Privacy Policy

1. Introduction

This Privacy Policy explains how Hari ("Hari", "we", "us", or "our") collects, handles, stores, and shares information when you use the Hari browser extension and related websites (collectively, the "Service"). This policy is designed to be transparent and complete so you fully understand how your personal data is managed.

By installing or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Controller and Contact Details

For the purposes of applicable data protection laws, Hari is operated by an individual developer (the "Controller").

You can contact the Controller at:

• Email: [email protected]

3. Information We Collect

We collect the following categories of personal and technical data when you use the Service:

a. Account and Subscription Information

When you register for or use the Service, we collect:

• Email address
• User ID and authentication tokens
• Subscription status (e.g., free, active paid, cancelled)
• Stripe customer ID and subscription ID (but not full payment card details — those are handled directly by Stripe)

b. Extension Settings and Usage Information

To provide and personalize the Service, we collect:

• Immersion level and other in-extension preferences you configure
• Whether Hari is enabled or disabled on particular websites
• Feature flags and configuration values necessary for the extension to function

c. Web Browsing Activity Data and Website Content

When you activate Hari on a webpage, we access and transmit for translation purposes:

• Visible text content from the web pages you visit — this constitutes web browsing activity data and website content as defined in the Chrome Web Store User Data policy and is treated as personal and sensitive user data
• The domain name (hostname) of the website being translated, sent to contextualise the translation request
• Language and configuration parameters associated with each translation request

This data is transmitted to our backend server and to Lara API solely to generate Tagalog translations. The original sentence text, translations, source domain, and a creation timestamp are stored on our backend as a server-side translation cache to avoid re-processing identical content. This cache is retained indefinitely with no current automatic expiry. A copy is also stored in your browser's local Chrome storage.

We do not intentionally collect passwords, financial details, or other sensitive personal information from web pages. The extension is designed to avoid processing form fields used for such data. Cached translation data is not used for profiling, advertising, or any secondary purpose.

d. Technical and Log Data

As part of normal operation, we automatically receive:

• IP address, browser type and version, and basic device information transmitted via standard HTTP(S) requests
• Timestamps and error logs related to your use of the Service

4. How We Handle Your Data

We handle your data with the following principles:

• Purpose limitation: Data is collected only for the specific purposes described in this policy and is not processed in ways incompatible with those purposes.
• Data minimization: We collect only the data necessary to provide, operate, and improve the Service.
• Integrity and confidentiality: We apply technical and organizational security measures to protect your data from unauthorized access, disclosure, alteration, or destruction.
• No sale of personal data: We do not sell, rent, or trade your personal data to third parties for their own commercial use.
• No behavioral advertising: We do not use your data to build advertising profiles or target you with behavioral advertisements.
• Transparency: We inform you clearly about what data we collect, why, and with whom it is shared.

Web browsing activity data and website content (page text processed for translation) is transmitted to our backend and to Lara API solely to produce Tagalog translations. The resulting translations, original sentence text, and source domain are stored in a server-side cache on our backend to avoid re-processing the same content. This cache data is not used for any purpose other than serving future translation requests.

Limited Use

We only use and share user data for the purposes described in this Privacy Policy. Specifically:

• We do not sell user data to any third party.
• We do not use user data for targeted advertising or behavioral profiling.
• We do not use user data for any purpose that is not directly necessary to provide and improve the Hari Service as described in this policy.
• We do not share user data with any party not listed in this policy.
• We do not combine user data collected through the Hari Service with personal information obtained from other sources for unrelated purposes.
• Web browsing activity data and website content is accessed and transmitted solely for the purpose of generating translations. It is not retained, analyzed for secondary purposes, or used to build user profiles of any kind.

5. How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To provide, operate, and maintain the Service, including translating website content into Tagalog.
• Account management: To create and manage your user account, authenticate your identity, and determine your subscription status.
• Payment processing: To process subscription payments through Stripe.
• Security and abuse prevention: To monitor for fraudulent activity, prevent unauthorized access, and diagnose and resolve technical issues.
• Service communications: To send you important updates, security notices, and administrative messages about the Service.
• Legal compliance: To comply with applicable laws and enforce our Terms of Service.

6. Data Storage

Your data is stored as follows:

a. Account and Subscription Data

Account information (email address, user ID, subscription status) is stored in a managed cloud database provided by Supabase. Data is stored on servers located in the United States. Access to this database is restricted to authorized personnel and systems only.

b. Extension Preferences

Your extension settings and preferences are stored in Supabase and are synced to your account so they persist across devices and sessions.

c. Translation Cache (Web Browsing Activity Data and Website Content)

When Hari translates a page, the following data is stored in a server-side translation cache on our backend (hosted on Render, United States) to avoid re-processing the same content in the future:

• Original sentence text from web pages
• Tagalog translations of those sentences
• The domain name (hostname) of the website where the sentence appeared
• A creation timestamp

This cache is currently retained indefinitely with no automatic expiry. If you wish to request deletion of your translation cache data, contact us at [email protected].

