1. Introduction
HardProps is a technology project in development. This policy explains personal data processing for its informational landing and Early Access accounts, where those features are available. It is not a claim that the future 3D platform is launched. Public registration and self-service deletion are unavailable; descriptions of those features apply only where enabled and do not announce their launch. The public site currently displays account forms as a disconnected interface preview; it cannot create an account, sign you in or take a payment.
2. Controller and contact
HardProps is owned and operated by Руслан Фролов Александрович, an individual managing the project from Ukraine. There is currently no registered company or sole-proprietor registration. Privacy and support contact: [email protected]. Any future change of operator will be disclosed with updated details and any notice required by law.
3. Scope
This policy concerns hardprops.com, the landing, authentication, account profile, Early Access ID and related service emails. It does not cover the separate HardProps Structure platform or establish terms for future purchases. External websites have their own privacy notices.
4. Categories of data
Account data includes email, internal user ID, provider identity, email verification status, registration date, chosen language and supplied display name. Membership records include a stable Early Access ID. Authentication also involves password-authentication data handled by Supabase, verification codes, session credentials and security events. Providers process IP addresses, device/browser information, request metadata and anti-abuse signals. Email records include recipient, content, delivery identifier, state and retry history. Do not send passwords, identity documents or sensitive information through unsolicited feedback. Deletion requests also involve request/status dates, hashed receipt/recovery proofs and separate minimal participation or justified obligation records.
5. Sources
Data comes from information you provide, your browser and interactions, our account systems and, if you choose Google sign-in when enabled, Google. Email and infrastructure providers return security and delivery information. We do not request access to your Gmail mailbox.
6. Purposes and legal grounds
We process the email, account and participation data needed to provide the account service you request and take steps at your request before an agreement, where those grounds apply. Under GDPR, where applicable, these are Article 6(1)(b) purposes; under Ukrainian law, the corresponding transaction-related ground is Article 11 of the Law on Personal Data Protection. Abuse prevention, session protection and necessary security evidence pursue legitimate interests, subject to necessity, proportionality and your overriding rights. Compliance with applicable duties, including handling statutory privacy requests, relies on the relevant legal obligation. Optional marketing, if introduced, requires separate consent where required. Choosing Google or acknowledging this policy is not blanket consent to unrelated processing. You may ask about the grounds and object to legitimate-interest processing.
7. Registration and authentication
The account implementation supports email-and-password registration, email confirmation, password sign-in, code-based recovery and alternative Email OTP access where enabled. Supabase Auth receives passwords over HTTPS and manages their verification; passwords are not stored in HardProps profile or entitlement tables, application browser storage or application logs. Confirmation and recovery use six-digit single-use codes, currently valid for ten minutes, with at least sixty seconds between sends and additional anti-abuse limits. Existing OTP participants can verify their email with a fresh code and set a password on the same account. Password recovery does not create a new participant or replace an existing Early Access ID. Membership is created idempotently after verified sign-in. Password-change security notifications are configured; delivery remains subject to provider operation. Public registration is not launched by this notice. Email and successful verification are necessary for an account; without them we cannot provide it. A display name is optional. Signing out does not delete the account.
8. Google Sign-In
Google sign-in is available only in environments where account services and the Google provider are enabled; the public interface preview does not perform sign-in. If you choose it where available, it requests only openid, email and profile. Google may supply an account identifier, email and verification information, name and profile image. Supabase stores returned identity/profile metadata; the landing uses email for the account and service messages and the supplied name for the editable profile. The landing does not currently display the Google profile image. The Google identifier links the sign-in identity; it is not the public Early Access ID. We do not request Gmail, Drive, contacts or calendar access. Basic identity data is processed by Supabase; the recipient email and Early Access ID are included in the welcome message delivered through Resend. Network providers process associated requests. No Google access token or session credential is included in welcome emails. Google independently processes your use of its service under its own policy.
9. Service emails
Supabase sends authentication emails through Resend SMTP. A separate server function sends a welcome email with your Early Access ID and account link after membership creation. A private queue records attempts, delivery status and provider message ID for retries and duplicate prevention. These are service messages, not a subscription to marketing. Open and click tracking for the sending domain are disabled in the checked configuration; delivery events are still processed. The operator may send a service reply about the handling of a privacy or deletion request. Receipt of that reply does not by itself establish erasure from every provider or recovery copy. Service replies contain no session or recovery secrets.
10. Cookies and browser storage
The reviewed application stores the selected language and Supabase session data in localStorage. The OAuth PKCE flow may also store a temporary verifier there. No advertising tracker was identified in the reviewed landing code. Turnstile processes browser/security signals; its current widget has no pre-clearance enabled. This does not rule out cookies or logging by hosting/security providers or Google during their own interactions. Necessary authentication and security technologies must be distinguished from optional tracking under applicable local rules. No optional advertising analytics are enabled by this legal update. Browser controls can clear local data; clearing it can sign you out and does not erase server records. The prepared deletion flow also uses sessionStorage for the private status/recovery receipt and can create a local receipt file only when you choose to save it. The server stores hashes rather than the receipt secrets. These pseudonymous request and rights records remain subject to data-protection rules.
11. Service providers
Supabase provides Auth, database and server functions; Resend delivers email; Cloudflare provides Pages hosting, network/security services and Turnstile; Google provides optional identity services. Providers and their subprocessors receive data needed for those tasks. Their roles may include processing on our instructions and independent processing under their own terms. Authorized administrators can access data for operation and support. Disclosure may also be required by law. Provider privacy information is linked below; those notices do not replace this policy. Google/Gmail also handles messages you send to the approved support mailbox [email protected]; this does not grant the application access to users’ Gmail mailboxes.
