Privacy Policy

2.1 Account Data

When you sign up for HardStop, we collect your name and email address. We use this to manage your account, deliver removal credentials when your wait time expires (or to your accountability partner where you have nominated one — see Section 2.4), send renewal reminders, and communicate with you about your service. We cannot operate HardStop without this information.

Legal basis (UK/EU GDPR): performance of a contract.

2.2 Payment Data

When you subscribe to HardStop, your payment is processed by Stripe, Inc. Stripe collects and holds your payment card details. HardStop does not store your full card number, CVV, or banking credentials. We receive from Stripe only a transaction confirmation, the last four digits of your card for reference, and your billing country. We retain payment transaction records as required by applicable financial and tax law.

Legal basis (UK/EU GDPR): performance of a contract; legal obligation.

2.3 Wait Time Preferences and Custom Block Requests

We hold your chosen wait time duration, including any custom wait time you select in the HardStop application, and any block-removal wait times you select for custom blocks. This is necessary to honour the commitment you made to yourself when you signed up.

We also hold the list of custom websites and applications you have asked us to block on your devices, together with the dates those blocks were requested. We hold this because we cannot apply, maintain, or remove your custom blocks without it. We recognise that your personal blocklist can reveal information about your habits and struggles, and we treat it as sensitive. We use it solely to configure your filtering, and we do not analyse it, profile you with it, or disclose it to anyone except our filtering infrastructure provider (NextDNS) to the extent technically necessary to apply the blocks.

Legal basis (UK/EU GDPR): performance of a contract.

2.4 Accountability Partner Data

If you choose to nominate an accountability partner under Section 5.6 of the Terms of Service, we collect and hold the email address you provide for that partner. We use it for exactly one purpose: delivering your removal credentials to your partner instead of to you, in accordance with the arrangement you set up. Your partner receives credential delivery emails only. We do not send your partner marketing, status updates, notifications, or any other communication, and we do not use their address for any other purpose.

This information is provided to us by you, not by your partner. By nominating a partner, you confirm that your partner has agreed to receive removal credentials on your behalf and knows that your account relates to an adult content filtering service. You are responsible for that disclosure to your partner; we rely on your confirmation. If your partner wishes to have their email address removed from our records, they may contact us at support@tryhardstop.com, and we will remove it and notify you that your partner arrangement has ended (a change which is then handled under Section 5.6 of the Terms of Service).

Partner email addresses are deleted when the partner arrangement ends, and in any event no later than 30 days after your account is closed.

Legal basis (UK/EU GDPR): performance of a contract with the account holder; legitimate interests (administering the credential delivery arrangement the account holder has requested).

2.5 Device Enrollment Data — All Platforms

HardStop's content filtering on iPhone, iPad, Mac, and Windows is delivered through infrastructure operated by NextDNS, Inc. Because your devices are configured to use HardStop's NextDNS filtering, certain technical information is visible to HardStop within the NextDNS administrative dashboard. This is a necessary technical consequence of how the service works and is disclosed in Section 3.4 of the Terms of Service.

The information visible to HardStop may include: your email address; the device name or label assigned during setup; a system-assigned configuration or device identifier; your device model and operating system version where reported; connection status and last-seen timestamps; and approximate geographic location at city level based on your connection point.

We treat all of this information as personal data. Where your account covers devices belonging to other members of your household, we hold the same technical information for each enrolled device, and you are responsible for making this policy available to those household members before their devices are enrolled. We do not use it for any purpose other than confirming your enrollment status, administering your service, and facilitating your removal from the service. We do not profile, analyse, or commercialise this data in any way.

Legal basis (UK/EU GDPR): performance of a contract; legitimate interests (service administration).

2.6 Website Analytics and Advertising Measurement

Our website at tryhardstop.com uses analytics and advertising measurement tools to help us understand how visitors find and use our site and whether our advertising works. These tools collect data including your IP address, browser type, device type, pages visited, and referring URLs. We use two providers:

• Google: We use Google Analytics and Google Tag Manager. Google collects data about your visit to our website in accordance with Google's Privacy Policy at policies.google.com/privacy. You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.
• Meta: We use the Meta Pixel on our website. This allows us to measure the effectiveness of our advertising and understand how people interact with our site. Meta collects data in accordance with Meta's Privacy Policy at facebook.com/policy. You can manage your Meta ad preferences at facebook.com/ads/preferences.

