Privacy policy.

The short version

• What the apps find about your devices, your traffic and your HARD codes stays on your devices. The apps don’t send it to us.
• The apps download public lists (phishing sites, criminal networks, published security flaws). To look something up, they send a product name, a router model or a domain name to the public service that answers.
• Text leaves your device for an AI model only when you ask: the Operator chat and the optional second opinion send it to Anthropic, and the app says so first.
• On this website, we keep the email address and details you give us in a form, and we count visits.
• We don’t sell personal information, and we don’t use it for advertising.

Who we are

HARD is a trading name of FLINDEV PTY LTD, a company registered in Australia (“HARD”, “we”, “us”). We are responsible for the personal information described here. HARD is used worldwide, so this policy is written for the Australian Privacy Act 1988 and its Australian Privacy Principles, and for the EU and UK General Data Protection Regulation (GDPR) where it applies to you.

This policy covers hard.fyi, HARD for Mac, HARD for iPhone, the HARD browser extension, and HARD Operator. HARD is in early access, and this policy describes the apps as they work today. Where something is still coming, we say so.

This website

Forms

When you send a form on hard.fyi, we store what you entered in a Cloudflare database (Cloudflare Workers KV):

Email alerts and early access

Your email address, the page you signed up on, and the time.

Introduction to HARD Operator

Your name, email address, and, if you give them, your phone number and how you heard about us, with the time. We keep your latest request.

Support and security reports

Your email address, what it’s about, your message, and, if you give them, your name and device, with the page and the time. Each request is kept separately.

To limit abuse, we count form posts from each IP address. The count is deleted automatically after one hour, and we don’t store the IP address with anything you send.

Visits

We use Stickybeak, a web analytics service, to count visits to pages and a few events, such as a form being sent successfully (with the page it was sent from). Its script is served from hard.fyi. We use it to see which pages are read and which forms work, not to build profiles of people.

This site is hosted by Cloudflare, which handles every request to it, including your IP address, to deliver the page and protect the site.

Third parties your browser contacts

• The home page loads a graphics library from cdn.jsdelivr.net, which receives your IP address with the request.
• The essay Everyone will be hacked asks ipinfo.io (or ipapi.co, if that fails) where your connection is, to show you what any site can learn about you. Your browser asks them directly. We don’t receive or keep the answer.

We don’t use advertising cookies or advertising trackers. The site stores your light or dark theme choice in your browser.

The apps and extension

HARD’s promise is that it sees the attack, not your life. The apps look for what’s used against people (fake sites, scam messages, cloned voices, software with holes attackers are using) and keep what they find on your devices. The apps don’t send your data to HARD.

What stays on your device

• HARD for Mac’s checks of your Mac, its findings and activity, the programs online in Live and how much each sent, the firewall’s log and your rules, Wi-Fi scan results, and the Operator chat history. All of it is kept in ~/Library/Application Support/HARD/ on your Mac.
• HARD codes. The secret behind each pair is created on your device and kept in its Keychain, never synced to a server or included in backups. Codes are never sent anywhere.
• Messages you check with Is this legit?, unless you ask for a second opinion (below).
• On iPhone, the scam-text filter. It runs on the phone.

What the apps download, and what they send to look things up

To do their job, the apps download public information and ask public services questions. These requests come from your device, so the service receives your IP address. We don’t receive them.

HARD for Mac also checks whether someone is intercepting your connections by connecting to well-known sites, such as google.com, apple.com, github.com and Microsoft’s sign-in page.

Claude and Anthropic

Two features use Claude, an AI model made by Anthropic. Both are your choice, and the app says so before you send anything:

• The second opinion in Is this legit? on the Mac, when you tick it, sends the text you’re checking.
• The Operator chat sends your message, the recent conversation, any screenshots you attach, and a summary of what HARD found on your Mac that needs attention.

In the current early-access version, HARD for Mac reaches Claude through Anthropic’s Claude Code on your Mac, so the request is made under your Anthropic account and Anthropic’s own terms and privacy policy apply. Never send passwords, one-time codes or recovery keys.

Secure DNS and Cloudflare

If you turn on Secure DNS in HARD for Mac, your Mac sends its DNS lookups (the names of the sites and services it connects to) to Cloudflare’s 1.1.1.1 resolvers, encrypted. Cloudflare’s resolver privacy policy applies. It’s off until you choose it.

The browser extension

To protect you, the extension reads the pages you visit in your browser: their addresses, and the parts of a page that matter for its checks, such as sign-in forms, payment buttons and field labels. It does this in your browser. It doesn’t send pages or what you type anywhere.

