Privacy Policy

1. Who We Are

Harvestkin is a marketplace where people list what they grow, raise, and make, find someone nearby who wants it, and arrange a trade directly with each other. We do not handle the goods, we do not handle money between members, and we do not record what any trade was worth.

This policy explains what personal information Harvestkin collects, why, who else touches it, how long we keep it, and what you can ask us to do about it. It covers both harvestkin.com (the public site) and app.harvestkin.com (the app you sign in to).

Harvestkin is operated by [LEGAL ENTITY NAME — OWNER CONFIRMS], based in [British Columbia, CANADA — OWNER CONFIRMS]. For privacy purposes we are the controller of the information described here (the business under California law, the organization under PIPEDA, the enterprise under Quebec Law 25).

Privacy is the product, not a policy page. Most of the commitments below are properties of how the software is built rather than promises about how we behave — the section on data minimisation (Section 3) names the ones that are structural.

2. What Data We Collect

Account data

• Your email address. This is the only contact identifier we hold. Sign-in is passwordless: we email you a six-digit code. We never receive or store a password for your Harvestkin account.
• Your handle — your public name on the marketplace. If you do not choose one when you sign up, we generate one from the part of your email address before the @ (so jane.doe@example.com becomes jane_doe). Your handle is visible to anyone, including people who are not signed in. You can change it at any time in your profile, and we suggest you do if you would rather your email name not be public.
• Your display name, bio, and avatar link, if you choose to add them. Your display name and avatar link are public; your bio is visible only to you and is not published in the public profile.
• Your settings and consents — language, units, notification preferences, and the timestamps at which you accepted the terms and this policy.

We do not collect, and there is no field in our database for: your legal name, your street address, your phone number, your date of birth, any government identifier, or any payment instrument or bank detail. There is no payment system in Harvestkin at all.

Location data

Harvestkin needs approximate location to match neighbours, and is built so that it never learns a precise one.

• How a location is captured. You place a pin on a map yourself. Harvestkin never asks your browser or device for your location — there is no use of the browser geolocation API anywhere in the app.
• How it is reduced. Every location — both your profile home point and every listing's location — is snapped to a fixed 0.01-degree grid before it is stored. The snap runs in the database on every write, so no precise coordinate is ever persisted, not even briefly.
• What that means in practice. A grid cell is a rectangle roughly 1.1 km north-to-south, and roughly 0.5–0.7 km east-to-west at Canadian latitudes (cells narrow as you move away from the equator). We describe it as a cell rather than a radius because that is what it is.
• What the snap does and does not do. It is deterministic: the same pin always produces the same stored point, and re-submitting a pin never moves it. That means it bounds the precision of what we hold — it does not add random noise, and it is not a defence against someone who already knows roughly where you live.
• What other people see. On a listing, others see the snapped cell, drawn as a box rather than a dot. Your profile's home point is not public — only the coarse region it falls in is.

Listings and the things you publish

A listing holds what you are offering or looking for, a quantity and unit, a title, an optional description and variety, the snapped location, and its status. Active listings are public and are readable by anyone, including people who are not signed in. So are any certification claims you attach, including any proof link you supply — treat a proof link as public.

Photos

Photos you attach to a listing are stored in a private bucket and served through short-lived signed links.

Embedded metadata is removed before a photo is stored. Many cameras and phones write GPS coordinates, a capture timestamp, and a device identifier into the image file itself. Your browser re-encodes each photo before it is uploaded, which produces a new image from the picture data alone — so the file we receive carries none of that metadata, and we never hold a copy that does. Photo rotation is preserved, because it is applied to the picture rather than left in a tag. If your browser cannot process a photo, the upload is refused rather than sent unprocessed.

What this does not do: it cannot remove information that is visible in the picture — a street sign, a house number, a recognisable view. Those are yours to judge before you upload.

Messages

Messages between members are end-to-end encrypted in your browser. The encryption keys are generated on your device and the private keys never leave it in a form we can open.