A frank note about what this means. HardStop is a service people use for a personal and sensitive reason. If you consent to analytics and advertising cookies, Google and Meta will receive the fact that your browser visited tryhardstop.com. We do not send these providers your account data, your blocklist, your wait times, or anything about your use of the HardStop service itself — only standard website visit data as described above. If you would prefer that Google and Meta receive nothing at all, decline analytics and advertising cookies in the cookie notice. The website works fully without them.

Both tools use cookies. Analytics and advertising cookies are set only with your consent, given via the cookie notice on your first visit, and you can withdraw that consent at any time. See Section 7 for more information, and see Section 8 for your right to opt out of "sharing" under California law.

Legal basis (UK/EU GDPR): consent, obtained via our cookie notice on first visit.

2.7 Support Communications

When you email us at support@tryhardstop.com, we receive and retain the content of that communication, including your email address and anything you choose to share with us. We use this solely to respond to and resolve your support request. Our inbox is operated via Google Workspace (Gmail). Support emails are retained for up to two years from the date of the communication, after which they are deleted.

Legal basis (UK/EU GDPR): legitimate interests (providing customer support).

2.8 Emergency Access Requests

If you email us with the subject line "EMERGENCY ACCESS" under Section 5.4 of the Terms of Service, you may choose to share details of a medical emergency, mental health crisis, safety threat, or other serious situation. Information about your health or a crisis you are experiencing is special category data under UK/EU GDPR and sensitive information under the Australian Privacy Act, and we treat it accordingly.

We use this information for one purpose only: assessing and actioning your emergency access request as fast as possible. We do not use it for any other purpose, do not add it to any profile, and restrict access to it to the team members handling the request. You do not need to provide detail beyond what you are comfortable sharing — a brief description is enough for us to act.

Emergency access communications are retained under the same schedule as other support communications (up to two years) so that we can evidence how the request was handled, after which they are deleted.

Legal basis (UK/EU GDPR): protection of vital interests; and your explicit consent, given by voluntarily including this information in your request. Where you would prefer we delete the content of an emergency request after it is resolved, tell us and we will do so, retaining only a minimal record that a request was made and actioned.

2.9 Guarantee Claim Data

If you make a claim under the Zero Access Guarantee (Section 7.6 of the Terms of Service), we collect the information you submit with the claim: a description of what occurred, the approximate date, the device involved, and the site, application, or content source involved, together with any additional evidence we reasonably request or you choose to provide. Evidence you provide, such as screenshots or screen recordings, may by its nature show your device and the adult content accessed.

We use claim materials solely to assess, remediate, and resolve the claim, including verifying the conditions in Section 7.6 of the Terms of Service. Access to claim evidence is restricted to the team members assessing the claim. We do not use claim materials for any other purpose.

Claim materials, including any evidence, are deleted no later than 90 days after the claim is finally resolved, unless a longer period is required to comply with law or to establish, exercise, or defend legal claims arising from the claim itself. Where a refund is issued, the refund record is retained with our payment records as required by applicable financial and tax law.

Legal basis (UK/EU GDPR): performance of a contract (administering the guarantee included with your subscription); legitimate interests (preventing fraudulent claims); and, for any evidence that reveals sensitive information about you, your explicit consent, given when you choose to submit it.

2.10 The Root Cause Quiz

The Root Cause Quiz, formerly provided as a bonus with certain plans and no longer offered but still usable by members who received it, is hosted as a custom GPT on OpenAI's ChatGPT platform. When you use the quiz, you are interacting with OpenAI's service, not with HardStop's systems. HardStop does not receive, see, or store your quiz answers or anything you type into the quiz. Your interaction with the quiz is processed by OpenAI in accordance with OpenAI's privacy policy, available at openai.com/policies/privacy-policy, and is subject to the terms of your own ChatGPT account where you have one.

Because we do not control OpenAI's platform, we recommend that you avoid including directly identifying information (such as your full name or contact details) in your quiz answers if you prefer that your responses not be associated with you on OpenAI's systems.

