Privacy Policy

Last updated: 2026-05-19

The short version

harnx collects your email, what plan you're on, how much you've used the AI features, and the things you actually send to the AI. That's it. We don't sell anything, we don't track you across the web, and we don't read your code for fun.

What we collect

Account data

  • Email + password hash. Required to sign in. Passwords are stored as scrypt hashes — we never see the plaintext.
  • Stripe customer ID + subscription status. We don't store your card number. Stripe holds payment details under their own privacy policy.

Usage data

  • Monthly request count + token usage. So we can enforce plan caps and show you how much you've used.
  • Per-purpose tags (chat, commit message, dictation, etc.) for the same reason.
  • Transcription seconds for the dictation cap.

AI request content

When you use chat, commit messages, AI merge, dictation, or any other AI feature, the prompt and the file context you attach travel through our proxy to upstream providers. Those providers operate under zero-retention policies for API traffic — they don't train on your data and they purge it within their own retention windows.

We do not log AI request bodies or responses on our side. Token counts (input + output) are stored for billing; the actual content is not.

Desktop client

The desktop app stores your terminal scrollback, chat history, and project backlog locally on your machine. None of that data is transmitted to our servers unless you explicitly send it through an AI request.

What we don't collect

  • No analytics or telemetry pings.
  • No third-party cookies, no Google Analytics, no Segment.
  • No keystroke logging, no scrollback exfiltration.
  • No browsing history or anything outside the app itself.

Cookies

One session cookie (HttpOnly, Secure, SameSite=Lax) for signed-in users on harnx.dev. No tracking cookies, no third-party cookies.

Sharing

We share data only with:

  • Stripe — for subscription billing.
  • Anthropic + OpenAI — when you make AI requests, proxied through our server. We strip embedded secrets (API keys, PEM blocks) from the request body before forwarding, best-effort.
  • Law enforcement — if compelled by a valid legal request. We'll notify you unless legally prohibited.

We don't sell or rent personal data. Ever.

Your rights

You can:

  • Delete your account and all associated data — settings → account → sign out and wipe local data, plus email us to delete the server-side row.
  • Correct anything we have on file — email us with the change.

Retention

  • Account row: until you delete it.
  • Session cookies: 30 days.
  • Stripe webhook event log: 90 days for idempotency / dispute reconciliation.
  • AI request bodies: not retained.

Contact

[email protected]