Hark 隐私政策

生效日期：2026 年 11 月 1 日

一句话：Hark 不出售你的任何数据，也没有任何统计、广告或追踪。你的数据只存在你的设备上，或者在你的设备和你自己配置的服务器之间直接传输。只有当你主动订阅可选的 Hark Push 并开通后，通知元数据才会经过开发者运营的推送中继（详见第 5 节）；未订阅时，开发者收不到你的任何信息。

1. 我们收集什么

未订阅 Hark Push 时，什么都不收集。Hark 不包含任何统计分析、广告、崩溃上报或追踪代码，也不使用任何第三方 SDK 来收集数据。Hark 没有账号体系，不需要注册登录。订阅 Hark Push 后的数据处理见第 5 节。

2. 存在你设备上的数据

主机配置（主机地址、端口、用户名、分组等）和应用设置：保存在本机的应用存储中。
密码和私钥：保存在 iOS 钥匙串（Keychain）中，受系统加密保护。
服务器指纹：用于识别你连接过的服务器、防止中间人攻击，保存在本机。

这些数据不会发送给开发者或任何第三方。删除主机或卸载 Hark 会删除相应数据。

3. 与你自己的服务器之间的数据

Hark 是 SSH 客户端。你在终端里输入的内容、终端的输出、你选择上传的图片（保存到服务器的 ~/.hark/uploads/ 目录），都通过加密的 SSH 连接，直接在你的设备和你自己配置的服务器之间传输，不经过开发者或任何中间服务器。

为了显示会话列表、编码助手的状态和最近回复，Hark 会在你的服务器上执行只读命令（例如列出 tmux 会话、读取 Claude Code / Codex 在该服务器上的会话记录）。读取结果只显示在你的设备上，不会发送到其他任何地方。

4. 设备权限

麦克风与语音识别：用于语音输入命令。识别使用 Apple 的设备端语音识别完成，音频不会离开你的设备。首次使用某种语言时，iOS 可能会从 Apple 下载该语言的识别模型。
相机与照片：仅在你主动选择拍照或从相册选图时使用，图片只上传到你指定的服务器。从相册选图使用系统的照片选择器，Hark 无法访问你的整个相册。
剪贴板：只在你主动粘贴时读取；只在你主动复制时写入。
本地网络：用于连接你局域网内的电脑和服务器。
通知：用于在编码助手等待你确认时提醒你。未订阅 Hark Push 时，通知由设备本地生成，不经过任何推送服务器；订阅后的远程通知见第 5 节。

你可以随时在 iOS「设置」中关闭这些权限。

5. Hark Push 订阅（可选）

Hark Push 是一项可选的自动续期订阅：让你的服务器上的编码助手在等待确认或完成任务时，向你的手机发送推送通知，并可在锁屏上直接选择「允许 / 拒绝」。它由开发者运营的推送中继（托管在 Cloudflare 上）完成。未订阅的用户不经过中继，开发者收不到任何信息。

订阅并开通后，中继会处理：

设备推送令牌（APNs device token）和 Hark 随机生成的设备标识；
订阅凭证（Apple 签名的交易信息，用于确认订阅有效；我们不接触你的支付信息）；
通知元数据：助手名称、项目目录名、tmux 会话名、主机地址与端口、用户名、事件类型。

通知元数据只在转发给 Apple 推送服务（APNs）的过程中短暂经过中继，不做留存；中继不接收、不存储终端内容、命令内容、输出、密码或私钥。中继会保存的只有：推送令牌、设备标识、订阅标识与到期时间，以及通道记录（通道编号、密钥的哈希、你给主机起的显示名）。这些记录在订阅结束 30 天后自动删除。你也可以随时在 Hark 中停用某台主机的推送，对应的通道会立即从中继删除，hook 也会从服务器上移除。

6. 配置导出

你可以主动导出主机配置做备份。导出文件使用你设置的口令加密（AES-256-GCM），保存在你选择的位置。开发者无法访问该文件，也无法帮你找回口令。

7. 儿童隐私

Hark 是面向开发者的工具，不面向儿童，也不收集任何人的个人信息。

8. 政策变更

如果本政策有变更，我们会更新本页面并修改顶部的生效日期。

9. 联系我们

如对本隐私政策有任何疑问，请联系：hark@38209661.xyz

Hark Privacy Policy

Effective date: November 1, 2026

In short: Hark does not sell your data and contains no analytics, advertising, or tracking. Your data stays on your device, or travels directly between your device and the servers you configure yourself. Only if you choose to subscribe to the optional Hark Push and enable it does notification metadata pass through a push relay operated by the developer (see Section 5); if you do not subscribe, the developer receives nothing about you.

