Hark.

Privacy policy

Last updated September 27, 2026

Hark exists to measure websites without tracking people, so this policy is short. It covers two groups: the visitors to websites that use Hark, and our own customers who sign up to use it.

Who we are

Hark is run by Durandal Limited, a company registered in England and Wales with company number 07891415. When this policy says "Hark", "we", "our" or "us", it means Durandal Limited.

For your account and billing details, we are the data controller. For the statistics we collect about visitors on your websites, you are the controller and we are your data processor: we only process that data to provide the service to you, on your instructions.

Visitors to websites that use Hark

The Hark script is about 1.5 KB. It sets no cookies, stores nothing on the visitor's device, and uses no fingerprinting or other persistent identifier. Nothing we collect can identify an individual visitor or follow anyone from one website to another, or from one day to the next.

For each page view or event, we record:

  • the page address, without its query string (campaign tags are kept, below)
  • the referring website (just its address; query strings are dropped) and any UTM campaign tags in the link
  • the browser, operating system and device type, worked out from the user agent
  • the country, region and city, plus an approximate position rounded to about 1 km for the live map. This comes from our network provider, Cloudflare, which looks it up from the visitor's IP address before the request reaches us.
  • how long the page was actively in view
  • the names and properties of any custom events the website owner has set up

We never store IP addresses or user agents. To count unique visitors, we combine the IP address and user agent with the website's domain and a random salt, then hash them. The salt changes every 24 hours and old salts are deleted, so the hash can't be reversed or linked to the next day's. The IP address and user agent are thrown away once the request has been handled.

Because no personal data is stored and nothing is written to the visitor's device, most websites that use Hark don't need a cookie banner for it. Each website owner is still responsible for its own privacy notice and legal basis.

Hark customers

Your account

You need an email address to sign up. We use it to send your sign-in links, and important notices about your account and billing. We don't send marketing email unless you ask for it.

We don't keep passwords. You sign in with a one-time link, and once you're signed in we set one cookie to keep you signed in. It's strictly necessary for the service, so we don't ask for consent to it. We store the websites you add and their settings.

Payments

Paddle.com is our reseller and merchant of record, so it handles checkout, payments, tax and invoices. Your card details go straight to Paddle; we never see or store them. Paddle tells us your subscription's status, plan and billing country, and gives us a customer reference. Paddle's checkout may use its own cookies. Paddle's own privacy policy covers what it does with your details.

Support

If you email us, we keep the conversation, including your email address, so we have a record of past issues.

Our own website

harkstats.com has no advertising and no third-party analytics or tracking scripts.

Who else processes data

We use a few providers to run Hark. Each one only gets what it needs:

  • Fly.io hosts our application and database in London.
  • Cloudflare provides DNS, network security and the location lookup described above.
  • Postmark sends our sign-in and account emails.
  • Paddle handles payments, tax and invoicing.

Some of these providers are based in, or may process data in, the United States. Where that happens, the transfer is covered by safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.

We never sell data, and we never share it for advertising.

How long we keep data

  • Website statistics are kept for as long as your plan's data retention period, and for as long as the site stays in your account. When you remove a site, all its statistics are deleted straight away.
  • Your account data is kept while you have an account. If you ask us to close it, we delete your account, sites and statistics within 30 days.
  • We keep what the law requires, such as billing records. Paddle keeps its own transaction records.

Security

All traffic to Hark is encrypted with HTTPS. Access to production systems is limited to the people who need it to run the service. If a breach affects personal data we hold, we'll notify affected customers and the relevant authorities without undue delay, as the law requires.

Your rights

Under UK and EU data protection law, you can ask to see, correct, export or delete your personal data, or object to how we use it. Email [email protected] and we'll reply within 30 days. If you're a visitor to a website that uses Hark, contact the website's owner first, as we hold nothing that identifies you. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

Changes to this policy

If we change how we handle personal data, we'll update this page and change the date at the top. If the change is significant, we'll email customers before it takes effect.

Contact

Privacy questions: [email protected]. Anything else: [email protected].