Privacy Policy

Last updated September 25, 2026

This policy explains what HF Tracker (https://hftracker.app), run by Harrison Ward, collects, why, and your choices. The short version: we collect only what the features need, we never sell or rent your information, and you can download or delete it any time.

What We Collect

• If you just browse: standard server logs (IP address, browser type, pages, time) for security and rate limiting. No ads, no third-party trackers, no analytics services. Links shared from the site carry a small tag (like ?ref=share) so we can count how people find us, without knowing who you are.
• If you make an account: your first name, email, a password (stored only as a one-way hash), and optional two-factor settings.
• How you use your account: when you were last active and which days you visited, so we can see what's useful.
• Email opens and clicks: our emails include a tiny picture and tagged links that tell us when an email was opened or a link clicked. This includes our replies when you write to us. Turn it off any time on your Account page. Nothing is shared with anyone.
• Alert settings: what you watch, targets, quiet hours, which channels you pick, and a log of alerts sent.
• Mobile number (optional), only if you turn on text alerts, with your opt-in and when you gave it.
• Push notifications (optional): the push address your browser gives us.
• Things you add: wish lists, projects, coupon wallet, notes, and for family accounts receipts you forward (items, prices, store, date) and your garage.
• Shelf tag photos (optional, family accounts): sent to our AI provider only to read the item number and price. We don't keep the photo.
• If you email us: your message, name, email address and any pictures or PDFs you attach, plus our replies, so we can help you and keep track of the conversation.
• Donations: handled entirely by Stripe. We never see or store your card number. Stripe may tell us the amount, name and email of a donor.

Why We Use It (And Our Legal Basis)

• To run the features you ask for, like alerts, lists and your account (to perform our agreement with you).
• To send emails, pushes and texts you've turned on (your consent, which you can pull back any time).
• To keep the Site secure: stopping abuse, bots, scraping and break-ins (our legitimate interest).
• To follow the law (legal obligation).

We don't sell, rent or trade your personal information, don't use it for targeted advertising, and don't make automated decisions about you that have legal or similarly significant effects.

Text Messages

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent will not be shared with any third parties, except the text provider (Twilio or Telnyx) that delivers the messages for us. See the Text Messages part of our Terms.

Who Helps Us (Service Providers)

These companies process data only on our behalf and only as needed:

• Hosting and security: our server provider (IONOS) and Cloudflare, which protects and delivers the Site.
• Email: SMTP2GO sends alert and account emails and our replies to you; Cloudflare receives email sent to us.
• Texts: Twilio (or Telnyx) sends text alerts.
• Push: your browser's push service (Apple, Google or Mozilla) delivers push alerts.
• AI: our AI gateway and model provider make product pictures and read shelf tag photos.
• Donations: Stripe.
• Affiliate links: if you click a Harbor Freight affiliate link, Harbor Freight and its affiliate network (CJ) may set their own cookie on their site to credit the sale. We don't send them anything about you.

We may also share information if the law requires it, to protect people's safety, or to deal with fraud or security problems.

How Long We Keep It

• Your account and what you add: until you delete them or your account.
• Unfinished sign ups: deleted after 7 days.
• Sign-in attempts: 30 days. Alert history: about 13 months. Security log: about 13 months.
• Emails you send us and our replies: about 2 years after the last message. Spam: 30 days.
• Server logs: kept briefly for security, usually no more than 90 days.

Your Choices And Rights

• Download your data or delete your account any time from the Account page. Deleting removes your alerts, lists, receipts, garage and settings.
• Stop emails with the unsubscribe link in any email, stop texts by replying STOP, and turn off pushes in your browser or on the Alerts page.
• If you're in the EU, UK or EEA (GDPR): you can access, correct, delete, restrict or object to our use of your data, move it elsewhere, and withdraw consent. You can also complain to your local data protection authority.
• If you're in California or another US state with a privacy law (like CCPA/CPRA, Virginia, Colorado, Connecticut, Utah or Texas): you can know what we collect, get a copy, correct it, delete it, and opt out of sale or sharing for targeted ads. We don't sell or share personal information that way. We won't treat you differently for using these rights.

To use a right we can't handle through the buttons, contact us through our contact form. We may need to confirm it's you, and we'll answer within 30 days (45 where state law allows).

Cookies

We use one essential cookie to keep you signed in, plus your browser's local storage for small preferences like which chart tab you last used. No advertising or tracking cookies, so there's nothing to opt out of. Cloudflare may set a security cookie to tell people from bots. If you pass our “I'm human” check we set one short-lived cookie (24 hours) so you aren't asked again.

Browser Extension

The optional HF Tracker browser extension runs only on harborfreight.com product pages. It reads the item number from the page and asks our Site for that tool's public price data. It sends no personal data, keeps no browsing history, uses no analytics, and only stores the site address in your browser's extension settings.

Security

We use HTTPS everywhere, hashed passwords, optional two-factor sign in, sign-in lockouts, strict browser security rules, rate limits and bot checks. No system is perfect. If we learn of a breach that affects your information, we'll tell you as the law requires.

Kids

The Site isn't meant for children under 13, and we don't knowingly collect their information. If you think a child gave us information, contact us and we'll delete it.

Where Data Lives

We run in the United States. If you use the Site from elsewhere, your information is processed in the US, which may have different data protection rules than your country.

Changes

We'll update the date above when this changes, and email account holders about significant changes.

Contact

Harrison Ward · Contact form