Effective: · Last updated:
This policy covers pool.harlolabs.com and its mining and account services. In plain language: we use your email to run your account, mining records to operate the pool and calculate rewards, optional device information to show stats and send alerts, and optional PostHog analytics only if you accept it. Privacy contact: Hello@HarloLabs.com.
What we collect and why
- Account information: your email address, verification status, login sessions, linked wallet addresses, and qualification progress. We use these for login, account access, and spin eligibility. We do not store account passwords because login uses email codes.
- Security information: protected login-code checks, rate-limit records, session-token hashes, and account activity needed to prevent abuse. If you enable two-factor authentication, we store an encrypted authenticator secret and protected recovery-code checks.
- Mining information: payout addresses, worker names, connection times, accepted and rejected shares, work and difficulty records, estimated hashrate, reported firmware, and block/reward records. We use these to run the pool, show history, calculate BCH rewards, and verify spin qualification.
- Optional miner stats: temperature, power, voltage, frequency, fans, and other supported readings your firmware reports. We use these for device charts and any temperature alerts you configure. Your configured alert thresholds are saved to your account.
- Spins and store records: credit grants, spins, winnings, balances, redemption requests, fulfillment records, and administrative adjustments. We need these to maintain balances, prevent duplicate spending, and handle support or fulfillment.
- Website and network information: connecting to the website or pool reveals your IP address and technical connection information to our server. Access and security logs may include the requested URL, browser information, time, and errors. These help us operate and protect the service.
What other people can see
Wallet addresses and named-worker mining information are publicly viewable by looking up a wallet. Depending on the miner, this can include firmware, hashrate, best shares, connection state, and reported device stats. Wallet and device spin qualification can also be shown publicly. Do not put private information in worker names.
Your account email, private balances, recovery codes, and account history are not part of the public wallet view. A win share link is public to anyone who has it and may be fetched or cached by social platforms. It shows the recorded win amount, not your email, wallet, or account balance. BCH blockchain records are public and cannot be erased by this website.
Cookies and storage on your device
We use essential cookies for email-code verification, your login session, two-factor verification, and notification-device identification. A login lasts up to 30 days. Browser storage remembers recently checked wallets, sound and notice-dismissal preferences, and pending spin or redemption request references so retries do not spend twice. Those references are not passwords or recovery codes.
Optional analytics is off by default. The cookie notice offers Accept analytics and Essential only equally. Rejecting analytics does not affect mining, login, spins, purchases, or notifications. The footer’s Cookie settings button lets you change your choice. We save this consent preference in browser storage for 180 days; after that, we ask again. If browser storage is blocked, your choice may last only for the current page visit. We honor Global Privacy Control and Do Not Track signals by keeping optional analytics off.
Optional PostHog analytics
If you accept, our head script loads PostHog for our US-hosted analytics project. PostHog uses first-party cookies and local storage to recognize a browser with a random identifier; analytics cookies are set to expire after 180 days. We measure page views, navigation, automatic interaction events such as clicks and form submissions, heatmaps, and browser performance. Session recordings reconstruct visible page content, scrolling, pointer movements, and interactions so we can understand how the website is used. Form submission events do not include the values you type. We also collect technical browser/device information. PostHog receives network information, including your IP address, when your browser connects to its servers. IP retention and analytics-record retention depend on our PostHog project settings.
We do not identify analytics visitors by their account email or wallet. Recording and automatic interaction capture start only after you accept this broader analytics choice; earlier consent to limited page-view analytics does not enable them. Inputs are masked before transmission. Private account and admin panels, balances, account history, security setup, and recovery codes are blocked from recordings and automatic interaction capture. Recording pauses on profile, admin, and shared-win pages. We remove private URL query strings, wallet fragments, and win-share tokens, and redact email and wallet text. Public pool statistics and public page content may appear in recordings. We do not record console logs, network request/response bodies or headers, canvases, cross-origin frames, or automatic error reports. The brand label is “harlolabs.” Analytics is for understanding and improving website usage, not targeted advertising.
Choosing Essential only stops future analytics collection on this browser and clears this project’s analytics identifiers from browser storage and cookies where accessible. It does not automatically delete events already received by PostHog. You can contact us about access or deletion. Your choice applies to this browser, not every device where you log in. Clearing site storage removes the choice and may sign you out or remove preferences; it does not delete server-side account or reward records.
Email and push notifications
We send your email address and a one-time login code to Zoho/ZeptoMail to deliver account emails. Our login emails disable open and click tracking.
If you enable push notifications, we save the browser’s push subscription endpoint and delivery keys with your account. Alerts are delivered through your browser or device’s push provider, such as Apple or Google. Push messages can contain worker names, temperatures, best-share results, or pool block information, and may appear on your lock screen. They do not include your email, login code, or recovery codes.
Push subscriptions can remain active after your login expires. You can disable alerts in your profile or device settings. Logging out disconnects this device’s subscription. Expired or rejected subscriptions are removed when detected.
Who receives information
Authorized HarloLabs operators can access the records needed for support, security, rewards, and fulfillment. Our server hosting and backup systems process the data needed to provide the service. Email and push providers receive the information described above. With your analytics consent, PostHog receives the website-usage data and session recordings described above for processing in the United States. Processing locations depend on those providers and can be outside your country.
If a redemption needs delivery details, we arrange that separately by email. We do not sell account information or use it for targeted advertising. Information may also be disclosed when legally required or needed to investigate abuse. Visiting store links or sharing to X or Facebook takes you to a separate service with its own privacy practices; we do not send your account email through those share buttons.
How long information stays
Email login codes expire after 10 minutes, and login sessions after up to 30 days; expired authentication records are cleaned up periodically. Mining and telemetry charts normally keep minute detail for about 24 hours and hourly detail for about 7 days. Devices disconnected for more than 24 hours are removed from the wallet page with their device-specific data; aggregate work and reward accounting can remain.
Account, wallet-link, reward, redemption, and audit history currently has no automatic deletion date. These records maintain balances and reward history and help resolve support issues. Server logs and backups may retain copies after a record is removed from the active service. We do not promise immediate deletion from every backup.
Your choices and requests
You can use public pool views without an email account, choose whether to enable notifications or two-factor authentication, change alert thresholds, unlink wallets, log out, clear browser storage, and accept or reject optional analytics through Cookie settings.
For access, correction, or deletion requests, email Hello@HarloLabs.com. We may ask you to verify control of your account before acting. Tell us what you want changed or removed. We will explain any records we need to retain for accounting, security, or legal reasons, and the effect on account access or saved rewards. There is currently no self-service account deletion button.
Security and changes
We use encrypted website connections, access controls, protected authentication records, and optional two-factor authentication. No online service can guarantee complete security. Never email your wallet seed phrase, private key, or account recovery codes. Enter account codes only in the legitimate login or security forms.
We will update the effective date when this policy changes and describe material changes on the website. Where required, we will request consent before using information for a new purpose.