Privacy Policy

Last updated September 28, 2026

This policy explains what HF Tracker (https://hftracker.app), run by Harrison Ward, collects, why, and your choices. The short version: we collect only what the features need, we never sell or rent your information, and you can download or delete it any time.

What We Collect

• If you just browse: standard server logs (IP address, browser type, pages, time) for security and rate limiting. No ads and no third-party trackers. We count pages and button taps with our own copy of Umami (run on our own server, not Google): no cookies, no IP addresses kept, nothing tied to you or your account. Links shared from the site carry a small tag (like ?ref=share) so we can count how people find us, without knowing who you are. We count page views and daily visitors ourselves: each visitor is a scrambled code made from your address and browser with a key that changes every day, so we can count visitors without keeping your address, and nobody can be followed from one day to the next. These codes are deleted after two days.
• If you make an account: your first name, email, a password (stored only as a one-way hash), and optional two-factor settings.
• How you use your account: when you were last active and which days you visited, so we can see what's useful.
• Email opens and clicks: our emails include a tiny picture and tagged links that tell us when an email was opened or a link clicked. This includes our replies when you write to us. Turn it off any time on your Account page. Nothing is shared with anyone.
• Alert settings: what you watch, targets, quiet hours, which channels you pick, and a log of alerts sent.
• Mobile number (optional), only if you turn on text alerts, with your opt-in and when you gave it.
• Push notifications (optional): the push address your browser gives us.
• Prices you share: store prices you saw (with an optional tag photo, location data removed) and protection plan prices. Others see the price, never who shared it.
• Getting-started emails: new accounts get three tips emails in their first week. Turn them off from any of them or on the Alerts page.
• Things you add: wish lists, projects, coupon wallet, notes, receipts you forward or photograph (items, prices, store, date) and your garage. Only you can see them (family accounts share wish lists, projects and game plans with each other).
• Shelf tag and receipt photos (optional): sent to our AI provider only to read the item number and price. We don't keep the photo.
• If you email us: your message, name, email address and any pictures or PDFs you attach, plus our replies, so we can help you and keep track of the conversation.
• Donations: handled entirely by Stripe. We never see or store your card number. Stripe may tell us the amount, name and email of a donor.

Why We Use It (And Our Legal Basis)

• To run the features you ask for, like alerts, lists and your account (to perform our agreement with you).
• To send emails, pushes and texts you've turned on (your consent, which you can pull back any time).
• To keep the Site secure: stopping abuse, bots, scraping and break-ins (our legitimate interest).
• To follow the law (legal obligation).

We don't sell, rent or trade your personal information, don't use it for targeted advertising, and don't make automated decisions about you that have legal or similarly significant effects.

Text Messages

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent will not be shared with any third parties, except the text provider (Twilio or Telnyx) that delivers the messages for us. See the Text Messages part of our Terms.

Who Helps Us (Service Providers)

These companies process data only on our behalf and only as needed:

• Hosting and security: our server provider (IONOS) and Cloudflare, which protects and delivers the Site.
• Email: SMTP2GO sends alert and account emails and our replies to you; Cloudflare receives email sent to us.
• Texts: Twilio (or Telnyx) sends text alerts.
• Push: your browser's push service (Apple, Google or Mozilla) delivers push alerts.
• AI: our AI gateway and model provider make product pictures and read shelf tag photos.
• Donations: Stripe.
• Affiliate links: if you click a Harbor Freight affiliate link, Harbor Freight and its affiliate network (CJ) may set their own cookie on their site to credit the sale. We don't send them anything about you.

We may also share information if the law requires it, to protect people's safety, or to deal with fraud or security problems.

How Long We Keep It

• Your account and what you add: until you delete them or your account.
• Unfinished sign ups: deleted after 7 days.
• Sign-in attempts: 30 days. Alert history: about 13 months. Security log: about 13 months.
• Emails you send us and our replies: about 2 years after the last message. Spam: 30 days.
• Server logs: kept briefly for security, usually no more than 90 days.

Your Choices And Rights

• Download your data or delete your account any time from the Account page. Deleting removes your alerts, lists, receipts, garage and settings.
• Stop emails with the unsubscribe link in any email, stop texts by replying STOP, and turn off pushes in your browser or on the Alerts page.
• If you're in the EU, UK or EEA (GDPR): you can access, correct, delete, restrict or object to our use of your data, move it elsewhere, and withdraw consent. You can also complain to your local data protection authority.
• If you're in California or another US state with a privacy law (like CCPA/CPRA, Virginia, Colorado, Connecticut, Utah or Texas): you can know what we collect, get a copy, correct it, delete it, and opt out of sale or sharing for targeted ads. We don't sell or share personal information that way. We won't treat you differently for using these rights.

To use a right we can't handle through the buttons, contact us through our contact form. We may need to confirm it's you, and we'll answer within 30 days (45 where state law allows).

Cookies

We use one essential cookie to keep you signed in, plus your browser's local storage for small preferences like which chart tab you last used. No advertising or tracking cookies, so there's nothing to opt out of. Cloudflare may set a security cookie to tell people from bots. If you pass our “I'm human” check we set one short-lived cookie (24 hours) so you aren't asked again.

Browser Extension

The optional HF Tracker browser extension runs only on harborfreight.com pages. On product pages it reads the item number and asks our Site for that tool's public price data. On search, category, cart and checkout pages it reads the item numbers of the tools shown to add price tags. It only talks to our Site. Right after you install it, it opens a welcome page on our Site once. It sends no personal data and keeps no browsing history. Once a day it sends anonymous usage counts: a random ID made on your computer, the extension version, your browser's name, and how many times its features were used (like "price cards shown: 12"). No pages, item numbers, addresses or anything about you are included, and you can turn it off in the extension's settings. Its settings stay in your browser.

If you choose to link the extension to your account, the Site gives the extension its own limited key. It can only: read your purchase list from your Garage (item numbers, what you paid, the date and store, warranty dates and any price adjustment we found), see which tools already have an alert or are on your lists, add a price alert, add a tool to your gift or wish list, and, when you tap Add on an order confirmation page, save that order's items and prices to your Garage. It can't sign in, change your settings, or see your email, texts or billing. The key is kept in that browser, is sent only to our Site, and we store only a scrambled (hashed) copy. Nothing is sent to Harbor Freight. You can unlink any browser at any time from the Link The Extension page, which stops its key from working.

Security

We use HTTPS everywhere, hashed passwords, optional two-factor sign-in, sign-in lockouts, strict browser security rules, rate limits and bot checks. No system is perfect. If we learn of a breach that affects your information, we'll tell you as the law requires.

Kids

The Site isn't meant for children under 13, and we don't knowingly collect their information. If you think a child gave us information, contact us and we'll delete it.

Where Data Lives

We run in the United States. If you use the Site from elsewhere, your information is processed in the US, which may have different data protection rules than your country.

Changes

We'll update the date above when this changes, and email account holders about significant changes.

Contact

Harrison Ward · Contact form