Privacy Policy

Introduction

Hardroad, Inc. is committed to protecting online privacy. We carefully protect your data from loss, misuse, unauthorized access or disclosure, alteration, or destruction. Users may receive communications about services and can opt out of future mailings.

Information Collection

Hardroad collects personally identifiable information from visitors who register, purchase products, or seek information. This encompasses name, address, telephone number, e-mail address, credit card number and expiration date, password, purchase history, IP address and related browsing data.

Use of Information

Hardroad uses collected data to provide services, respond to inquiries, and market products. The company may transfer personal information to third parties including advisors, service providers, regulatory authorities, and business partners. In acquisition scenarios, the company may transfer data to buyers as business assets. Anonymous aggregated demographic information may be shared with third parties.

Cookies and Analytics

We use cookies and Google Analytics to understand how visitors use our site. This includes pages visited, time on site, and general location (city/country). Google Analytics uses cookies to collect this data anonymously. You can opt out by declining cookies when prompted or by installing the Google Analytics Opt-out Browser Add-on.

Google User Data

This section describes how Hardroad handles information obtained through Google APIs (“Google user data”). It takes precedence over every other section of this policy. Where anything else in this policy would permit a broader use, sharing, or transfer of your information, that broader permission does not apply to Google user data.

What we access, and why

Hardroad requests access to your Google account only when you start a connection yourself, and only for the feature you are connecting. Before you reach Google's consent screen, Hardroad shows you in-app exactly which permissions will be requested and what each one is used for.

• Google Calendar — .../auth/calendar and .../auth/calendar.events. We read your calendar list so you can choose which calendars Hardroad plans around, and we read the events on those calendars so Hardroad knows when you are busy. We create and update events for the tasks and habits you schedule from the Hardroad planner. This is used only to operate the calendar sync and scheduling features you turned on.
• Google Contacts — .../auth/contacts.readonly. We read contact names, email addresses and phone numbers so you can choose which of them to import into Hardroad, and then assign tasks, invite collaborators and share goals without retyping addresses. This access is read-only: Hardroad cannot add, change or delete anything in your Google Contacts. Contacts you do not select during import are not stored.
• Google account identity — openid, .../auth/userinfo.email and .../auth/userinfo.profile. Your name, profile picture and email address, used to label which Google account a connection belongs to so you can tell two connected accounts apart, and to sign you in if you chose Google sign-in.

Limited Use

Hardroad's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we never do with Google user data

• We never sell, rent, or trade it.
• We never transfer it to third parties — including advertising networks, data brokers, business partners, or other information resellers. The transfers described under “Use of Information” above do not apply to Google user data.
• We never use it for advertising, remarketing, or ad personalisation of any kind.
• We never use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. The research, experimentation and model-development activities described under “Experiments and Research” above, and in our Terms of Service, exclude Google user data entirely: it is never included in de-identified research datasets, published research, or model training.
• Hardroad staff do not read your calendar events or your contacts. The only exceptions are the narrow ones Google's policy permits: where you have given us explicit permission to look at specific data (for example when you ask support to investigate a problem), where it is necessary for security purposes such as investigating abuse, or where we are required to by law. Any such access is limited to what the purpose requires.

Where it is stored, and who can reach it

Google user data and the OAuth tokens that authorise access are held in Hardroad's database on Google Cloud Platform in the United States, which encrypts data at rest, and is transmitted over TLS. Tokens are never sent to your browser or to any client application — only Hardroad's servers use them. Access to the production systems that hold this data is limited to the staff who operate the service.

We do not share Google user data with any third party. We may disclose it if we are legally compelled to, and where we are permitted to do so we will make reasonable efforts to notify you first. If Hardroad is ever acquired or merged, Google user data will continue to be handled under this policy, and you will be given notice and the opportunity to disconnect and delete it before any transfer takes effect.

How long we keep it

Hardroad keeps the Google data needed to run the features you connected for as long as that connection is active: the calendars you selected and their events, and the contacts you chose to import. Contacts and calendar events you have imported or synced become part of your Hardroad planning history and are kept until you delete them in the app or delete your Hardroad account.

How to disconnect and delete

• Disconnect a calendar account in Hardroad under Settings → Calendars. This deletes the stored Google token and the calendar records for that account, and stops all further access.
• Revoke Hardroad's access at Google at any time from myaccount.google.com/permissions. This immediately stops any further access, for every scope you granted.
• Ask us to delete what we already hold — including the contacts grant, synced events, and imported contacts — using the request routes on our Data Deletion & Retention page.

Deleting your Hardroad account deletes all Google user data we hold for you. See Data Deletion & Retention for the full process and timelines.

Financial Account Data

This section describes how Hardroad handles information about your bank, credit card, brokerage, and retirement accounts. It takes precedence over every other section of this policy. Where anything else in this policy would permit a broader use, sharing, or transfer of your information, that broader permission does not apply to financial account data.

How the connection works

Hardroad connects to your financial institutions through Plaid, a financial data provider. You connect an institution yourself; Hardroad never initiates a connection on your behalf.