12. International transfers
The primary Supabase project region is eu-west-1 in the EU. This is not a promise that support, security logs or every subprocessor operates only there. Resend provides EU-region email sending, but its published DPA identifies US processing; an EU sending region is not EU-only storage. Google and Cloudflare operate global infrastructure, and the operator manages the project and support correspondence from Ukraine. Relevant destinations therefore include Ukraine, the EU and the United States, with other locations possible under provider subprocessor arrangements. Where applicable law requires safeguards for international transfers, the relevant transfer must have an applicable lawful arrangement, such as valid standard contractual clauses or another permitted mechanism. A provider publishing clauses is not proof that every HardProps transfer is covered. Contact [email protected] for information about the applicable safeguards and how to obtain relevant copies, subject to lawful redaction. Provider privacy and transfer resources are linked below.
13. Retention
Accounts are not automatically deleted solely for inactivity. Early Access IDs and valid participation rights are retained while the relevant programme and a lawful processing basis continue; this does not justify indefinite retention of every profile field. Account data is retained for the requested service until a verified deletion request or the end of its necessary purpose, subject to applicable duties and justified exceptions. Welcome payloads and delivery records currently have no application-level automatic purge; retries and duplicate prevention do not establish a retention period. Necessary delivery markers are distinguished from message content when reviewing erasure. Support and security evidence is kept only while needed to handle the matter or for an identified continuing legal or security purpose, with necessity reviewed when the matter closes or the purpose changes. Resend publishes 30-day email/log retention on its standard Free, Pro and Scale plans and seven-day backup retention; these are provider-controlled statements, not a verified account-specific HardProps deadline. Supabase, Google and Cloudflare records have product-specific cycles for which no universal period has been established here. Any operator recovery copies, if created, are kept only while needed for recovery or an identified legal duty; necessity is reviewed when copies are replaced or their recovery purpose ends. Provider backups follow the provider’s applicable lifecycle. Data already erased from active systems must not be reintroduced into ordinary use during recovery. OTP validity is not deletion of emails or audit records. Minimal lawful rights or obligation records are separated from a deleted sign-in profile and reviewed when the programme or need ends; financial payments and Rewards are not launched. The operator reviews welcome-message content when delivery and any necessary retries end, removes content no longer needed, and retains a minimal delivery marker only for a documented continuing purpose. This is a manual responsibility, not an existing automatic purge.
14. Security
The implementation uses HTTPS, verified authentication, row-level access policies and restricted server credentials. Welcome messages exclude session tokens and Supabase secrets. These measures reduce risk but cannot guarantee absolute security or availability. Keep codes and sessions private and report suspected compromise at [email protected]. Do not send a verification code in a support request.
15. Privacy rights
Depending on applicable law, rights may include information and access, correction, erasure, restriction, portability, objection to legitimate-interest processing, and withdrawal of consent without affecting earlier lawful processing. Exceptions may apply. You may complain to the competent authority, including the Ukrainian Parliament Commissioner for Human Rights where relevant, or a competent EU supervisory authority where GDPR applies. This does not limit available judicial remedies. We do not use a decision system that grants financial benefits or produces legal effects based solely on automated profiling in the reviewed registration flow.
16. Requests and account deletion
For access, correction, export, objection or deletion requests, contact [email protected]. Requests are handled manually by the operator; general self-service deletion is unavailable. We record the receipt date, request type and scope, proportionate identity verification, applicable deadlines, actions and outcome, and any justified retention or follow-up. Do not send passwords, codes, session credentials or private receipt/recovery secrets. The operator assesses the requested scope, necessary retained categories and any legal or technical obstacles. We do not promise automatic deletion or a fixed completion time for every system. Applicable response and erasure duties remain binding, and an operational obstacle does not itself extend a legal deadline. Inactivity alone does not cancel valid participation rights, and deletion does not waive valid obligations. Any retained identifiers or rights records may remain personal data and require a lawful basis and necessity review. You can also request assessment of those residual records. For access requests under Article 16 of Ukraine’s Law on Personal Data Protection, we communicate the review outcome within ten working days and satisfy the request within thirty calendar days, unless the law provides otherwise. Where GDPR applies, we respond to rights requests without undue delay and within one month of receipt; a permitted extension of up to two further months requires notice and reasons within the first month. These response periods do not authorize delaying erasure that is legally due sooner.
17. Children
Early Access registration is restricted to people aged 18 or older. We do not ask for a date of birth or identity document in the normal registration flow. The prepared registration interface uses a separate, initially unchecked adult declaration during registration; this is a user declaration, not documentary age verification or a server-enforced proof of age. We do not knowingly invite children to register. If you believe a child has submitted personal data, contact [email protected] so the operator can assess and handle the information lawfully.
18. Marketing
Creating an account, selecting Google or receiving a welcome email does not subscribe you to marketing. No marketing-consent record or unsubscribe mechanism is currently implemented, and this update does not start marketing. Any future optional subscription must use a separate unchecked choice where consent is required, record the choice and notice version, and provide an effective withdrawal method. Refusal must not prevent Early Access registration. Service codes and essential security messages are separate.
19. Policy changes
The effective edition will identify its date and version. Material changes, including a future company taking over operation, require an updated notice and additional communication where required. Changes do not remove mandatory rights or retroactively authorize incompatible uses. All three language versions are intended to convey equivalent meaning; no translation overrides mandatory local protections.
20. Contact information
For privacy, account support, security or deletion requests, contact Руслан Фролов Александрович, the individual HardProps operator in Ukraine, at [email protected]. Website: https://hardprops.com. The name is retained in its original script in all language versions. Do not send passwords, verification codes, session credentials or private recovery receipts.