Privacy Policy
Version 1.0, effective 10 September 2026
1. Who is responsible for your data
The data controller is Oleksandr Tykhonov, running a sole proprietorship under the name Oleksandr Tykhonov, NIP 9542859404, REGON 526238763, ul. Tunelowa 22E, 40-676 Katowice, Poland ("Harder", "we").
Privacy contact: privacy@harder.pro. We have not appointed a Data Protection Officer because the law does not require one at our size.
This policy applies to the Harder iOS app, the web application at harder.pro, our blog and marketing site, and emails we send you.
2. Summary
- We collect what is needed to run a challenge platform: your account details, your Spaces, the Challenges you create and join, your Proofs, and your messages.
- We do not sell your data and we do not show advertising.
- Health data from Apple Health is read only if you choose to turn on verification, only as daily totals, and only to verify your challenge actions.
- Your data is stored in the European Union (AWS, Frankfurt region).
- You can delete your account at any time from Settings. Deletion is immediate.
3. What data we collect and why
| Category | Examples | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Account data | Name, nickname, email, password hash, timezone, birth year, age-verified flag, terms version accepted | Create and secure your account, confirm you are 16 or older, prove agreement | Contract (Art. 6(1)(b)); legal obligation for age check (6(1)(c)) | While the account exists |
| Sign-in data | Google or Apple identifier and email, passkey public key, device name of each login | Sign you in | Contract | While the account exists or until you remove the login method |
| Spaces | Title, slug, description, thumbnail, followers | Your public profile | Contract | While the account exists |
| Challenges and Actions | Names, descriptions, schedules, images, categories, tags, visibility | Run the service | Contract | Until you delete them or the account |
| Proofs | Text, photos, videos, completion times, comments | Show your progress to you and to the participants of that Challenge | Contract | Until you delete them or the account |
| Health data (optional) | Daily step count, walking and running distance, exercise minutes, mindful minutes, workout sessions, and which app or device recorded them | Verify challenge actions | Explicit consent (Art. 9(2)(a)), see section 9 | Until consent is withdrawn or the proof, Challenge, or account is deleted |
| Messages | Direct messages between Spaces, blocks, reports | Messaging, safety | Contract; legitimate interest in safety (6(1)(f)) | Until you delete the account; reported messages up to 12 months for moderation records |
| Interests and onboarding | Interests you select, onboarding progress | Recommend Challenges | Contract | While the account exists |
| Usage and technical data | IP address, device type, app version, language and region codes, request logs, error reports | Security, debugging, abuse prevention, rate limiting | Legitimate interest in running a secure service | Logs up to 30 days; aggregated statistics indefinitely |
| Notification data | Push token, notification preferences, delivery and open status | Send and manage notifications | Contract; consent for optional categories | Until you unregister the device or delete the account |
| Payment data | Plan, billing interval, invoices, last 4 card digits, Stripe customer id | Paid features, accounting | Contract; legal obligation (tax and accounting records) | Accounting records for the period required by Polish law (currently 5 years after the tax year) |
| Creator data | Stripe Connect account status, payout status | Creator Program | Contract | While you are a Creator, then accounting retention |
| Moderation records | Flags, AI confidence scores, admin decisions, reports, appeals | Enforce the community rules, respond to reports | Legitimate interest; legal obligation (Digital Services Act) | 12 months after the decision, longer if a dispute is open |
| Referral data | Referral code, which Challenge page you arrived from | Attribute sign-ups to share links | Legitimate interest | 30 days for the attribution, then only the fact of referral |
| Support and legal requests | Emails you send us, complaint records | Answer you, keep evidence | Contract; legal obligation | 3 years after closing |
| Newsletter and marketing emails | Email address, consent date, opens | Send you news about Harder | Consent (withdrawable in every email) | Until you unsubscribe |
We do not collect precise location, contacts, or advertising identifiers. We do not use advertising trackers.
4. Where the data comes from
Mostly from you. Some data comes from Google or Apple when you sign in with them (identifier, email, and for Apple your name the first time only), from Apple Health when you turn on verification (section 9), from other users (for example when someone reports your content or invites you), and from our systems (logs, moderation scores).
5. Who can see your data
Other users. Your Space profile is public. Challenges, Proofs, and comments are visible according to the Challenge's visibility setting: personal (only you), private (people you invited), public, or public with approval. Verified health readings, such as a step count, are shown inside the Challenge in the same way as photo proofs. Direct messages are visible to the two Spaces in the thread.
Our service providers (processors). They act on our instructions under data processing agreements.
| Provider | What they do | Where | Safeguard |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, backups, email delivery (Amazon SES) | EU, Frankfurt (eu-central-1) | AWS Data Processing Addendum |
| Cloudflare | Content delivery, image and video storage and streaming | Global network, EU-configured storage | Data Processing Addendum, EU-US Data Privacy Framework |
| Stripe | Payment processing, Creator payouts | EU and US | Stripe Data Processing Agreement, Standard Contractual Clauses |
| Apple | Sign in with Apple, push notification delivery, In-App Purchase | EU and US | Apple developer terms, Data Privacy Framework |
| Google (Firebase) | Push notification delivery, Sign in with Google | EU and US | Google Cloud Data Processing Terms, Data Privacy Framework |
| OpenAI and Google (Gemini) | Automated content moderation of text and images, classification of challenge action names | US | Data Processing Agreements, Standard Contractual Clauses. Health readings are never sent to these providers |
| Slack | Internal alerts to our team about flagged content | US | Internal tool; no personal data beyond what appears in the alert |
Authorities. We disclose data when the law requires it, for example a valid court order, and to report content that suggests a serious crime.