Your bank username and password are entered with Plaid and go to your bank. Hardroad never receives, sees, or stores them. Plaid handles that exchange and returns an access credential to Hardroad, which is what lets us read the account data you agreed to share.

What we receive

• Account details — the institution name, account name, account type, and the last four digits only of the account number. We never receive or store a full account number.
• Balances — current and available balances.
• Transactions — date, amount, merchant or description, and the institution's own category, for the accounts you connect.
• Investment holdings — for brokerage and retirement accounts, the securities held, their quantities, and the values your institution reports.
• Loan and credit details — balances, interest rates, and payment dates, for accounts where your institution provides them.

What we use it for

Financial account data is used to show you your own finances inside Hardroad: your net worth, your spending against a budget, how much room you have left in tax-advantaged accounts, and a projection of what your savings reach by retirement. It is also used to recognise a contribution to a retirement account so that the corresponding goal and habit update.

Transaction descriptions may be sent to an AI provider for the sole purpose of assigning a spending category, and only where our own rules and your previous corrections cannot categorise a transaction. That provider operates under a zero data retention arrangement: it does not retain the data and does not use it to train models.

Hardroad cannot move your money

Hardroad's access is read-only. We do not request permission to transfer funds, make payments, buy or sell investments, or take any other action on your accounts, and the application contains no ability to do so. When you want to move money, Hardroad links you out to your own institution's app or website, where you act directly with them.

What we never do with it

• We never sell, rent, or trade your financial account data.
• We never transfer it to third parties — including advertising networks, data brokers, business partners, or other information resellers.
• We never use it for advertising, remarketing, or ad personalisation of any kind.
• We never use it to make or inform decisions about you. It is not used for credit decisions, lending, insurance, employment, tenancy, risk scoring, or any similar assessment, and it is never provided to anyone who makes such decisions.
• We never use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. The research, experimentation and model-development activities described under “Experiments and Research” above, and in our Terms of Service, exclude financial account data entirely: it is never included in de-identified research datasets, published research, or model training.
• Hardroad staff do not read your transactions or balances. The only exceptions are where you have given us explicit permission to look at specific data (for example when you ask support to investigate a problem), where it is necessary for security purposes such as investigating abuse, or where we are required to by law. Any such access is limited to what the purpose requires.

Where it is stored, and who can reach it

Financial account data is held in Hardroad's database on Google Cloud Platform in the United States, which encrypts data at rest, and is transmitted over TLS.

The access credential that authorises reading your accounts is not stored in our database. It is held in a dedicated secrets service, and the database records only a reference to it. It is never sent to your browser or to any client application — only Hardroad's servers use it. Access to the production systems that hold this data is limited to the staff who operate the service.

We do not share financial account data with any third party. We may disclose it if we are legally compelled to, and where we are permitted to do so we will make reasonable efforts to notify you first. If Hardroad is ever acquired or merged, financial account data will continue to be handled under this policy, and you will be given notice and the opportunity to disconnect and delete it before any transfer takes effect.

How long we keep it

Hardroad keeps the financial data needed to run the features you connected for as long as that connection is active. Transactions and balances become part of your Hardroad financial history and are kept until you disconnect the institution, delete them in the app, or delete your Hardroad account.

How to disconnect and delete

• Disconnect an institution in Hardroad under Settings → Accounts. This ends Plaid's access to that institution, deletes the stored access credential, and stops all further data collection.
• Manage your connections at Plaid at any time from my.plaid.com, where you can see every app connected to your accounts and revoke access.
• Ask us to delete what we already hold — including transactions, balances, and holdings — using the request routes on our Data Deletion & Retention page.

Deleting your Hardroad account deletes all financial account data we hold for you. See Data Deletion & Retention for the full process and timelines.

Experiments and Research

If you opted in to research at signup (or later in Settings), your de-identified data may be used in scientific research as described in the Broad Research Consent you accepted. You can withdraw at any time in Settings → Privacy & Research, and withdrawing never changes your Hardroad experience.

Data Security

The company implements physical, electronic, and managerial procedures to prevent unauthorized access and uses various electronic means to keep transaction information transferred over the Internet as secure as generally available transaction technology reasonably permits.

Children's Privacy

Hardroad does not collect information from children 12 years old and younger except as permitted by law.

Third-Party Collection

Third-party sponsored promotions may collect information independently. Hardroad encourages users to review those parties' privacy policies.

Contact and Links

Users can contact the company at webmaster@hardroad.app. External links lead to uncontrolled sites and we recommend reviewing their privacy notices.

We Do Not Sell Your Data

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

Your Rights

You can request to see, correct, or delete your personal data at any time. California residents have additional rights under CCPA, including the right to know what data we collect and to opt out of any sale (we don't sell data). EU residents have similar rights under GDPR. To exercise any of these rights, email us at webmaster@hardroad.app.

Data Retention

We keep your data only as long as needed to provide our services or as required by law. Analytics data is retained for 14 months.

Opt Out of Communications

Enter your email below to unsubscribe from marketing communications.

Policy Changes

The company reserves the right to update this policy and will inform users of material changes in advance.