Privacy Policy

1. Who we are

Harnd ("we", "us") provides a design-harness tool for AI-assisted software development, operated at https://harnd.com.

Contact: hello@harnd.com. We have not yet finalized our formal business registration details. If you need our current operating details for any reason (for example, a data-protection inquiry), contact us at the email above and we will share them.

2. The short version

• Our CLI (harnd init, harnd scan, harnd validate) runs entirely on your machine, requires no account, and sends nothing over the network.
• We never collect your source code automatically. If you opt in to harnd sync, we receive metadata about your design system — names, file paths, usage, quality gates, and the text you or your AI wrote to describe them.
• The only code we extract is a single offending line attached to each quality-gate violation (max 200 characters), so you can see what was flagged, and the colour and spacing values that are in your code but not in your harness (the value alone, without the code around it). You can suppress the offending line with harnd sync --redact.
• Some fields (component, screen and pattern spec) are free-form text you write yourself. If you paste code there, it is sent. That is your choice, not our collection.
• Your data — your harness projection, your account and your waitlist entry — is stored in the United States; the global network our application runs on processes requests worldwide (see §5).

3. What we collect

3.1 Waitlist (you type it in)

Email address (required), and optionally your role, team size, which AI agents you use, your language, and the referral/UTM parameters of the page you signed up from.

3.2 Projected harness metadata (only if you run harnd sync)

harnd sync is opt-in and requires an API key you create. When you run it we receive:

• Design tokens — names and values (e.g. color.accent = #0a0a0a)
• Components, screens and patterns — names, file paths, routes, preview URLs, variants and states, and the free-form specification text you write (up to 20,000 characters each)
• Quality gates — rule names, severity, rationale, parameters, and the file-path patterns they apply to
• Intents — the meaning/purpose text you or your AI recorded, and whether you confirmed it
• Provenance — for each record, whether it was written by a human, generated by AI, or produced by a scan, including the name of the AI model used
• Usage — how often each token/component is referenced and in which files. This also includes the colour and spacing values we found in your code that are not in your harness — the literal value as written (for example #ff0000 or 13px), how many times it appears, and in how many files. This is what lets us show you what your project uses that your design system does not cover
• The instruction files we generate for your AI — the full text of .harnd/agents/harness.md and components.md (up to 200,000 characters each, at most 10 files). These are generated from your harness, so they hold your token and component names and the descriptions you or your AI wrote — not your source code
• Decisions — the "what / why / alternatives / reasoning" text you chose to record, plus file paths, a short change summary, and the git commit id
• Violations — file path, line number, rule, severity, and one offending line of code (≤200 characters)
• Harness metadata — its name, revision number, and a content hash used to avoid duplicate uploads

3.3 What we do not collect

We do not receive your repository contents, your file contents, your raw diffs, or your environment variables — there is no code path that transmits them. This is enforced on both sides: our CLI forwards an explicit allow-list of fields, and our server rejects any unknown field, any raw diff field, and any request over 5 MB. Where we accept a code field, it holds file paths only — there is nowhere to put file contents.

Two things are taken from your code mechanically rather than written by you: the single violation line described above, and the colour and spacing values listed under Usage. Neither carries surrounding code. Free-form spec and decision text is whatever you choose to write.

Before we store decision text and violation lines, we mask high-confidence secrets (database connection strings, API keys, and your home directory path).

Your .harnd/ files and your API key stay on your machine. The API key is stored in .harnd/credentials with owner-only permissions and is excluded from version control.

3.3b Two optional questions (after your harness has changed)

Once your harness has been synced enough times for the Health page to show how it has changed, we show a card there with two optional free-text questions: what you are building, and what made you try Harnd. Both are optional, nothing is withheld if you decline, and we ask only once: the card does not come back after you answer it or dismiss it. We store what you write (up to 2,000 characters each) with your account, and we delete it when we delete your account.

