- only touch the practice targets the course gives them
- leave real people and real systems alone. The one exception is week 5, when students look up what's public about themselves, and only with a guardian's opt-in. Without it, they use a sample profile.
- stop and write it up once they've shown a bug is real
- never ask for anything in exchange for a report, and never threaten to make a bug public
- keep course talk in the open, and keep their password to themselves
- not try what they learn anywhere real, and not post lab details or other students' work outside BugClub HQ
Students can't message each other. The student forum is the only place students talk to each other, and I review every post before it goes up. The only private thread a student has is with me, about their own write-ups and the week 7 disclosure.
[FACT: any other conduct rules, such as how students treat each other]
When the rules are broken
If a student breaks the ethics agreement, their lab access pauses until I've talked it through with them and their parent or guardian. Honest mistakes happen, and that conversation is how they get sorted out.
Testing a real system on purpose ends a student's place in the course. I can also hide or remove a forum post that breaks the rules.
[FACT: whether a student who's removed gets a refund]
[FACT: any other reasons a student can be removed]
Live sessions and recordings
Weeks 1 to 7 each have a live session, Tuesdays, 7 to 8:30 PM Eastern, on [FACT: live session platform]. Cameras: Cameras are optional. Students join with theirs on or off, whichever they're comfortable with.
During a session, students ask questions in the chat, stay muted until they're asked to speak, and never share findings from real programs or anyone's personal data.
Sessions are recorded for students who miss one, and I post the recording inside BugClub HQ for that cohort. If a student's camera or microphone is on, they're in the recording. [FACT: recording consent wording from counsel]
Recordings are for the cohort. Don't record a session yourself, and don't share a recording or its link outside the cohort.
Who owns what
Course materials. The readings, labs, practice apps, videos and templates belong to the business named above. Students and parents can use them for the course. Don't copy them, sell them or post them somewhere else.
Student work. A student's write-ups, notes, capstone report and the rest of their case file belong to the student. To run the course, I store that work, read it and give feedback on it, and agreeing to these terms lets me do that. The case file stays in their account after the cohort ends. [FACT: how long it stays, and whether students can export it]
[FACT: what the course does with student work beyond that, e.g. never shares it, or asks first before using an excerpt as an example]
What the course is and isn't
BugClub HQ is an eight-week course: one self-paced week, then seven with a live session. It teaches students to find security bugs in practice apps and report them the right way. It isn't accredited, and it doesn't come with an accredited certificate.
Nothing in the course gives anyone permission to test a real system. Permission only ever comes from whoever owns it.
[FACT: what happens if a live session is cancelled]
[FACT: limitation of liability, warranties and governing law from counsel]
Changes to these terms
When I change these terms, I'll update the date at the top. [FACT: how changes apply to families who are already enrolled]
How to reach me
Email hello@bugclubhq.com. You can also write to [FACT: mailing address].