What we collect, why, and how you stay in control. Last updated: 9 October 2026.
Hartwell Labs (Bartosz Osiej, sole proprietorship, Poland) builds open-source security tooling: Talus Process Monitor, TrustNode, Scryer and Externum. This policy applies to our websites (hartwell-labs.pl and product pages), our bots and any tooling we operate.
Our sites are static pages served over HTTPS. You can read them without an account and we do not run advertising, analytics trackers or social pixels. We keep standard server logs (IP address, user agent, requested resource, timestamp) for security and abuse prevention; these are retained no longer than 14 days. If you enable dark mode or site preferences, they are stored in your browser only (local storage) and never transmitted to us.
When you install our TrustNode bot into a community chat (e.g. a Root App or Discord server), the bot stores the community/channel identifiers and configured announcement targets needed to deliver bot commands and validator alerts. We do not read private messages, do not store message contents longer than necessary to answer a command, and never sell or share this data. Command usage is logged briefly for abuse monitoring.
If you contact us by email, we process your address and message solely to answer you and to maintain our records of the correspondence. We keep it for the duration of the business relationship plus retention required by Polish tax law (5 years for invoices).
We process personal data under: performance of a contract (delivering the bot features you requested), legitimate interest (security of our services, anti-abuse, correspondence), and legal obligation (tax/finance records under Polish law). Where we rely on legitimate interest, you may object at any time.
Data is retained only as long as needed for the purpose above. We apply encryption in transit (TLS), least-privilege access, and review secrets handling continuously. Our security disclosure process is documented on our /security/ page.
Under the GDPR you may request access, rectification, erasure, restriction, portability and — where processing is based on legitimate interest — object. You also have the right to lodge a complaint with a supervisory authority (in Poland: PUODO). Contact us to exercise any of these rights; we respond within 30 days.
Our services are not directed at children under 13 (or under 16 in the EEA). If you believe a child provided us personal data, contact us and we will delete it.
We may update this policy; the version date below governs. For any privacy request write to contact@hartwell-labs.pl with subject “Privacy”, or use the postal contact listed on our company page.