Privacy Policy

Introduction

Hardroad, Inc. is committed to protecting online privacy. We carefully protect your data from loss, misuse, unauthorized access or disclosure, alteration, or destruction. Users may receive communications about services and can opt out of future mailings.

Information Collection

Hardroad collects personally identifiable information from visitors who register, purchase products, or seek information. This encompasses name, address, telephone number, e-mail address, credit card number and expiration date, password, purchase history, IP address and related browsing data.

Use of Information

Hardroad uses collected data to provide services, respond to inquiries, and market products. The company may transfer personal information to third parties including advisors, service providers, regulatory authorities, and business partners. In acquisition scenarios, the company may transfer data to buyers as business assets. Anonymous aggregated demographic information may be shared with third parties.

Cookies and Analytics

We use cookies and Google Analytics to understand how visitors use our site. This includes pages visited, time on site, and general location (city/country). Google Analytics uses cookies to collect this data anonymously. You can opt out by declining cookies when prompted or by installing the Google Analytics Opt-out Browser Add-on.

Google User Data

This section describes how Hardroad handles information obtained through Google APIs (“Google user data”). It takes precedence over every other section of this policy. Where anything else in this policy would permit a broader use, sharing, or transfer of your information, that broader permission does not apply to Google user data.

What we access, and why

Hardroad requests access to your Google account only when you start a connection yourself, and only for the feature you are connecting. Before you reach Google's consent screen, Hardroad shows you in-app exactly which permissions will be requested and what each one is used for.

• Google Calendar — .../auth/calendar and .../auth/calendar.events. We read your calendar list so you can choose which calendars Hardroad plans around, and we read the events on those calendars so Hardroad knows when you are busy. We create and update events for the tasks and habits you schedule from the Hardroad planner. This is used only to operate the calendar sync and scheduling features you turned on.
• Google Contacts — .../auth/contacts.readonly. We read contact names, email addresses and phone numbers so you can choose which of them to import into Hardroad, and then assign tasks, invite collaborators and share goals without retyping addresses. This access is read-only: Hardroad cannot add, change or delete anything in your Google Contacts. Contacts you do not select during import are not stored.
• Google account identity — openid, .../auth/userinfo.email and .../auth/userinfo.profile. Your name, profile picture and email address, used to label which Google account a connection belongs to so you can tell two connected accounts apart, and to sign you in if you chose Google sign-in.

Limited Use

Hardroad's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we never do with Google user data

• We never sell, rent, or trade it.
• We never transfer it to third parties — including advertising networks, data brokers, business partners, or other information resellers. The transfers described under “Use of Information” above do not apply to Google user data.
• We never use it for advertising, remarketing, or ad personalisation of any kind.
• We never use it to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. The research, experimentation and model-development activities described under “Experiments and Research” above, and in our Terms of Service, exclude Google user data entirely: it is never included in de-identified research datasets, published research, or model training.
• Hardroad staff do not read your calendar events or your contacts. The only exceptions are the narrow ones Google's policy permits: where you have given us explicit permission to look at specific data (for example when you ask support to investigate a problem), where it is necessary for security purposes such as investigating abuse, or where we are required to by law. Any such access is limited to what the purpose requires.

Where it is stored, and who can reach it

Google user data and the OAuth tokens that authorise access are held in Hardroad's database on Google Cloud Platform in the United States, which encrypts data at rest, and is transmitted over TLS. Tokens are never sent to your browser or to any client application — only Hardroad's servers use them. Access to the production systems that hold this data is limited to the staff who operate the service.

We do not share Google user data with any third party. We may disclose it if we are legally compelled to, and where we are permitted to do so we will make reasonable efforts to notify you first. If Hardroad is ever acquired or merged, Google user data will continue to be handled under this policy, and you will be given notice and the opportunity to disconnect and delete it before any transfer takes effect.

How long we keep it

Hardroad keeps the Google data needed to run the features you connected for as long as that connection is active: the calendars you selected and their events, and the contacts you chose to import. Contacts and calendar events you have imported or synced become part of your Hardroad planning history and are kept until you delete them in the app or delete your Hardroad account.

How to disconnect and delete

• Disconnect a calendar account in Hardroad under Settings → Calendars. This deletes the stored Google token and the calendar records for that account, and stops all further access.
• Revoke Hardroad's access at Google at any time from myaccount.google.com/permissions. This immediately stops any further access, for every scope you granted.
• Ask us to delete what we already hold — including the contacts grant, synced events, and imported contacts — using the request routes on our Data Deletion & Retention page.

Deleting your Hardroad account deletes all Google user data we hold for you. See Data Deletion & Retention for the full process and timelines.

Experiments and Research

If you opted in to research at signup (or later in Settings), your de-identified data may be used in scientific research as described in the Broad Research Consent you accepted. You can withdraw at any time in Settings → Privacy & Research, and withdrawing never changes your Hardroad experience.

Data Security

The company implements physical, electronic, and managerial procedures to prevent unauthorized access and uses various electronic means to keep transaction information transferred over the Internet as secure as generally available transaction technology reasonably permits.

Children's Privacy

Hardroad does not collect information from children 12 years old and younger except as permitted by law.

Third-Party Collection

Third-party sponsored promotions may collect information independently. Hardroad encourages users to review those parties' privacy policies.

Contact and Links

Users can contact the company at webmaster@hardroad.app. External links lead to uncontrolled sites and we recommend reviewing their privacy notices.

We Do Not Sell Your Data

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

Your Rights

You can request to see, correct, or delete your personal data at any time. California residents have additional rights under CCPA, including the right to know what data we collect and to opt out of any sale (we don't sell data). EU residents have similar rights under GDPR. To exercise any of these rights, email us at webmaster@hardroad.app.

Data Retention

We keep your data only as long as needed to provide our services or as required by law. Analytics data is retained for 14 months.

Opt Out of Communications

Enter your email below to unsubscribe from marketing communications.

Policy Changes

The company reserves the right to update this policy and will inform users of material changes in advance.