1. What we collect

Without a Hark Push subscription, nothing. Hark contains no analytics, advertising, crash reporting, or tracking code, and uses no third-party SDKs to collect data. Hark has no accounts and requires no sign-in. Data handling after subscribing to Hark Push is described in Section 5.

2. Data stored on your device

Host settings (address, port, username, groups) and app preferences are stored in the app's local storage.
Passwords and private keys are stored in the iOS Keychain, protected by system encryption.
Server fingerprints, used to recognize servers you have connected to and protect against man-in-the-middle attacks, are stored on your device.

None of this is sent to the developer or any third party. Deleting a host or uninstalling Hark removes the corresponding data.

3. Data exchanged with your own servers

Hark is an SSH client. What you type in the terminal, the terminal's output, and images you choose to upload (saved under ~/.hark/uploads/ on the server) travel over an encrypted SSH connection directly between your device and the server you configured. Nothing passes through the developer or any intermediate server.

To show session lists, coding-assistant status, and recent replies, Hark runs read-only commands on your server (for example, listing tmux sessions or reading the Claude Code / Codex session logs stored on that server). The results are displayed only on your device and are not sent anywhere else.

4. Device permissions

Microphone and speech recognition are used for voice input. Recognition runs on-device using Apple's speech recognition; audio never leaves your device. The first time you use a language, iOS may download that language's recognition model from Apple.
Camera and photos are used only when you choose to take a photo or pick an image; the image is uploaded only to the server you specify. Photo selection uses the system photo picker, so Hark cannot access your whole library.
Clipboard is read only when you paste and written only when you copy.
Local network access is used to connect to computers and servers on your local network.
Notifications alert you when a coding assistant is waiting for your confirmation. Without a Hark Push subscription they are generated locally on your device and no push server is involved; remote notifications after subscribing are described in Section 5.

You can turn off any of these permissions at any time in iOS Settings.

5. Hark Push subscription (optional)

Hark Push is an optional auto-renewing subscription that lets coding assistants on your servers send push notifications to your phone when they are waiting for confirmation or have finished, and lets you choose "Allow / Deny" right from the lock screen. It runs through a push relay operated by the developer and hosted on Cloudflare. Users who do not subscribe never touch the relay, and the developer receives nothing.

Once you subscribe and enable it, the relay processes:

your device push token (APNs device token) and a random device identifier generated by Hark;
your subscription receipt (Apple-signed transaction information used to confirm the subscription is valid; we never see your payment details);
notification metadata: assistant name, project folder name, tmux session name, host address and port, username, and event type.

Notification metadata passes through the relay only briefly while being forwarded to Apple's push service (APNs) and is not retained; the relay does not receive or store terminal content, command text, output, passwords, or private keys. What the relay does store is limited to: push token, device identifier, subscription identifier and expiry date, and channel records (channel ID, a hash of its secret, and the display name you gave the host). These records are deleted automatically 30 days after your subscription ends. You can also disable push for any host in Hark at any time, which immediately deletes the corresponding channel from the relay and removes the hook from your server.

6. Configuration export

You can export your host settings as a backup. The exported file is encrypted (AES-256-GCM) with a passphrase you choose and saved where you choose. The developer cannot access the file or recover your passphrase.

7. Children's privacy

Hark is a tool for developers. It is not directed at children and does not collect personal information from anyone.

8. Changes to this policy

If this policy changes, we will update this page and the effective date at the top.

9. Contact

If you have questions about this privacy policy, contact: hark@38209661.xyz