2.11 Marketing Communications

If you are a HardStop subscriber, we may occasionally send you emails beyond transactional service communications. These include check-in messages, feedback requests, and occasional updates about the service. These are sent to your registered email address — never to an accountability partner's address. You can opt out of non-transactional emails at any time by emailing support@tryhardstop.com or using the unsubscribe link in any marketing email. Opting out of marketing emails does not affect your ability to receive service-critical communications such as renewal reminders and removal credentials.

Legal basis (UK/EU GDPR): legitimate interests (existing customer relationship); or consent where required by applicable law.

2.12 What We Do Not Collect

HardStop does not collect: your browsing history or DNS query logs on any platform; the websites you visit or attempt to visit; your search terms or online behaviour; your files, messages, photos, contacts, or any content stored on your device; your precise GPS location; your Root Cause Quiz answers, which are processed by OpenAI and never reach us; or any data through the HardStop Enforcer application, which has no data collection capability of any kind.

2.13 Support Communications and AI Assistants

When you contact us through the chat on tryhardstop.com or by email to support@tryhardstop.com, we collect the content of your messages, the email address or chat session you write from, and any details you choose to share (for example your device type, the sites or apps involved, or your account email).

Our front-line support is provided in whole or in part by AI assistants operated on the Chatbase platform: the assistant reads your message and generates a response using HardStop's published policies and support guides. Your conversation is also available to our human support team, who review conversations, take over where a human is needed, and handle every request that changes your account or releases removal credentials. AI assistants do not make decisions that have legal or similarly significant effects on you.

We use support communications solely to provide support, to keep a record of what was agreed, and to improve our support guides; we do not sell them or use them for advertising. Because support conversations may reveal sensitive information about you, we recommend sharing only what is needed to resolve your issue.

Support records are retained for as long as your account is active and for up to 12 months afterwards, unless a longer period is required by law or to establish, exercise, or defend legal claims.

Legal basis (UK/EU GDPR): performance of a contract (providing support); legitimate interests (keeping accurate support records and improving our service); and, for any sensitive information you choose to include, your explicit consent.

All users

You can ask us what personal data we hold about you; you can ask us to correct inaccurate data; you can ask us to delete your data, subject to our legal retention obligations; and you can opt out of non-transactional marketing emails at any time.

UK and EU users (UK GDPR / EU GDPR)

In addition to the above, you have the right to restrict our processing of your data in certain circumstances; the right to data portability for data you have provided to us; the right to object to processing based on legitimate interests; and the right to withdraw consent for any processing based on consent, including analytics and advertising cookies. You also have the right to lodge a complaint with your supervisory authority — the UK Information Commissioner's Office at ico.org.uk, or your relevant EU data protection authority.

Australian users (Privacy Act 1988)

You have the right to access personal information we hold about you and to request correction of that information under the Australian Privacy Principles. If you believe we have handled your personal information in a way that does not comply with the Australian Privacy Principles, you may complain to us first, and if unresolved, to the Office of the Australian Information Commissioner at oaic.gov.au.

California users (CCPA/CPRA)

You have the right to know what personal information we collect, use, and share; the right to delete personal information we hold about you, subject to certain exceptions; the right to correct inaccurate personal information; and the right to opt out of the sale or sharing of personal information.

HardStop does not sell personal information. However, our use of the Meta Pixel and Google Analytics on our website may constitute "sharing" of personal information for cross-context behavioral advertising as defined under the CCPA/CPRA, because these tools transmit website visit data to Google and Meta. You can opt out of this sharing at any time by declining or withdrawing consent for analytics and advertising cookies via the cookie settings on our website, or by emailing support@tryhardstop.com with the subject "Do Not Share My Personal Information." We do not sell or share the personal information you provide through your HardStop account (your name, email, wait times, blocklist, partner nomination, or enrollment data) with anyone for advertising purposes.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Exercising your rights

To exercise any of the rights listed above, email us at support@tryhardstop.com. We will respond within 30 days for UK, EU, and Australian requests, and within 45 days for California requests. We may ask you to verify your identity before processing your request. Requests relating to an accountability partner's email address may be made by the partner themselves as described in Section 2.4.