• Stored in your browser: its settings, the sites you’ve marked as your bank, your payment threshold, a log of what it stopped, and, for its password alert, a salted one-way hash and the length of passwords you use on the real sign-in pages of brands like Google, Microsoft and Apple. Never the passwords themselves. Payment pause timers are cleared when the browser quits.
• Sent to rdap.org: a domain name, only when an address already looks suspicious, to see how recently it was registered.
• Downloaded: the phishing list, every 12 hours.
• Sent to HARD for Mac, on your Mac, if it’s installed: the site’s name, what HARD did, HARD’s own wording, and for a paused payment, a rough size range and the reasons. Never the amount, the payee, an account number, a crypto address or the page.

HARD for iPhone

iOS gives HARD’s text filter texts from numbers that aren’t in your contacts. HARD checks them on the phone and tells iOS whether to send them to Junk. Nothing is sent anywhere. Apple handles the app’s delivery and updates under its own terms.

Family and managed accounts

On the Family plan, an organiser can manage HARD for someone they look after. When this is switched on for your family, an organiser sees that person’s important alerts (for example, a transfer HARD paused or a fake site it stopped) and what needs fixing on their devices. They don’t see that person’s messages, browsing or bank balance.

Family sharing is still being finished in early access. Before it’s switched on, we’ll update this policy to say exactly what is shared and where it’s stored. An organiser must have the person’s agreement before managing their HARD.

HARD Operator

HARD Operator members choose to share more, so their engineer can protect them: what HARD sees across the household, and what members tell their engineer about their accounts, devices, homes and people during discovery and after. We use it only to protect the household, keep it confidential, and can sign an NDA.

The details of what’s shared, where it’s kept and for how long are agreed with each household before membership starts, and written into the agreement.

How we use information

To send alerts

With your consent, which you can withdraw at any time.

To answer you

Support requests and introduction requests, to do what you asked.

To provide HARD

Early access places, your plan and HARD Operator, under our agreement with you.

To keep HARD safe

Limiting abuse of our forms and protecting the site, which is in our and our users’ legitimate interests.

To improve the site

Counting visits and form use, in our legitimate interests.

Because the law says so

For example, keeping tax records, or answering a valid legal request.

Who we share it with

We don’t sell personal information. We share it only with the services that help us run HARD, under contracts that limit what they can do with it:

• Cloudflare: hosting this site, and storing what you send in our forms.
• Stickybeak: counting visits and events.
• The service we use to send email, when we write to you.
• Anthropic, only for the Claude features described above, and only when you use them.

We may also disclose information if the law requires it, to protect someone’s safety, or if HARD’s business is sold, in which case this policy continues to apply.

Where it’s stored

We’re in Australia. Cloudflare stores and serves data on its global network, and Anthropic, Cloudflare’s DNS resolver and some of the public services the apps use are based in the United States. Where we send personal information outside Australia, the EU or the UK, we rely on our providers’ commitments, including standard contractual clauses where they apply, to protect it to the same standard.

How long we keep it

• Alert and early access emails: until you ask us to remove you, or we stop sending alerts.
• Introduction and support requests: as long as we need to deal with them and keep a record of what was agreed, then deleted. You can ask us to delete them sooner.
• The form-abuse counter: one hour.
• Data in the apps and extension: on your devices, until you delete it or the app. See Uninstalling.

Security

We keep what we collect to a minimum, and the apps keep what they find on your devices. Our stored data is accessible only to the people who need it to run HARD. No system is perfectly secure; if we learn of a breach that’s likely to cause you serious harm, we’ll tell you and the regulator as the law requires. To report a vulnerability, see Security.

Your rights

Wherever you live, you can ask us:

• what personal information we hold about you, and for a copy;
• to correct it;
• to delete it;
• to stop sending you alerts (withdrawing your consent).

Under the GDPR you can also object to our use of your information, ask us to restrict it, and ask for it in a portable form. You can complain to your local data protection authority.

We’ll confirm who you are before acting on a request, and answer within the time the law allows: 30 days under the Australian Privacy Principles, and one month under the GDPR. To make a request, use the support form and choose Privacy and your data.

Children

The website and our forms are for adults. A Family plan can include children, added by a parent or guardian who is an organiser and who is responsible for their consent. We don’t knowingly collect personal information from a child through this site; if you think we have, tell us and we’ll delete it.

Changes

When HARD changes what it collects or where it goes, we’ll update this page and the date at the top before the change takes effect. If a change is significant, we’ll also tell you in the app or by email.

Contact and complaints

For anything about your privacy, use the support form and choose Privacy and your data. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the data protection authority where you live.