Privacy
Harakka keeps a memory for you and the AIs you connect. That memory is often personal, so this page says plainly what is stored, who can see it and how you get it out or deleted.
Who is responsible
Harakka is run by Martin Heijkenskjöld, a sole trader in Stockholm, Sweden, who is the data controller. Questions go to hello@harakka.app.
What is stored when you have an account
- Your account: email address, name if you give one, and your password as a one-way hash. Nobody can read the password itself.
- Your memory: the folders, notes, tags, files and rules you or your connected AIs create, with their history so changes can be undone.
- Your connections: which AI apps and guests you have given access, what they may do, and when they were last used.
- Sign-ins: for each signed-in device, when it was created and last used, its IP address and browser name, so you can see and sign out devices under Settings.
- Security and usage logs: failed sign-in attempts (kept 7 days) and a log of which tools your AIs called (kept 90 days), to stop abuse and fix problems.
There are no ads, no analytics and no tracking cookies. The app sets one cookie, which keeps you signed in.
Who can read your notes
You, and the AIs and guests you give access to - nobody else. Each account is kept apart in the database itself, so one account can never reach another's memory.
To be honest about the rest: whoever runs the servers has technical access to the database. Harakka's operator does not read your notes. The only exceptions are if you ask for help with something that needs it, or if Swedish law requires it, and then only what is needed.
What your AI sees
When you connect an AI such as Claude or ChatGPT, the notes it reads or writes pass through that AI company, under your own account and agreement with them. Harakka does not send your notes to any other AI service. Semantic search with embeddings is off.
Why, and on what basis
- To run the service you signed up for: storing your memory and letting you and your AIs use it (contract).
- To keep the service secure and working: sign-in protection, limits and logs (legitimate interest).
- To email you about your account: confirming your address, resetting your password, and important changes to the service. No newsletters unless you sign up for them.
How long
As long as you have an account. When you delete your account under Settings, your memory, connections and sign-ins are deleted from the database right away. Backups, when kept, are overwritten within 30 days.
Who handles it for Harakka
- Railway - servers and database, in the EU (the Netherlands). Their request logs keep IP addresses for a short time for security and troubleshooting.
- Resend - sends the emails. Resend is a US company, so your address is processed in the US when Harakka writes to you, under Resend's data processing agreement.
- Google Fonts - the typefaces on this site are loaded from Google, which sees your IP address when the page loads.
Copy in GitHub is off unless you turn it on under Settings > Account. When you connect a repository, Harakka writes a copy of your notes to that private repository on your own GitHub account, under GitHub's terms. The access token is stored encrypted and used for nothing else. Disconnect and the copying stops; the files stay in your repository until you delete them.
If payments are added, the payment provider will be listed here before anyone is charged. Railway is a US company, but your data stays in its EU region above. Only two things reach the US: your email address when Resend sends you an email, and your IP address when the page loads its fonts from Google. Your data is never sold, and never shared with anyone other than these services.
The waitlist
If you only joined the waitlist, Harakka stores your email address, how you'd like to run Harakka, whether you came through someone's share link, and when you signed up. It is used to email you about Harakka, with your consent. Reply to the confirmation email to leave the list, and your address is deleted right away.
Your rights
You can see, correct, download and delete your data. Most of it you can do yourself: Settings > Account has "Download everything" (your whole memory as a file) and "Delete account". For anything else, or to object to how your data is used, write to hello@harakka.app.
If something goes wrong with your data, for example a security breach, you will be told, and the Swedish Authority for Privacy Protection is notified as the law requires. If you think your data is handled wrongly, you can complain to IMY.