• What we cannot read: the content of your messages. The server stores ciphertext, and the API that moves it treats it as opaque bytes. No administrator has any access path to message content — there is no such permission in the database for anyone.
• What we can see, and you should assume we can: who is messaging whom, when, how often, and the approximate size of each message. End-to-end encryption protects content, not the fact of a conversation. We do not analyse this metadata, but it exists, and we are telling you so rather than letting "end-to-end encrypted" imply more than it delivers.
• Backups. If you enable a recovery method, we store your private keys in a form sealed by a secret we never receive (a passkey-derived secret or your recovery phrase). We can hold that bundle and hand it back; we cannot open it. If you lose that secret, we cannot recover your messages for you.
• Known limits, stated plainly. This system does not provide forward secrecy or post-compromise security, and message timestamps are set by the server rather than cryptographically proven. It protects your message content from us and from anyone who obtains our database. It is not designed to withstand a targeted state-level adversary.

Connections and trades

When you and another member connect around a listing, we record: the listing, the two members, the status, and the timestamps at which each of you confirmed the trade was completed.

We record nothing about what the trade was worth. There is no price, amount, value, or traded-quantity field on that record anywhere in our database — this is a structural property of the schema, not a setting. Harvestkin runs no payments between members and holds no credits, points, balances, wallets, or platform currency of any kind.

Ratings

After a trade, either side may leave a rating. A rating is a score from 1 to 5 and nothing else — there is no free-text field on a rating. Ratings are double-blind: you cannot see what someone said about you until both sides have rated or a fixed window has passed. Your public reputation is shown only once at least three ratings have been revealed, so that a single rating can never be read off your profile.

Reports

If you report a listing or a member, we record who reported, what was reported, a reason, and your note (up to 500 characters). Reports are readable by our moderators. Report notes are never fed into any automated or AI system.

Market information

Harvestkin publishes advisory ratios between commodity types — an indication of how much of one good tends to be offered against another, in a region, over a period. These are computed only from public listing data, are aggregated with a hard minimum of five contributing samples per figure, and carry no user, listing, connection, or trade identifier at all. They are advisory market information. They are not prices, and nothing in Harvestkin uses them to settle anything.

Technical data

We do not run analytics, advertising, or tracking of any kind today (Section 5). Our hosting and infrastructure providers keep ordinary server logs — IP address, user agent, request path — as any web host does. Our own application code logs error codes, not you: it does not log IP addresses, request bodies, bearer tokens, email addresses, message content, or coordinates.

3. How We Use Your Data

We use personal information only to:

• Run your account — sign you in by emailed code, hold your settings and preferences.
• Operate the marketplace — publish your listings, show you nearby matches, let you connect with other members.
• Deliver messages — move encrypted messages between you and the member you are talking to.
• Send you notifications you asked for — in-app, and by email where you have enabled it.
• Maintain reputation — compute the floored reputation figure shown on your profile.
• Keep the marketplace safe — review reports, moderate listings and certification claims, and act on abuse.
• Produce advisory market information — in aggregate form only, from public listings, with no identifiers attached.
• Meet legal obligations and respond to your privacy requests.

We do not sell personal information. We do not share it with advertisers. We do not track you across other websites. There is no advertising network, data broker, or cross-site tracker in Harvestkin.

Data minimisation as architecture

Several of the limits above are enforced by the software rather than by policy, and would take a deliberate schema change — not a config toggle — to undo:

Lawful bases for processing (EU/UK data subjects)

If you are in the EU or UK, we rely on:

We do not process special-category data (GDPR Art. 9) and ask for none.

4. Third-Party Processors

These are every third party that receives data in the course of running Harvestkin. We keep this list short on purpose, and we will update it here when it changes.

What we send to Anthropic, precisely

Harvestkin makes exactly one call to an AI model, and only when you type a name for a good that our catalogue does not already recognise. It receives a fixed instruction, a list of our own commodity names, and the words you typed — nothing else.

It does not receive: your user id, your email address, your session token, your IP address, your location, your listing, your messages, your ratings, or any other identifier. Its only possible effect is to propose a new name for our catalogue, which a human moderator must approve before it is used.

