Privacy Policy

1. Who we are

Harnd ("we", "us") provides a design-harness tool for AI-assisted software development, operated at https://harnd.com.

Contact: hello@harnd.com. We have not yet finalized our formal business registration details. If you need our current operating details for any reason (for example, a data-protection inquiry), contact us at the email above and we will share them.

2. The short version

• Our CLI (harnd init, harnd scan, harnd validate) runs entirely on your machine, requires no account, and sends nothing over the network.
• We never collect your source code automatically. If you opt in to harnd sync, we receive metadata about your design system — names, file paths, usage, quality gates, and the text you or your AI wrote to describe them.
• The only code we extract is a single offending line attached to each quality-gate violation (max 200 characters), so you can see what was flagged. You can suppress it with harnd sync --redact.
• Some fields (component, screen and pattern spec) are free-form text you write yourself. If you paste code there, it is sent. That is your choice, not our collection.
• Data is stored in the United States.

3. What we collect

3.1 Waitlist (you type it in)

Email address (required), and optionally your role, team size, which AI agents you use, your language, and the referral/UTM parameters of the page you signed up from.

3.2 Projected harness metadata (only if you run harnd sync)

harnd sync is opt-in and requires an API key you create. When you run it we receive:

• Design tokens — names and values (e.g. color.accent = #0a0a0a)
• Components, screens and patterns — names, file paths, routes, preview URLs, variants and states, and the free-form specification text you write (up to 20,000 characters each)
• Quality gates — rule names, severity, rationale, parameters, and the file-path patterns they apply to
• Intents — the meaning/purpose text you or your AI recorded, and whether you confirmed it
• Provenance — for each record, whether it was written by a human, generated by AI, or produced by a scan, including the name of the AI model used
• Usage — how often each token/component is referenced and in which files
• Decisions — the "what / why / alternatives / reasoning" text you chose to record, plus file paths, a short change summary, and the git commit id
• Violations — file path, line number, rule, severity, and one offending line of code (≤200 characters)
• Harness metadata — its name, revision number, and a content hash used to avoid duplicate uploads

3.3 What we do not collect

We do not receive your repository contents, your file contents, your raw diffs, or your environment variables — there is no code path that transmits them. This is enforced on both sides: our CLI forwards an explicit allow-list of fields, and our server rejects any unknown field, any raw diff field, and any request over 5 MB. Where we accept a code field, it holds file paths only — there is nowhere to put file contents.

The only code we extract mechanically is the single violation line described above. Free-form spec and decision text is whatever you choose to write.

Before we store decision text and violation lines, we mask high-confidence secrets (database connection strings, API keys, and your home directory path).

Your .harnd/ files and your API key stay on your machine. The API key is stored in .harnd/credentials with owner-only permissions and is excluded from version control.

3.4 Server logs

We write one structured log line per API request (timestamp, event name, HTTP status, duration, harness id, and counts). Secrets and code are structurally excluded, and connection strings, API keys and home-directory paths are redacted before writing.

Separately, our infrastructure providers keep their own logs: Cloudflare records edge request logs including your IP address and User-Agent, Supabase records database connection logs, and Resend records email delivery. These are retained under those providers' own policies.

3.5 Cookies

• harnd_owner — operator sign-in.
• NEXT_LOCALE — remembers your display language. Set for all visitors by our internationalization middleware.

We do not use analytics or advertising cookies.

4. Why we use it

• To operate the service (store and display your harness projection, run quality gates)
• To contact waitlist registrants about early access
• To diagnose failures and abuse (server logs, rate limiting)

5. Where your data is stored

Our database (Supabase) is hosted in the United States (us-east-1). Our application runs on Cloudflare's global network, which may process your request in a country other than the United States even though your data ultimately rests in our United States database. If you access the service from outside the United States, your data is transferred there.

We are established in Japan. Under Japan's Act on the Protection of Personal Information (APPI, Art. 28), transferring personal data to a recipient in a foreign country requires a lawful basis even where the recipient acts only as our service provider. We rely on contractual safeguards: we are formalizing a data processing agreement with each of our sub-processors, committing them to maintain protections equivalent to those required of a Japanese business operator.

External environment (APPI Art. 32(1)(iv)): We have reviewed the personal-information protection regime of the United States, where your data is stored, and implemented our security measures on that basis.

We do not currently direct our service at individuals in the European Economic Area: we do not price or market in EU currencies or languages, and we run no EU-directed advertising. This is a deliberate operating decision that we review if our target market changes, not merely an incidental fact about where our first users happen to be.

6. Who we share it with (sub-processors)

• Cloudflare — hosting, content delivery, edge request logs (incl. IP address)
• Supabase — database (PostgreSQL), connection logs
• Resend — sending the waitlist confirmation email and sign-in magic links

We do not sell or share your personal data with anyone other than the sub-processors listed above, and we receive no revenue from data. (We are not a "business" under the CCPA/CPRA: we meet none of its revenue or volume thresholds.)

Changes to this list. We will publish any new sub-processor on this page and give at least 30 days' notice before it begins processing your data. If you object, you may stop using the Service and ask us to delete your data before the change takes effect.

6.1 AI models

We do not operate a language model, and we do not send your data to a model provider. harnd scan and harnd validate are ordinary static analysis running on your machine.

The meaning-making step — deciding what a component is for — is performed by your own AI agent, on your machine, reading your local .harnd/ files. That is between you and whichever AI provider you have chosen; we are not in that path, we do not see it, and their handling of your data is governed by their terms, not ours.

We do not use your data to train any model, ours or a provider's. If we ever offer a feature that calls a model on your behalf, it will be opt-in and invoked per action, the provider will appear in the sub-processor list above under the 30-day notice, and this no-training commitment will be carried into our contract with that provider.

Diagnostics. We currently collect no usage telemetry from the CLI — not even counts. If we start (for example, to learn that a scan found no tokens in a given project), we will say so here first and it will exclude your code, your token values, and your decision text.

7. How long we keep it

Our intended retention policy is:

• Waitlist registration — until you ask us to remove it, or 24 months after our last contact with you
• Harness projection (revisions, decisions, violations, API keys) — until the harness is deleted. Deleting a harness removes all of its projected data in the same operation
• API keys — 90 days after revocation (hash only)
• Our structured request logs — 90 days
• Provider-side logs (Cloudflare, Supabase, Resend) — per each provider's own policy; we do not control these

We are stating this honestly: scheduled automatic deletion is not yet implemented, and there is not yet a self-service delete button. Today, deletion happens when you ask us — email us and we remove your harness, which takes its revisions, decisions, violations and API keys with it. We aim to complete deletion requests within a reasonable time and will not claim a retention schedule we do not yet enforce. As our user base grows we intend to move to scheduled automatic enforcement of the table above; until then, this manual process is how we honor it.

8. Your rights

You can request access to, correction of, or deletion of your personal data by emailing hello@harnd.com. You can revoke an API key at any time from your settings, which immediately stops further syncing with that key.

9. Security

API keys are stored only as hashes; the plaintext is shown once and never stored. Non-public harnesses are readable only by members of the owning organization. Requests to the sync endpoint are rate limited. High-confidence secrets are masked before decision text and violation lines are stored.

10. Changes

We will update this page and the "Last updated" date when this policy changes.

11. Beta notice

Harnd is in beta and provided free of charge. We may change or discontinue the beta at any time. If we discontinue it, we will notify registered users by email in advance and provide a reasonable window to export your data — your .harnd/ files already hold your canonical harness data on your own machine — or to request deletion of your cloud projection before shutdown.