Harthena does not use tracking or advertising cookies. Here's exactly what we do — and don't — use.
Short version: Harthena does not set any HTTP cookies on your device. We use browser localStorage for your login session (this keeps you signed in across app restarts; it expires automatically after 30 minutes of inactivity or when you sign out), one localStorage item for a debug preference flag, and IndexedDB to cache your family's data on your device for offline use. The only third-party cookies you may encounter are set by Stripe on Stripe's own domain when you visit their payment checkout — not by us.
Cookies are small text files that websites store on your device via your browser. They are widely used to make websites work, remember your preferences, and collect analytics information. Cookies set by the website you are visiting are called "first-party cookies". Cookies set by other organisations through the website are called "third-party cookies".
This policy also covers related storage technologies including localStorage and sessionStorage, which are browser-side storage mechanisms that are not transmitted as HTTP cookies but may store data on your device.
In the UK, the use of cookies and similar technologies is regulated by the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. In the EU, the equivalent rules derive from the ePrivacy Directive (2002/58/EC) as implemented in each member state. Under both frameworks, cookies that are not strictly necessary for the service require the user's informed consent before being set.
Harthena does not set any HTTP cookies on your device. Neither the landing page (harthena.com) nor the app (Harthena PWA) sets any first-party cookies.
We use two browser storage mechanisms that are distinct from cookies — they are not transmitted as HTTP headers and are not accessible cross-site:
| Storage item | Type | Purpose | Duration | Personal data? |
|---|---|---|---|---|
bpm_session |
localStorage | Stores your session token to keep you logged in. Used to authenticate API requests to our servers. Stored in localStorage (not sessionStorage) so a Progressive Web App install stays signed in across app restarts, matching how a native mobile app behaves. |
Expires automatically after 30 minutes of inactivity, or immediately when you sign out. | Yes — contains your session token, user ID, and role. Not personally identifiable on its own but links to your family account. |
hna_debug (or brand-equivalent key) |
localStorage | Stores a boolean flag ("1" or absent) indicating whether debug logging is enabled in the browser console. Settable only via the parent settings panel. | Persists until cleared or toggled off. No expiry. | No — contains only "1" or is absent. No personal data. |
hna_family_<id> |
IndexedDB | Caches a sanitised copy of your family's app data (chores, meals, shopping, goals, etc.) on your device so the app still shows your data when you are offline. PIN hashes, calendar feed URLs, and session tokens are stripped before this cache is written. | Refreshed on every successful sync. Cleared when you sign out. | Yes — your family's app data, cached locally for offline use. |
hna_queue_<id> |
IndexedDB | Holds changes you make while offline (e.g. a chore marked done) until the app can send them to our servers. | Deleted once every queued change has been sent. Cleared on sign-out only when empty, so a pending offline change is never lost by signing out. | Yes — the specific changes you made while offline. |
Legal basis: localStorage (session token) and IndexedDB (offline data cache and write queue) are strictly necessary for the operation of the app's authenticated session and its offline functionality. Under PECR Regulation 6(4) and the equivalent ePrivacy Directive provision, strictly necessary cookies and storage do not require consent. The debug localStorage item contains no personal data and requires no consent.
When you subscribe to the Family plan, you are redirected to Stripe's hosted checkout page (hosted on stripe.com or checkout.stripe.com — a domain controlled by Stripe, not Harthena). While you are on Stripe's checkout page, Stripe may set its own cookies on your device for the following purposes:
These cookies are set by Stripe on Stripe's own domain and are governed by Stripe's Privacy Policy and Stripe's Cookie Settings. Harthena has no control over these cookies. Once you complete or exit the Stripe checkout page, you are returned to Harthena's domain and Stripe's cookies remain on stripe.com — not on harthena.com.
| Provider | Domain | Purpose | Category |
|---|---|---|---|
| Stripe | stripe.com / checkout.stripe.com | Payment fraud prevention, session management, checkout analytics | Third-party (Stripe's domain) |
The signed-in Harthena app does not run any analytics script in your browser. No third-party script of any kind loads once you are logged in — nothing reads or writes anything on your device for analytics purposes, so no PECR consent question arises for the app itself.