Third parties your browser contacts directly

• OpenFreeMap (tiles.openfreemap.org) serves the background map tiles in the app. Because your browser requests those tiles directly, OpenFreeMap can see your IP address and which map areas you are looking at. We do not send it your account or your pin. We are working to serve map tiles ourselves, which will remove this third party entirely.

There are no other third-party origins that either site is permitted to contact — this is enforced by a Content-Security-Policy on the app origin, not merely by convention.

5. Cookies, Storage, and Analytics

Harvestkin sets no cookies. Not one. There is no cookie banner because there is nothing to consent to.

We run no analytics today. No Google Analytics, no advertising pixel, no session recorder, no error-tracking service, no third-party tag of any kind. If we later add analytics, we intend to use a cookieless, first-party, aggregate measure — visits, referrers, and page counts, with no cookie, no cross-site identifier, and no profile of you — and we will update this section before we do.

No tracking cookies. No cross-site tracking. We never sell your data.

What the app does store on your device, all of it necessary for the app to work:

None of these is shared with any third party, and none is used to track you anywhere else.

Global Privacy Control (GPC). We honour GPC signals by construction: there is nothing to opt out of, because we neither sell nor share personal information for cross-context behavioural advertising.

6. Data Retention

This table describes how long data actually lives today, not an aspiration. Where the honest answer is "indefinitely, until you ask", it says so.

Why some things survive your departure

Two rules are deliberate, and you should know them before you rate someone or make a trade:

• A rating you gave survives your leaving, with your name removed. Otherwise deleting an account would be a way to erase criticism, and the reputation figure other members rely on would be worth nothing.
• A trade record cannot be deleted by either party. A trade has two sides, and one side should not be able to erase the other's history. The record contains no value and no goods detail.

Where this policy says data is "anonymised", we mean the link to an identified person is removed and cannot be restored by us.

7. Your Rights

How deletion and export work — read this first

We would rather be accurate than impressive:

• Export is self-service. Settings → Privacy → Download my data assembles everything we hold about you that we can read and saves it as one file, in one request. The file states plainly which sections it does not contain and why — your messages are end-to-end encrypted and we cannot read them, your private keys never reached us, ratings written about you are withheld until their reveal time, and no precise location exists to include. You can also put a formal request on record if you want the statutory clock started; you do not need to.
• Deletion is self-service, with a 14-day grace period. Settings → Privacy → Delete my account schedules the deletion and shows you the date it will happen. You can cancel it yourself at any point inside those 14 days. The delay is deliberate: your trades have counterparties, and a deletion made in a bad hour should be recoverable in a better one. After the date passes it runs automatically and cannot be undone.
• Deletion is permanent and it cascades. Deleting your account removes your profile, settings, listings, photos, connections, conversations and messages, notifications, keys, and the ratings you received. It anonymises — rather than deletes — the ratings you gave and any reports you filed. A trade record has two sides and is not erased by one of them.

To make any request below, email us at the address in Section 11. We respond within 30 days. We may ask you to confirm your identity, using the email address on the account, before we act.

EU and UK — GDPR and UK Data Protection Act 2018

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate. Most of it you can edit yourself.
• Erasure — deletion, subject to the two survival rules named in Section 6.
• Portability — your data in a structured, machine-readable form.
• Restriction — ask us to limit processing in certain circumstances.
• Objection — object to processing we base on legitimate interests.
• Withdraw consent — where we rely on consent, at any time, without affecting what came before.
• Complain — to your national supervisory authority (the ICO in the UK, or your Member State's data protection authority).

Canada — PIPEDA and BC PIPA

• Access the personal information we hold about you, and be told how it has been used.
• Correction of inaccurate information.
• Withdraw consent for any non-essential processing.
• Description of recipients (BC PIPA s. 23) — ask us who we have disclosed your information to. Section 4 is that list, kept current.
• Complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.

Quebec — Law 25 (Act respecting the protection of personal information in the private sector)

• Access the personal information we hold, and rectification of what is wrong.
• Withdraw consent for non-essential processing.
• Portability — receive your computerised personal information in a structured, commonly used technological format.
• De-indexation — ask that your personal information be de-indexed, or that a hyperlink to it be ceased, where dissemination contravenes the law or causes serious injury to your reputation or privacy.
• Be informed of automated decision-making — Harvestkin makes no decision about you by automated means alone. The single AI feature (Section 4) classifies the name of a good, never a person, and its output requires human approval.
• Complain to the Commission d'accès à l'information du Québec (CAI).

