Effective: · Last updated:
This policy covers pool.harlolabs.com and its mining and account services. In plain language: we use your email to run your account, mining records to operate the pool and calculate rewards, optional device information to show stats and send alerts, and first-party website analytics unless you opt out or your browser sends a privacy signal. Privacy contact: Hello@HarloLabs.com.
What we collect and why
- Account information: your email address, verification status, login sessions, linked wallet addresses, and qualification progress. We use these for login, account access, and spin eligibility. We do not store account passwords because login uses email codes.
- Security information: protected login-code checks, rate-limit records, session-token hashes, and account activity needed to prevent abuse. If you enable two-factor authentication, we store an encrypted authenticator secret and protected recovery-code checks.
- Mining information: payout addresses, worker names, connection times, accepted and rejected shares, work and difficulty records, estimated hashrate, reported firmware, and block/reward records. We use these to run the pool, show history, calculate BCH rewards, and verify spin qualification.
- Optional miner stats: temperature, power, voltage, frequency, fans, and other supported readings your firmware reports. We use these for device charts and any temperature alerts you configure. Your configured alert thresholds are saved to your account.
- Spins and store records: credit grants, spins, winnings, balances, redemption requests, promotional bonus assignments and draw records, fulfillment records, and administrative adjustments. We need these to maintain balances, prevent duplicate spending, and handle support or fulfillment.
- Website and network information: connecting to the website or pool reveals your IP address and technical connection information to our server. Access and security logs may include the requested URL, browser information, time, and errors. These help us operate and protect the service.
What other people can see
Wallet addresses and named-worker mining information are publicly viewable by looking up a wallet. Depending on the miner, this can include firmware, hashrate, best shares, connection state, and reported device stats. Wallet and device spin qualification can also be shown publicly. Do not put private information in worker names.
Your account email, private balances, recovery codes, and account history are not part of the public wallet view. A win share link is public to anyone who has it and may be fetched or cached by social platforms. It shows the recorded win amount, not your email, wallet, or account balance. BCH blockchain records are public and cannot be erased by this website.
Cookies and storage on your device
We use essential cookies for email-code verification, your login session, two-factor verification, and notification-device identification. A login lasts up to 30 days. Browser storage remembers recently checked wallets, sound, first-visit introduction and notice-dismissal preferences, and pending spin or redemption request references so retries do not spend twice. Those references are not passwords or recovery codes.
Our own first-party analytics runs without a cookie popup unless you opt out or your browser sends a privacy signal. The footer’s Cookie settings button lets you turn it off or on. Existing opt-outs are honored. An explicit choice is saved in browser storage for 180 days; when it expires, the default applies again. If browser storage is blocked, your choice may last only for the current page visit. We honor Global Privacy Control and Do Not Track signals by keeping optional analytics off. Turning analytics off does not affect mining, login, spins, purchases, or notifications.
Optional first-party analytics
When analytics is enabled, our own server records timestamped page views, named button/link clicks (including the Stratum copy button), email-login steps, completed logins, completed spins and Bolts won, and wallet links/unlinks. We use a random browser identifier and a protected, keyed representation of your IP address to count visitors and unique IPs. Raw IP addresses and full browser user-agent strings are not stored in the analytics database. A browser category such as Safari or Chrome is stored. The website and security logs described above may separately contain IP addresses.
When you are logged in, enabled analytics events reference your internal account ID so authorized administrators can measure daily active accounts and weekly return activity and view the associated account email. Anonymous events do not contain an email. Protected IP identifiers can still distinguish connections; a shared IP can represent several people. Counts cover browsers with analytics enabled and do not represent every visitor.
Analytics is stored separately in analytics.sqlite. Detailed events are retained for 90 days; daily summaries, protected visitor identifiers and account activity summaries for up to one year. The first observed login date is retained while the account exists to support cohort reporting. Backup copies can persist according to the backup practices below. There are no session recordings, heatmaps, captured form values, security codes, wallet addresses, recovery codes or confidential reward chances in analytics. Analytics does not change your mining rewards or account balances.