3.3c Your account

If you sign in, we store your email address, the account identifier our authentication provider (Supabase Auth) assigns you, and the display name it supplies, if any. If you sign in with Google, Google confirms your identity to us and passes us your email address, name, and Google account id. When you ask us to delete your account, we delete these records and the data attached to the account, including your answers to the two optional questions above. One thing is deliberately not deleted: entries in our audit log (§3.3d) remain, because they are the record of what happened in an organization — but they stop pointing at you. See §7 for how deletion works today.

3.3d Audit log and rate limiting

We keep an audit log of security-relevant actions inside an organization — who changed who can see a harness, and who issued or revoked an API key — with the time it happened. These entries are never edited or deleted; if you delete your account they stay, with the reference to you removed. They are deleted when the organization itself is deleted.

To stop abuse of endpoints such as the waitlist form, we count requests per sender over a short window. We store a salted hash of your IP address for this, not the address itself, and the counter expires with its window.

3.4 Server logs

We write one structured log line per API request (timestamp, event name, HTTP status, duration, harness id, and counts). Secrets and code are structurally excluded, and connection strings, API keys and home-directory paths are redacted before writing.

Separately, our infrastructure providers keep their own logs: Cloudflare records edge request logs including your IP address and User-Agent, Supabase records database connection logs, and Resend records email delivery. These are retained under those providers' own policies.

3.5 Cookies

• harnd_owner — operator sign-in.
• NEXT_LOCALE — remembers your display language. Set for all visitors by our internationalization middleware.
• sb-* — keeps you signed in. Set by Supabase Auth when you sign in; not set for signed-out visitors.

We do not use analytics or advertising cookies — our analytics (§3.6) sets none.

3.6 Analytics

We use Cloudflare Web Analytics to count page views, referrers, the path visited, country, device and browser type, and page-performance metrics (Core Web Vitals). It sets no cookies and stores nothing in your browser, and it does not build a profile of you across sites or sessions. Because it stores no information on your device, we do not ask for consent to place cookies. Cloudflare already processes every request to this site as our hosting and CDN provider (see §3.4), so this adds no new recipient of your data. Cloudflare retains this analytics data for up to six months.

We do not use Google Analytics.

4. Why we use it

• To operate the service (store and display your harness projection, run quality gates)
• To contact waitlist registrants about early access
• To diagnose failures and abuse (server logs, rate limiting)
• To learn who the product is for — two optional questions, shown once on the Health page after it has something to show about how your harness changed. Answering is not required, and nothing is withheld if you decline.

5. Where your data is stored

Our database (Supabase) is hosted in the United States (us-east-1), and our contract for it is with Supabase Pte. Ltd., a company established in Singapore. Our application runs on Cloudflare's global network, which may process your request in a country other than the United States even though your data ultimately rests in our United States database. If you access the service from outside the United States, your data is transferred there.

We are established in Japan. Under Japan's Act on the Protection of Personal Information (APPI, Art. 28), transferring personal data to a recipient in a foreign country requires a lawful basis even where the recipient acts only as our service provider. We rely on contractual safeguards: a data processing agreement is in force with each of our sub-processors, committing them to maintain protections equivalent to those required of a Japanese business operator. Google is the exception, because you reach it only by choosing to sign in with it: it confirms your identity to us under its own terms with you, rather than processing data on our instructions.

External environment (APPI Art. 32(1)(iv)): We have reviewed the personal-information protection regimes of the United States, where your data is stored and where the providers we contract with for running the application, delivering it and sending email are established, and of Singapore, where the company we contract with for that storage is established, and implemented our security measures on that basis. The global network our application runs on has locations in many countries, and your data is copied to them temporarily as you use the service. Because each request is routed to whichever location can serve it, we cannot give a complete list of those countries. Storage itself stays in the United States — those locations hold temporary copies only. Separately, our providers keep their own logs and analytics, retained under their own policies (see §3.4, §3.6 and §7).

We do not currently direct our service at individuals in the European Economic Area: we do not price or market in EU currencies or languages, and we run no EU-directed advertising. This reflects the markets we serve today, not a decision to keep the service away from Europe — it is a market we have not yet expanded into. If we later direct our service at people in the EEA, we will first put the corresponding safeguards, such as an EU/UK representative and the applicable data-subject rights, in place.

