Privacy
Harku is anonymous-first for the people who vote and suggest — no account, no personal data. If you run a project, here's exactly what we collect, who processes it, and the rights you have over it.
For people who vote and suggest
You don't sign in to use a Harku widget, and we don't ask for your name, email, or any personal detail. To stop the same browser from voting twice, the widget generates a random id and keeps it in your browser's local storage. That id isn't linked to your identity — it only deduplicates votes.
When you post a suggestion, we store the text you write — a title and an optional description — and your vote records. That's all.
Our application code does not log or store IP addresses or any other personal identifiers for end users.
What the widget keeps in your browser
The widget stores a few small values in local storage, each scoped to the site you're on:
harku_voter_id— the random, anonymous id used to deduplicate votes.harku_voted_*— which suggestions you've upvoted, so the button shows the right state.harku:cl-seen:*— the last changelog entry you've seen, for the unread badge.harku_config_*— a cached copy of the widget's appearance, so it loads without a flash.
Clearing your browser storage removes all of these.
For site owners
If you run a Harku project, you sign in with an email and password (handled by our authentication provider). We store your email, your projects, the suggestions and roadmap items in them, and your changelog entries. Your dashboard data is protected by row-level security — only you can see and manage your own projects.
How data flows
The widget never reads from or writes to our database directly. Everything goes through a public API that validates your project's public key and only allows safe operations. The one direct connection the widget makes is a read-only, notifications-only channel that keeps the open panel live — it carries no personal data.
Payments
When you subscribe to a paid plan, payments are handled by Creem, our Merchant of Record and payment processor. Creem collects and processes your billing details (name, email and card information) to take the payment and issue invoices. We never see or store your full card number — we only receive a customer id, a subscription id and its status. Creem is the seller of record for your purchase; their terms and privacy policy govern the transaction.
Who processes your data
We keep the stack small and only use providers with appropriate data-protection terms:
- Supabase — database, authentication and storage for your account and project data.
- Vercel — hosting for this site and the dashboard, plus privacy-friendly, cookieless analytics.
- Creem — payment processing and billing, as Merchant of Record.
- Our CDN — delivers the widget script (loader.js) to your visitors.
Cookies & analytics
We keep this minimal. The site uses one functional cookie, i18n_redirected, to remember your language. Theme and layout preferences live in your browser's local storage, not in cookies. Our analytics (Vercel Analytics) are cookieless and don't track you across other sites — no advertising cookies, no third-party trackers.
How long we keep it
We keep your account and project data while your account is active. Delete a project and its suggestions, roadmap items and changelog go with it. Ask us to close your account and we delete your personal data within 30 days, except limited billing records we must keep for legal or tax reasons. Anonymous suggestion text and vote counts remain while the project that hosts them exists.
Your rights
You can ask us to access, correct, export or delete your personal data, and to restrict or object to how we process it, at any time. If you're in the EEA or UK these rights come from the GDPR; in California, from the CCPA. Email us and we'll action your request — you can also complain to your local data protection authority.
Anonymous voters: we hold nothing tied to your identity, so there's nothing to look up — clearing your browser storage removes everything the widget kept.
International transfers
Our providers may store and process data in countries other than your own. Where the law requires it, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) to protect your data.
Contact & changes
The data controller is Harku. Questions, or want to exercise a right? Email hello@harku.app and we'll help. If we make a material change to this policy we'll update this page and its effective date. Effective date: 2026-07-31.