A client-side copy of the translation cache is also stored in your browser's local Chrome storage (chrome.storage.local) to speed up translations on pages you revisit. This data remains on your device and is not transmitted to any server separately.

d. Log and Technical Data

Error logs and technical data are stored temporarily in our infrastructure for the purpose of debugging and monitoring service health. These logs are retained for a limited period and then automatically deleted.

e. Payment Data

Full payment card details are stored exclusively by Stripe, our payment processor. We store only a Stripe customer ID and subscription ID in our own systems, along with limited non-sensitive payment metadata (such as card brand and last four digits) as returned by Stripe.

All data in transit is encrypted using TLS (Transport Layer Security). Data at rest in our database is protected by encryption and access controls managed by Supabase.

7. Data Sharing

We do not sell your personal data. We share your data only with the third-party service providers listed below, and only to the extent necessary to operate the Service. We do not share your data with advertisers or unaffiliated third parties for their own use.

a. Supabase

Data shared: Email address, user ID, authentication tokens, subscription status, and extension preferences.
Purpose: Database hosting and user authentication.
Role: Data processor acting on our behalf.
Location: United States.
Restriction: Supabase is contractually prohibited from using this data for any purpose other than providing database and authentication services to us.

b. Stripe

Data shared: Payment information you provide during checkout (handled directly by Stripe's secure forms), and limited subscription metadata (card brand, last 4 digits, subscription status).
Purpose: Payment processing and subscription management.
Role: Independent payment processor operating under Stripe's own privacy policy and PCI compliance standards. We do not receive or store your full card number.
Restriction: Stripe may only use payment data to process transactions and provide payment services; they are contractually prohibited from using it for unrelated purposes.

c. Lara API

Data shared: Web browsing activity data and website content — specifically, the visible text from web pages you visit while Hari is active, and translation configuration parameters.
Purpose: Generating Tagalog translations of web page content.
Role: Data processor acting on our behalf.
Restriction: Lara API is contractually prohibited from retaining, using, or sharing this data for any purpose other than generating and returning translation responses. This data is not retained by Lara after the translation response is delivered.

d. Infrastructure and Hosting Providers

Data shared: Technical and log data (IP address, request metadata, error logs) necessary to operate and deliver the Service.
Purpose: Hosting, monitoring, and securing the Service infrastructure.
Role: Data processors acting on our behalf.
Restriction: Infrastructure providers are contractually prohibited from using technical data for any purpose beyond operating and securing the services they provide to us.

e. Legal Disclosures

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

8. Legal Bases for Processing (EEA/UK Users)

Where the General Data Protection Regulation ("GDPR") or similar laws apply, we process personal data under the following legal bases:

• Performance of a contract: To provide and operate the Service and manage your subscription.
• Legitimate interests: To secure and improve the Service, prevent abuse, and respond to your communications, where such interests are not overridden by your rights.
• Legal obligation: To comply with accounting, tax, and other legal requirements.

9. How We Process Web Browsing Activity Data and Website Content

When you enable Hari on a webpage, the extension reads the visible text content of that page. This constitutes web browsing activity data and website content under the Chrome Web Store User Data policy, and is classified as personal and sensitive user data. The text, along with the domain name of the website, is transmitted securely over HTTPS to our backend server, which uses the Lara API to generate Tagalog translations. The translated content is returned to your browser for display.

The original sentence text, Tagalog translations, source domain name, and a creation timestamp are stored in a server-side translation cache on our backend (hosted on Render, United States). The purpose of this cache is to avoid re-translating identical content on future page visits, improving performance. This cache is currently retained indefinitely with no automatic expiry.

This data is used solely for the purpose of generating and serving translations. It is not used for profiling, advertising, behavioral analysis, or any purpose unrelated to the translation function. Cached data is not sold or shared with any party other than those listed in Section 7.

We do not intentionally process sensitive categories of personal data (such as health information, financial details, or passwords) through the translation pipeline. The extension is designed to avoid intercepting password fields, payment forms, and other sensitive form inputs.

Page text is only collected and transmitted while Hari is active on a given page. Disabling Hari on a site stops all collection and transmission for that site.