California — CCPA/CPRA

• Know what personal information we collect, why, and who receives it — Sections 2 and 4.
• Delete personal information we hold, subject to the exceptions named in Section 6.
• Correct inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, and we never have. There is nothing to opt out of.
• Limit use of sensitive personal information — we collect no sensitive personal information as CPRA defines it.
• Non-discrimination — we will not treat you differently for exercising a privacy right.

Brazil — LGPD

• Confirmation and access, correction, anonymisation, blocking, or deletion of unnecessary or excessive data, portability, information about with whom we share data, and revocation of consent.
• Complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Australia — Privacy Act 1988

• Access and correction of your personal information under the Australian Privacy Principles.
• Complain to the Office of the Australian Information Commissioner (OAIC).
• Breach notification — where a data breach is likely to result in serious harm, we will notify affected individuals and, where applicable, the OAIC as soon as practicable, consistent with the Notifiable Data Breaches scheme. We apply this practice regardless of whether a small-business exemption might otherwise apply to us.

Everyone else

If you are somewhere not named above, ask us anyway. We apply the access, correction, and deletion rights above to every member, wherever you are.

8. International Data Transfers

Harvestkin is operated from [British Columbia, CANADA — OWNER CONFIRMS] and its processors (Section 4) are largely US-based, so your information will cross borders.

• From the EU/EEA to Canada. We rely on the European Commission's adequacy decision for Canada under GDPR Article 45, which covers personal data transferred to organisations subject to PIPEDA in the course of commercial activity. Our processing is such activity.
• From the UK to Canada. We rely on the UK's adequacy regulations for Canada on equivalent terms.
• Onward transfer to US-based processors. Personal data reaching the processors in Section 4 is protected by one or more of: EU-US Data Privacy Framework certification (with its UK extension), Standard Contractual Clauses approved by the European Commission, or the equivalent transfer mechanism available under the law of your jurisdiction.
• Within Canada. We apply PIPEDA and BC PIPA standards uniformly, and Law 25 standards to members in Quebec.
• Everywhere else. Where a regime not named above applies, we rely on the lawful transfer mechanisms it provides, including contractual safeguards and, where required, your consent.

9. Children

Harvestkin is not directed to children. You must be at least 16 to hold an account (the terms say the same).

We do not currently verify age at sign-up — we ask for an email address and nothing else, and we would rather say so than imply a check we do not perform. We do not knowingly collect personal information from anyone under 16. If you believe a child has an account, write to us at the address in Section 11 and we will delete it.

10. Security

• Sign-in is passwordless. We hold no password for your account, so there is no Harvestkin password to leak or reuse.
• Message content is encrypted on your device with keys we cannot open (Section 2).
• Access to data is enforced in the database, row by row, rather than only in application code — so a bug in a page cannot hand you someone else's data.
• The app origin runs a strict Content-Security-Policy that names every host the browser is allowed to contact, and forbids everything else.
• Photos are stored privately and served only through short-lived signed links.
• Administrator access is deliberately narrow. Moderators can act on listings, certification claims, and reports. They have no path to message content — not by policy, but because no such permission exists.

No system is perfect. If you find a security issue, please write to us at the address in Section 11 before disclosing it publicly, and we will work with you.

11. Updates and Contact

We will update this policy when what we do changes. The Last Updated date at the top of this document always reflects the current version, and this policy is published from a single source, so the version you read on the site and the version you read in the app are always the same text.

Where a change materially reduces your privacy, we will tell you in the app before it takes effect, and where the law requires consent, we will ask for it.

Contact

[Mailboxes below are placeholders pending owner confirmation.]

• Privacy requests and questions: privacy@harvestkin.com
• Everything else: support@harvestkin.com
• Postal address: [REGISTERED ADDRESS — OWNER CONFIRMS]

If you are in the EU or UK and are not satisfied with our response, you may complain to your supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.