LEGAL / PRIVACYYour account.
Your repositories.
This notice describes data handled by the current HARIKOS application. It does not claim fixed retention periods, data residency, certifications, or a complete account-deletion workflow.
LAST UPDATED / SEPTEMBER 27, 202601INFORMATION IN THE SERVICE
When you sign in, HARIKOS receives account identifiers and profile information made available by Google or GitHub, such as provider ID, login, email, display name, and avatar. The service stores account and subscription records; authorized GitHub installation and repository identifiers and metadata; scan status and commit IDs; derived claims and their evidence pointers (including file paths, line ranges, commit IDs, and content hashes); changes, contradictions, Memories, Context Packs, agent connection metadata, sessions, outcomes, and usage state. Task text and agent outcome text are stored when you create or submit them.
HOW WE USE IT
HARIKOS uses this information to authenticate accounts, enforce ownership and access, connect authorized repositories, scan selected files, show project state and history, provide Context and MCP functions, maintain billing entitlement, send transactional account and trial messages, protect the service, and troubleshoot service operation. HARIKOS does not intentionally keep a general-purpose full repository mirror; source is fetched for bounded processing and derived project records are persisted. Do not submit secrets or personal information that is not needed for your task.
PROVIDERS AND RECIPIENTS
The current implementation uses Supabase for authentication and PostgreSQL persistence, GitHub for identity/repository authorization and repository data, Paddle for billing and subscription records when configured, and Resend for transactional email when configured. If PostHog is configured, HARIKOS sends a limited set of explicit product events and an internal account identifier; automatic page-view capture, autocapture, performance capture, exception capture, and session recording are disabled in the application configuration. Provider processing locations and account-specific settings are not established by this notice. Each provider may process information under its own terms and privacy notices.
COOKIES AND ANALYTICS
Supabase session cookies are used for sign-in and authenticated service access. When product analytics is configured, PostHog may use browser storage needed for its identified-user event analytics. The application sends only the named product events and limited event properties implemented in the current code; analytics configuration can be absent.
RETENTION AND CONTROL
The application does not currently publish fixed retention periods, a self-serve account deletion control, or an account-wide deletion workflow. Signing out ends the active session; revoking GitHub access or an agent token limits future access but does not itself erase previously stored records. You can submit an access, correction, or deletion request by emailing the contact below. There is not yet a published request-fulfillment workflow, response time, or backup-erasure schedule.
SHARING AND SALE
The current product does not include a personal-data sale or targeted-advertising feature. Information is sent to the providers described above for the service functions they perform, and to others where you direct it or where required to operate, protect, or comply with legal obligations. HARIKOS does not currently offer a self-serve advertising opt-out or data-rights portal.
SECURITY AND CONTACT
The service uses authenticated server-side access controls and separate provider authorization boundaries. No security certification or absolute security guarantee is claimed. For privacy questions or a request concerning your information, contact ashyeagerhq@gmail.com.
JURISDICTION-SPECIFIC DETAILS
The legal operator and its address, provider processing locations, retention schedule, and final assessment of which U.S. state and Oman privacy-law obligations apply have not been supplied or verified. This notice describes observed product handling; it does not represent that a particular statutory regime applies or that all requirements have been independently audited.