Choosing Essential only or turning analytics off stops future optional analytics from that browser and clears its analytics identifier where accessible. The server checks the choice on each event or account action. Your choice lasts 180 days on this browser, is not shared across your devices, and is not required to mine or use your account. Existing analytics records are not automatically deleted when you opt out; contact us about access or deletion. Prior external-analytics choices are not reused.
Reported pool firmware names and counts are also summarized from existing mining connection data to operate and monitor the pool. Firmware names are self-reported; they are not proof of firmware authenticity. This operational inventory is separate from optional browser analytics.
This version does not load PostHog or send new analytics to an external provider. Earlier versions used PostHog; records already transmitted may remain there under that project's retention settings. Contact us with questions about earlier data.
Optional introduction video
The first-visit introduction does not autoplay. The video loads from Shopify’s CDN only when you press Play, which shares your IP address and technical request information with that provider. Browser storage remembers that the introduction has been shown so it does not appear on every visit. Clearing that storage or using another browser may show it again.
Email and push notifications
We send your email address and a one-time login code to Zoho/ZeptoMail to deliver account emails. Our login emails disable open and click tracking.
If you enable push notifications, we save the browser’s push subscription endpoint and delivery keys with your account. Alerts are delivered through your browser or device’s push provider, such as Apple or Google. Push messages can contain worker names, temperatures, best-share results, or pool block information, and may appear on your lock screen. They do not include your email, login code, or recovery codes.
Push subscriptions can remain active after your login expires. You can disable alerts in your profile or device settings. Logging out disconnects this device’s subscription. Expired or rejected subscriptions are removed when detected.
Who receives information
Authorized operators can grant named recipients read-only access to the analytics dashboard, including account emails, timestamped consented actions and usage reports. Each link requires a verified login matching its allowed email, expires after the chosen period (up to 30 days), and can be revoked. These reports do not expose login codes, recovery codes, raw IP addresses, wallet addresses or admin controls. A recipient may retain information they already viewed.
Authorized HarloLabs operators can access the records needed for support, security, rewards, and fulfillment. Our server hosting and backup systems process the data needed to provide the service. Email and push providers receive the information described above. We do not send new analytics to PostHog or other external analytics services. Processing locations depend on those providers and can be outside your country.
If a redemption needs delivery details, we arrange that separately by email. We do not sell account information or use it for targeted advertising. Information may also be disclosed when legally required or needed to investigate abuse. Visiting store links or sharing to X or Facebook takes you to a separate service with its own privacy practices; we do not send your account email through those share buttons.
How long information stays
Email login codes expire after 10 minutes, and login sessions after up to 30 days; expired authentication records are cleaned up periodically. Mining and telemetry charts normally keep minute detail for about 24 hours and hourly detail for about 7 days. Devices disconnected for more than 15 minutes are removed from the wallet page with their device-specific data; aggregate work and reward accounting can remain.
Account, wallet-link, reward, redemption, and audit history currently has no automatic deletion date. These records maintain balances and reward history and help resolve support issues. Server logs and backups may retain copies after a record is removed from the active service. We do not promise immediate deletion from every backup.
Your choices and requests
You can use public pool views without an email account, choose whether to enable notifications or two-factor authentication, change alert thresholds, unlink wallets, log out, clear browser storage, and accept or reject optional analytics through Cookie settings.
For access, correction, or deletion requests, email Hello@HarloLabs.com. We may ask you to verify control of your account before acting. Tell us what you want changed or removed. We will explain any records we need to retain for accounting, security, or legal reasons, and the effect on account access or saved rewards. There is currently no self-service account deletion button.
Security and changes
We use encrypted website connections, access controls, protected authentication records, and optional two-factor authentication. No online service can guarantee complete security. Never email your wallet seed phrase, private key, or account recovery codes. Enter account codes only in the legitimate login or security forms.
We will update the effective date when this policy changes and describe material changes on the website. Where required, we will request consent before using information for a new purpose.
