Privacy Policy

This policy explains what HarumAI (“we”) collects through the website harum.ai, the download site download.harumai.com and the HarumAI desktop app, why, where it is kept, and what you can ask us to do with it. It is written for the laws that protect your data, including Indonesia’s Personal Data Protection Law (Law No. 27 of 2022, “UU PDP”) and, where it applies, the EU General Data Protection Regulation (“GDPR”).

Who is responsible

We are responsible for the personal data described here. For any privacy question or request, write to privacy@harum.ai.

This website

The website is a set of static pages. It has no account sign-in, advertising, tracking pixels or analytics script, and it sets no cookies. The feedback form prepares an email on your device rather than sending its contents to this website.

• Delivery logs. The site is served by Cloudflare. To deliver pages and protect the site from abuse, Cloudflare processes technical data about each request, such as your IP address, browser type, the page asked for and the time. We use this only in aggregate (for example, how many visits a page had) and to investigate attacks.
• Your theme choice. If you allow Functional storage and pick Dark or Light, that choice is saved in your browser’s local storage. Without that permission, the theme changes only on the current page. Choosing System or rejecting Functional storage removes the saved theme. It never leaves your browser.
• Cookies settings. Your privacy choice is kept in local storage for 180 days. The footer opens the panel where you can change or withdraw it. Analytics and advertising are not used. The Cookie Policy lists the browser storage, its purpose and duration.
• Email. If you write to one of our addresses, we receive your email address and what you wrote, and use them only to answer you.

The download site

When you download HarumAI from download.harumai.com, our server records the request (IP address, time, the file asked for and your browser type) to deliver the file and to prevent abuse. Any download count we publish is a total, never tied to a person.

The HarumAI app

Your account. To use HarumAI you sign in with a HarumAI account. We keep the details you give when you create it, such as your email address, and the preferences you save to your account.

Model provider keys. Keys for OpenRouter, 9Router and OmniRoute, HarumAI Gateway, OpenAI or Anthropic are stored on your computer, in your operating system’s encrypted storage. A key is sent only with the request it is for. When a request goes through our server, the key passes through it for that one request and is never stored: not in a database, a log, a transcript or a cache.

Your conversations. You choose where they are kept:

• Cloud: conversations, the agent’s runs, your projects’ names and settings, plans and artifacts are stored on our server with your account, so you can open them on any device. To answer you, the content of a conversation is sent through our server to the model provider you chose.
• Local: the HarumAI engine runs on your computer and keeps all of this in a database on your device. Nothing of it is stored on our server. The engine only asks our server to confirm your account.

Large files. Images, audio, video and PDF files over 1 MB are never stored on our server. Your device keeps them and sends them again when a conversation needs them.

Usage records. For Cloud, we record which model each request used and how many tokens it took, so you can see your usage and so we can run the service.

Diagnostics. Traces and error reports are kept on your device. They are sent to our server only if you turn that on in Settings, Observability, and secrets are removed from them before they are saved.

Published pages. If you choose to publish an artifact, anyone with its link can open it until you unpublish it.

Model providers

When you use a model, what you send it (your messages, the files and code the agent reads for that task) goes to the provider you chose, under your own key and that provider’s own terms and privacy policy. We do not control how a provider handles that data. Read their policies before you connect a key.

Why we use your data

We use personal data only to provide the website, the downloads and the app you asked for (performing our agreement with you), to keep them secure and prevent abuse (our legitimate interest), to meet legal obligations, and for anything else only with your consent, which you can withdraw at any time. We do not sell personal data and we do not use your conversations or code to train models.

Who we share it with

• Cloudflare, which delivers this website and protects our servers.
• The model providers you choose, as described above.
• Authorities, when the law requires it, or when we believe in good faith that it is needed to prevent a crime, protect someone from harm, or protect our services, our users or our rights.

Some of these services process data outside Indonesia. When they do, we rely on the protections the law requires for such transfers.

How long we keep it

Account data is kept while your account exists. Cloud conversations and artifacts are kept until you delete them or your account. Delivery and download logs are kept only as long as needed for security and to run the service. When you delete something, we remove it from our active systems; copies in backups expire on their own schedule. We may keep data longer when the law requires it, or when it is needed to investigate abuse, resolve a dispute or enforce our terms.

Your rights

Under UU PDP and, where it applies, the GDPR, you can ask us to tell you what data we hold about you, give you a copy, correct it, delete it, stop or limit how we use it, or move it to another service, and you can withdraw consent you gave. Write to privacy@harum.ai. We may need to confirm it is really you before we act. You can also complain to the data protection authority where you live.

Children

HarumAI is not meant for children. If you are under 18, use it only with the consent of a parent or guardian.

Security

We protect data with encryption in transit, access limited to the people who need it, and keys kept out of our storage altogether. No system is perfectly secure; if we learn of a breach that affects you, we will tell you as the law requires. To report a security problem, see the Security page.

Changes

We will update this page when what we collect changes, and change the date at the top. If a change is significant, we will say so in the app before it applies.