Business transfer. If the business is sold or transferred, your data passes to the new owner under this policy, and we tell you first.
We do not sell personal data. We do not share it with advertisers or data brokers.
6. International transfers
Your data is stored in the EU. Some providers in section 5 are in the United States. Where data reaches them, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. Health readings from Apple Health do not leave the EU.
7. How long we keep data
See the retention column in section 3. When you delete your account, we delete your data immediately from our live systems. Backups are overwritten within 30 days. We keep only what the law requires us to keep (invoices, tax records, evidence of consent and of complaints) for the legal period, separated from the live service.
8. Your rights
Under GDPR you have the right to:
- Access your data and get a copy.
- Rectify inaccurate data. Most fields can be edited in the app.
- Erase your data. Use "Delete account" in Settings for immediate deletion, or write to us.
- Restrict processing while a dispute is checked.
- Portability of the data you gave us, in a machine-readable format. Write to privacy@harder.pro; we currently provide exports by email within 30 days.
- Object to processing based on legitimate interest, including moderation records, and to any marketing at any time.
- Withdraw consent at any time, without affecting processing before the withdrawal. Health data consent: Settings > Privacy. Newsletter: the link in every email.
- Not be subject to solely automated decisions with legal or similarly significant effects (section 11).
To exercise a right, email privacy@harder.pro from the address on your account, or use the in-app features. We answer within one month; for complex requests we may extend by two months and tell you why.
You can complain to a supervisory authority. Ours is the Polish authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain to the authority in the country where you live.
9. Health and fitness data (Apple Health)
9.1 Optional. Verification with Apple Health is off by default. It starts only after you read a consent screen in the app, tap "I agree", and then allow access in Apple Health. You can always use photo proof instead.
9.2 What we read. Daily totals for the data types your Challenge action needs: step count, walking and running distance, exercise minutes, mindful minutes, and workout sessions (type, duration, distance). We also record which app or device produced the reading, so we can distinguish a watch reading from a manually typed entry. We read one day at a time. We never read raw sensor samples, heart rate, sleep, location, body measurements, or medical records.
9.3 Why. For one purpose: to check that you completed a challenge action and mark it as verified. We do not use health data for advertising, marketing, analytics, profiling, or recommendations, and we do not sell it. Any new use would require a new consent from you.
9.4 Who sees it. The verified result, for example "12,340 steps, verified", is shown to the participants of that Challenge in the same way as photo proofs, following the Challenge visibility. Health readings are not shared with any third party and are stored only on AWS in the EU. They are not sent to our moderation or AI providers, and they are not included in notifications or emails.
9.5 Apple's rules. We do not store Apple Health data in iCloud and do not use it for advertising or data mining, in line with Apple's HealthKit guidelines.
9.6 Withdrawal and deletion. You can withdraw consent in Settings > Privacy. Withdrawal immediately deletes the stored health readings; your completed days stay marked as completed. Deleting your account deletes everything. To stop the app reading Apple Health at the device level, use iOS Settings > Health > Data Access.
9.7 Consumer Health Data Privacy Policy. Additional information required by certain US state laws is in our Consumer Health Data Privacy Policy at harder.pro/consumer-health-data-privacy.
10. Children
You must be at least 16 to use Harder. We ask for your date of birth at registration and keep only your birth year and a confirmation that you met the requirement. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, email privacy@harder.pro and we will delete it.
11. Automated decisions and moderation
We use automated tools, including AI models from OpenAI and Google, to scan text and images for content that breaks our community rules. The tools produce a confidence score. Depending on the score, content may be flagged for a person to review, hidden, or removed. Decisions about suspending or closing an account are always made by a person. You can appeal any moderation decision under the Terms of Service, and a person who was not involved in the first decision reviews it.
Health data verification is automated: a reading either meets the rule set by the Challenge creator or it does not. This has no legal or similarly significant effect on you; a failed check only means the action is not verified yet, and you can submit a photo proof instead.
We do not use profiling to make decisions about you.
12. Cookies and similar technologies
The web application uses cookies that are strictly necessary: the session cookie that keeps you signed in, a CSRF protection cookie, and a cookie that remembers your consent choices. These do not require consent.
We do not currently use analytics or advertising cookies. If we add analytics, we will ask for your consent through a banner with an option to refuse, and update this section.
The iOS app does not use cookies. It stores a session token and cached content on your device. The local cache is excluded from iCloud backup.
13. Security
We protect your data with encryption in transit (TLS) and at rest, access controls, separate admin accounts with role-based permissions, rate limiting, and logging of administrative access. Passwords are stored as hashes. If a breach affects your data in a way that creates a risk to you, we inform you and the supervisory authority as the law requires.
14. Marketing emails and notifications
We send transactional emails (registration, password reset, invitations, weekly digest of your own challenges) as part of the service. We send marketing emails (news, new features) only with your consent, and every email has an unsubscribe link. Push notifications can be managed by category in Settings > Notifications and turned off entirely in your device settings.
15. Changes to this policy
We may update this policy when the service or the law changes. For material changes we notify you by email or in-app message at least 14 days before they take effect. Each version is dated at the top. Previous versions are available on request.
16. Contact
Oleksandr Tykhonov, ul. Tunelowa 22E, 40-676 Katowice, Poland