Our public marketing site (the pages before you sign in, such as the homepage and this blog) uses PostHog for privacy-friendly analytics, configured to store data in the EU (eu.i.posthog.com). It does not use cookies — data is stored in that page's localStorage. Session recording and autocapture are disabled. You can read PostHog's privacy policy at posthog.com/privacy.
Server-side business events: separately, our servers record a small number of account-level milestones directly — for example, "a family registered" or "a subscription started" — identified only by your family's pseudonymous shortcode, never your name, email, or any child's data. Because these events are recorded entirely on our servers and never touch your browser's storage, PECR's device-storage consent rules do not apply to them; see our Privacy Policy for the GDPR lawful basis.
No analytics cookies are set. We do not use Google Analytics, Plausible, Heap, Hotjar, Mixpanel, Facebook Pixel, or any advertising or cross-site tracking service.
Server-side request logs (HTTP method, URL path, response code, timestamp) are retained for 30 days for security and diagnostic purposes. IP addresses in audit logs are irreversibly hashed before storage.
For complete transparency, here is the full inventory of all browser-side storage used across the Harthena landing page and app:
| Item | Domain | Storage type | Set by | Necessary? |
|---|---|---|---|---|
bpm_session |
harthena.com | localStorage | Harthena app | Strictly necessary |
hna_debug |
harthena.com | localStorage | Harthena app (parent settings) | Functional (no personal data) |
hna_family_<id> |
harthena.com | IndexedDB | Harthena app | Strictly necessary (offline cache) |
hna_queue_<id> |
harthena.com | IndexedDB | Harthena app | Strictly necessary (offline write queue) |
| Stripe session cookies | stripe.com | HTTP cookie (Stripe's domain only) | Stripe (third party) | Third-party — Stripe's policy applies |
| Analytics cookies | — | — | — | Not used |
| Advertising cookies | — | — | — | Not used |
| Cross-site tracking | — | — | — | Not used |
Because Harthena does not set HTTP cookies, there is no cookie preference centre or consent banner on our site (one would only appear if we added non-essential cookies in future). You can, however, manage browser storage as follows:
You can clear localStorage and IndexedDB through your browser's developer tools or privacy settings. Note that clearing bpm_session (localStorage) will log you out of the Harthena app; clearing the debug flag will reset it to its default (off); clearing IndexedDB will remove your offline data cache (the app will re-download it next time you are online, and any offline changes not yet synced would be lost — signing out through the app itself is the safer way to clear this, since it never removes unsynced changes).
If you wish to block cookies on stripe.com, you can do so via your browser's cookie settings. Note that blocking Stripe's cookies may prevent the payment checkout from functioning correctly. This does not affect your use of the free plan.
All modern browsers allow you to block, restrict, or delete cookies from specific sites. Refer to your browser's help documentation for instructions. Independent guidance is available from the ICO at ico.org.uk.
Some browsers offer a "Do Not Track" (DNT) signal. Because Harthena does not track users across sites and does not use analytics or advertising cookies, our site does not change its behaviour based on DNT signals — there is nothing to turn off. We do not participate in cross-site tracking under any circumstances.
We will update this Cookie Policy if our use of cookies or storage technologies changes — particularly before introducing any new non-essential cookies. Material changes will be communicated by updating the "Last reviewed" date above and, where required by law, by displaying a consent banner before any new non-essential cookies are set.
We will also notify you by email if we introduce analytics or tracking technologies that require your consent.
If you have any questions about this Cookie Policy or our use of browser storage, please contact us at privacy@harthena.com.
For complaints about our use of cookies under PECR, you may contact the Information Commissioner's Office (ICO) at ico.org.uk. EU residents may contact the data protection authority in their member state.