10. Data Retention

We retain different categories of data for different periods:

• Account and subscription data: Retained for the duration of your account and for a reasonable period thereafter as required for legal, tax, or dispute resolution purposes.
• Extension preferences: Retained while your account is active. You may delete your account to remove this data.
• Translation cache (web browsing activity data): Stored indefinitely on our backend server. The cache holds original sentence text, Tagalog translations, source domain names, and creation timestamps. To request deletion of your translation cache data, contact us at [email protected]. A local copy is also stored in your browser's Chrome storage until you uninstall the extension or clear browser data.
• Log and technical data: Retained for a limited period (typically 30 to 90 days) for debugging and monitoring purposes, then automatically deleted.
• Payment metadata: Retained as required to maintain accurate subscription records and meet legal obligations.

When personal data is no longer required for any of these purposes, we will delete or anonymize it within a reasonable time.

11. International Data Transfers

Your information may be stored and processed on servers located outside of your state, province, or country, including in jurisdictions that may have different data protection laws.

Where required by law, we implement appropriate safeguards (such as standard contractual clauses) to ensure that your personal data receives an adequate level of protection.

12. Your Rights

Depending on where you live, you may have some or all of the following rights in relation to your personal data:

• Right to access the personal data we hold about you.
• Right to correct inaccurate or incomplete personal data.
• Right to request deletion of your personal data, subject to legal retention requirements.
• Right to object to or restrict certain processing activities.
• Right to data portability (to receive certain data in a machine-readable format).
• Right to withdraw consent (where processing is based on consent).

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before responding.

13. Rights of California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act ("CCPA") or similar laws, including:

• The right to request information about the categories and specific pieces of personal information we have collected about you.
• The right to request deletion of personal information, subject to certain exceptions.
• The right to opt out of any "sale" or "sharing" of personal information, to the extent applicable.

Hari does not sell personal information for money. If you wish to exercise any California privacy rights, contact us at [email protected].

14. Security

We implement technical and organizational measures designed to protect your information against unauthorized access, loss, or misuse. These measures include:

• Encryption of data in transit using TLS/HTTPS
• Encryption of data at rest in our managed database
• Access controls and authentication requirements for our systems
• Restricted access to personal data on a need-to-know basis

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at [email protected].

15. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal data from children under 13.

If you believe that a child has provided us with personal data, please contact us so that we can delete the information.

16. Chrome Extension Permissions

The Hari browser extension requests the following permissions. Each permission is used solely as described below, and this section is provided to explicitly align with Chrome Web Store User Data Privacy requirements.

a. Content Scripts — <all_urls>

What it does: Allows the extension to inject its translation interface and scripts into any web page you visit.
Why it is necessary: Hari is a page-level translation tool. It must be able to run on any URL because users can enable translation on any website of their choosing. Without this permission, the extension could only function on a pre-defined list of sites.
Data implication: The extension reads the visible text content of pages where it is active. This constitutes web browsing activity data and website content as described in Sections 3 and 9. Text is only transmitted for translation when Hari is enabled on that page.

b. storage Permission

What it does: Allows the extension to read and write data to Chrome's local and sync storage.
Why it is necessary: Used to save your immersion level preference, per-site enable/disable settings, translation cache, and whether you have seen the privacy disclosure. This data stays on your device and in your Chrome account sync.
Data implication: Only extension preference data is stored. No personal information from web pages is stored locally.

c. tabs Permission

What it does: Allows the extension to query open browser tabs and reload them.
Why it is necessary: When you change the immersion level from the Hari new tab dashboard, the extension reloads your currently open tabs so the new translation level takes effect immediately. The extension does not read tab URLs for any tracking or analytics purpose.
Data implication: Tab URLs and titles are accessed only momentarily to trigger a reload. This information is not transmitted to any server, logged, or stored.

d. New Tab Override (chrome_url_overrides)

What it does: Replaces the browser's default new tab page with the Hari dashboard.
Why it is necessary: The Hari new tab page serves as the main interface for account login, subscription management, and immersion level settings. It provides a central place to manage the extension without opening a separate popup or options page.
Data implication: The new tab page handles authentication (email and password, processed by Supabase) and subscription status (processed by Stripe). No additional personal data is collected beyond what is described in Sections 3 and 7 of this policy.

e. Host Permissions — haribackend-mitj.onrender.com

What it does: Grants the extension explicit permission to make HTTPS requests to Hari's backend server.
Why it is necessary: All translation requests and subscription verification calls are routed through this backend, which then communicates with the Lara API. Restricting host permissions to this single domain ensures the extension cannot communicate with any other external server.
Data implication: Web browsing activity data (page text) and account authentication tokens are transmitted to this endpoint over HTTPS. See Sections 6, 7, and 9 for full storage and sharing details.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Effective Date" at the top indicates when it was last revised.

If changes are material, we will take reasonable steps to notify you, such as by posting a notice on our website or through the extension. Your continued use of the Service after any changes constitutes your acceptance of the revised Privacy Policy.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, you can contact us at:

• Email: [email protected]