Privacy policy

Last updated: October 29, 2026

This policy covers the HarmFlow app and this website, harmflow.com: what each one collects, who receives it, and the choices you have.

The HarmFlow app

HarmFlow runs on your Mac. It has no online service of its own, and it sends nothing to HarmFlow: no account, no telemetry, no usage analytics, and no crash reports.

• Its parts talk only to each other. The HarmFlow window and the daemon, the background process that runs your tasks, talk over your Mac's loopback address, 127.0.0.1, which no other computer can reach.
• What it keeps stays on your Mac. Your tasks, their schedules, the history of their executions, and their logs are files in HarmFlow's data folder, ~/Library/Application Support/HarmFlow. The key the window uses to reach the daemon is kept in your Mac's Keychain.
• The tools you choose send what your tasks give them. HarmFlow starts the tools you installed and signed in to yourself: Claude Code or Codex and, for a task that works on GitHub, Git and the GitHub CLI. They run under your own accounts and send what a task gives them — its prompt, and the files and repositories it works on — to their providers, Anthropic, OpenAI, and GitHub, under those providers' own terms and privacy policies. HarmFlow never signs you in to them.
• Links open in your browser. A link you open from HarmFlow opens in your web browser, which visits that page as it would any other.

This website

• No account and no forms. The website asks for no account and has no form, so it collects nothing you type.
• Served from harmflow.com. Every page, style, typeface, and image comes from harmflow.com. The website sets no cookie of its own and, until you accept analytics, makes no request to any other host.
• Hosted on GitHub Pages. GitHub, which serves the website, logs and stores the IP address of every visitor for security purposes, under the GitHub General Privacy Statement.

Analytics

The website measures its visits with Google Analytics 4, and only if you accept. A banner asks for your choice, with Accept and Reject given equal weight. Until you accept, a page loads nothing from Google, sends nothing to Google, and sets no analytics cookie. Until the website shows that banner, it runs no analytics at all.

Once you accept, the website measures only:

• the pages you view;
• your clicks on the page's main call to action;
• your visits to the page that says a page was not found.

The website gives you no identifier of its own, and its analytics keep their data for the shortest period Google Analytics offers.

How Google processes the data

Once you accept, your browser loads Google's tag, which sets Google Analytics cookies and sends each measured event to Google, with what a browser sends along with any request — such as its type, your device, your language, and your IP address, from which Google derives an approximate location. Google processes this data to provide the measurement to HarmFlow, and may process it outside your country, including in the United States. How Google uses information from sites or apps that use its services and Google's Privacy Policy describe what Google does with it.

Withdrawing your consent

Your choice is kept in your browser. To withdraw your consent, or to give it later, use the analytics link in the footer of every page, which reopens the choice. Withdrawing stops the measurement and removes the analytics cookies.

Changes and questions

When what the app or the website collects changes, this policy changes with it, and the date at its top says when it last did. A question about it can be asked in harmflow-app's GitHub issues, which anyone can read: put no personal data in it.