Privacy policy
Last updated 9 September 2026
This policy covers the HardenedOS website at hardenedos.com and the
Pixel Installer Android app
(com.hardenedos.installer.play), published on Google Play by
RoamGo LLC.
It is short because there is little to describe. Neither the site nor the app has accounts, advertising, or an analytics SDK of any kind. The app sends exactly one thing off your phone, and only when it crashes.
The Pixel Installer app
Pixel Installer runs on a host phone and writes an operating system onto a second Pixel connected over USB-C. It has no sign-in and no user account, so there is no profile to attach anything to.
What leaves your phone
| Destination | Direction | What |
|---|---|---|
releases.grapheneos.org |
Download | GrapheneOS release metadata and factory images. Requested by you, when you start a flash. |
api.hardenedos.com/dpc.apk |
Download | The Device Manager app, only if you use the optional enrollment step. |
api.hardenedos.com/installer/v1/crash-report |
Upload | A crash report, only after the app has crashed. Detailed below. |
That is the complete list. There is no other outbound request, no heartbeat, and no background reporting.
Crash reports
When the app crashes it writes a report to its own private storage and uploads it the next time you open the app. Each report contains exactly these fields, and nothing else:
- the app's package name, version code and version name;
- the Android release number (for example "16");
- the phone's manufacturer and model (for example "Google Pixel 9");
- the name of the thread that crashed;
- the exception type, its message, and the stack trace (truncated at 16,000 characters);
- the time the crash happened.
There is no identifier in a crash report — no account, no advertising ID, no device serial, no IMEI, no installation ID. Reports cannot be linked to each other or to you. As with any HTTPS request, our server sees the originating IP address while handling it; we do not store it alongside the report. Reports are sent over HTTPS and kept for as long as the bug they describe is open.
Nothing about the phone you are flashing is transmitted. The installer talks to the target device over the USB cable. Its serial, model, bootloader state and contents stay between the two phones in your hands.
Camera
The app can scan an activation QR code so you do not have to type it. The camera is used only while that scanner is open, the image is decoded on the phone, and neither the image nor the decoded code is transmitted or stored by us. The permission is optional — typing the code works just as well, and the app installs on devices with no camera.
The subscription
The first flash is free. Flashing after that requires a subscription, sold through Google Play with a free trial. Google processes the payment: we never see or receive your card number, billing address, or Google account. Play reports aggregate, anonymised sales figures to us, and tells the app only whether a valid subscription currently exists.
The count of free flashes used is stored on your device, in the app's own storage. It is never uploaded, and uninstalling the app erases it.
What the app does not do
- No advertising, and no advertising identifier is read.
- No analytics or telemetry SDK is linked into the app — not Firebase, not Crashlytics, not any other.
- No location, contacts, calendar, photos, microphone, call log or message access. The app does not request these permissions.
- No data is sold, and none is shared with third parties for their own purposes.
The website
hardenedos.com is a static site. It runs no analytics, sets no tracking cookies, and does not fingerprint visitors. Two things on the page do reach other servers, and you should know about both:
-
Google Fonts. Typefaces load from
fonts.googleapis.comandfonts.gstatic.com, so Google receives your IP address and browser user-agent as part of that request. -
Support chat. The chat bubble loads from
omemo.global. It stays dormant unless you open it; if you start a conversation, what you type is delivered to our support team over the encrypted OMEMO XMPP service.
The MDM demo at mdm.hardenedos.com sets one signed session
cookie when you sign in, so it can remember you are signed in. That is the
only cookie anywhere on the platform.
Children
Pixel Installer is a technical tool for reinstalling a phone's operating system. It is not directed at children, and we do not knowingly collect information from anyone under 18.
Your rights, and how to exercise them
Because crash reports carry no identifier, we cannot look one up by person — there is no way for us to find "your" reports, and equally no way for anyone else to. If you would rather no crash report were ever sent, the practical remedy is to uninstall the app; pending reports are stored only on your device and go with it.
For any question about this policy, about what we hold, or to ask us to delete something you believe is identifiable, write to hi@hardenedos.com and we will answer.
Changes
If this policy changes we will update the date at the top of this page. If a change ever means the app starts collecting something it does not collect today, we will say so in the app's release notes as well.
Who to contact
HardenedOS — hi@hardenedos.com
The Google Play edition of Pixel Installer is published by RoamGo LLC.