6. Who we share it with (sub-processors)

• Cloudflare — hosting, content delivery, edge request logs (incl. IP address), and receiving and forwarding email sent to our contact address
• Mailbox provider — the mailbox that mail forwarded from our contact address lands in. We will name the provider here once it is confirmed.
• Supabase — database (PostgreSQL), connection logs
• Resend — sending the waitlist confirmation email and sign-in magic links
• Google — confirming your identity if you choose "Continue with Google". Only reached if you pick that sign-in option

We do not sell or share your personal data with anyone other than the sub-processors listed above, and we receive no revenue from data. (We are not a "business" under the CCPA/CPRA: we meet none of its revenue or volume thresholds.)

Changes to this list. We will publish any new sub-processor on this page before it begins processing your data. If you object, you may stop using the Service and ask us to delete your data before the change takes effect.

6.1 AI models

We do not operate a language model, and we do not send your data to a model provider. harnd scan and harnd validate are ordinary static analysis running on your machine.

The meaning-making step — deciding what a component is for — is performed by your own AI agent, on your machine, reading your local .harnd/ files. That is between you and whichever AI provider you have chosen; we are not in that path, we do not see it, and their handling of your data is governed by their terms, not ours.

We do not use your data to train any model, ours or a provider's. If we ever offer a feature that calls a model on your behalf, it will be opt-in and invoked per action, the provider will appear in the sub-processor list above before it begins processing your data, and this no-training commitment will be carried into our contract with that provider.

Diagnostics. We currently collect no usage telemetry from the CLI — not even counts. If we start (for example, to learn that a scan found no tokens in a given project), we will say so here first and it will exclude your code, your token values, and your decision text.

7. How long we keep it

Our intended retention policy is:

• Waitlist registration — until you ask us to remove it, or 24 months after our last contact with you
• Harness projection (revisions, decisions, violations, API keys) — until the harness is deleted. Deleting a harness removes all of its projected data in the same operation
• API keys — 90 days after revocation (hash only)
• Your account, and your answers to the two optional questions — until you ask us to delete your account. These are attached to your account, not to a harness, so deleting a harness does not remove them
• Audit log entries — kept while the organization exists; deleted with it. Deleting your account removes the reference to you but leaves the entry
• Rate-limit counters (salted hash of an IP address) — until the counting window expires
• Our structured request logs — 90 days
• Provider-side logs (Cloudflare, Supabase, Resend) — per each provider's own policy; we do not control these

We are stating this honestly: scheduled automatic deletion is not yet implemented, and there is not yet a self-service delete button. Today, deletion happens when you ask us — email us and we remove your harness, which takes its revisions, decisions, violations and API keys with it. Deleting your account is a separate request — that is what removes your account record and your answers to the two optional questions. We aim to complete deletion requests within a reasonable time and will not claim a retention schedule we do not yet enforce. As our user base grows we intend to move to scheduled automatic enforcement of the table above; until then, this manual process is how we honor it.

8. Your rights

You can ask us to disclose the personal data we hold about you, correct it, delete it, or stop using it, by emailing hello@harnd.com. These are your rights under Japan's Act on the Protection of Personal Information, and we respond without undue delay. You can also revoke an API key at any time from your settings, which immediately stops further syncing with that key.

9. Security

API keys are stored only as hashes; the plaintext is shown once and never stored. Non-public harnesses are readable only by members of the owning organization. Requests to the sync endpoint are rate limited. High-confidence secrets are masked before decision text and violation lines are stored.

10. Changes

We will update this page and the "Last updated" date when this policy changes.

11. Beta notice

Harnd is in beta and provided free of charge. We may change or discontinue the beta at any time. If we discontinue it, we will post a notice on the Harnd website in advance and provide a reasonable window to export your data — your .harnd/ files already hold your canonical harness data on your own machine — or to request deletion of your cloud projection before shutdown.