Privacy Policy
Last updated
Draft — not legally effective. This document is under review by the owner and by retained counsel. It describes how Harvestkin works today, but it is not yet in force.
1. Who We Are
Harvestkin is a marketplace where people list what they grow, raise, and make, find someone nearby who wants it, and arrange a trade directly with each other. We do not handle the goods, we do not handle money between members, and we do not record what any trade was worth.
This policy explains what personal information Harvestkin collects, why, who else touches it, how long we keep it, and what you can ask us to do about it. It covers both harvestkin.com (the public site) and app.harvestkin.com (the app you sign in to).
Harvestkin is operated by [LEGAL ENTITY NAME — OWNER CONFIRMS], based in [British Columbia, CANADA — OWNER CONFIRMS]. For privacy purposes we are the controller of the information described here (the business under California law, the organization under PIPEDA, the enterprise under Quebec Law 25).
Privacy is the product, not a policy page. Most of the commitments below are properties of how the software is built rather than promises about how we behave — the section on data minimisation (Section 3) names the ones that are structural.
2. What Data We Collect
Account data
- Your email address. This is the only contact identifier we hold. Sign-in is passwordless: we email you a six-digit code. We never receive or store a password for your Harvestkin account.
- Your handle — your public name on the marketplace. If you do not choose one when you sign up, we generate one from the part of your email address before the
@(sojane.doe@example.combecomesjane_doe). Your handle is visible to anyone, including people who are not signed in. You can change it at any time in your profile, and we suggest you do if you would rather your email name not be public. - Your display name, bio, and avatar link, if you choose to add them. Your display name and avatar link are public; your bio is visible only to you and is not published in the public profile.
- Your settings and consents — language, units, notification preferences, and the timestamps at which you accepted the terms and this policy.
We do not collect, and there is no field in our database for: your legal name, your street address, your phone number, your date of birth, any government identifier, or any payment instrument or bank detail. There is no payment system in Harvestkin at all.
Location data
Harvestkin needs approximate location to match neighbours, and is built so that it never learns a precise one.
- How a location is captured. You place a pin on a map yourself. Harvestkin never asks your browser or device for your location — there is no use of the browser geolocation API anywhere in the app.
- How it is reduced. Every location — both your profile home point and every listing's location — is snapped to a fixed 0.01-degree grid before it is stored. The snap runs in the database on every write, so no precise coordinate is ever persisted, not even briefly.
- What that means in practice. A grid cell is a rectangle roughly 1.1 km north-to-south, and roughly 0.5–0.7 km east-to-west at Canadian latitudes (cells narrow as you move away from the equator). We describe it as a cell rather than a radius because that is what it is.
- What the snap does and does not do. It is deterministic: the same pin always produces the same stored point, and re-submitting a pin never moves it. That means it bounds the precision of what we hold — it does not add random noise, and it is not a defence against someone who already knows roughly where you live.
- What other people see. On a listing, others see the snapped cell, drawn as a box rather than a dot. Your profile's home point is not public — only the coarse region it falls in is.
Listings and the things you publish
A listing holds what you are offering or looking for, a quantity and unit, a title, an optional description and variety, the snapped location, and its status. Active listings are public and are readable by anyone, including people who are not signed in. So are any certification claims you attach, including any proof link you supply — treat a proof link as public.
Photos
Photos you attach to a listing are stored in a private bucket and served through short-lived signed links.
Embedded metadata is removed before a photo is stored. Many cameras and phones write GPS coordinates, a capture timestamp, and a device identifier into the image file itself. Your browser re-encodes each photo before it is uploaded, which produces a new image from the picture data alone — so the file we receive carries none of that metadata, and we never hold a copy that does. Photo rotation is preserved, because it is applied to the picture rather than left in a tag. If your browser cannot process a photo, the upload is refused rather than sent unprocessed.
What this does not do: it cannot remove information that is visible in the picture — a street sign, a house number, a recognisable view. Those are yours to judge before you upload.
Messages
Messages between members are end-to-end encrypted in your browser. The encryption keys are generated on your device and the private keys never leave it in a form we can open.
- What we cannot read: the content of your messages. The server stores ciphertext, and the API that moves it treats it as opaque bytes. No administrator has any access path to message content — there is no such permission in the database for anyone.
- What we can see, and you should assume we can: who is messaging whom, when, how often, and the approximate size of each message. End-to-end encryption protects content, not the fact of a conversation. We do not analyse this metadata, but it exists, and we are telling you so rather than letting "end-to-end encrypted" imply more than it delivers.
- Backups. If you enable a recovery method, we store your private keys in a form sealed by a secret we never receive (a passkey-derived secret or your recovery phrase). We can hold that bundle and hand it back; we cannot open it. If you lose that secret, we cannot recover your messages for you.
- Known limits, stated plainly. This system does not provide forward secrecy or post-compromise security, and message timestamps are set by the server rather than cryptographically proven. It protects your message content from us and from anyone who obtains our database. It is not designed to withstand a targeted state-level adversary.
Connections and trades
When you and another member connect around a listing, we record: the listing, the two members, the status, and the timestamps at which each of you confirmed the trade was completed.
We record nothing about what the trade was worth. There is no price, amount, value, or traded-quantity field on that record anywhere in our database — this is a structural property of the schema, not a setting. Harvestkin runs no payments between members and holds no credits, points, balances, wallets, or platform currency of any kind.
Ratings
After a trade, either side may leave a rating. A rating is a score from 1 to 5 and nothing else — there is no free-text field on a rating. Ratings are double-blind: you cannot see what someone said about you until both sides have rated or a fixed window has passed. Your public reputation is shown only once at least three ratings have been revealed, so that a single rating can never be read off your profile.
Reports
If you report a listing or a member, we record who reported, what was reported, a reason, and your note (up to 500 characters). Reports are readable by our moderators. Report notes are never fed into any automated or AI system.
Market information
Harvestkin publishes advisory ratios between commodity types — an indication of how much of one good tends to be offered against another, in a region, over a period. These are computed only from public listing data, are aggregated with a hard minimum of five contributing samples per figure, and carry no user, listing, connection, or trade identifier at all. They are advisory market information. They are not prices, and nothing in Harvestkin uses them to settle anything.
Technical data
We do not run analytics, advertising, or tracking of any kind today (Section 5). Our hosting and infrastructure providers keep ordinary server logs — IP address, user agent, request path — as any web host does. Our own application code logs error codes, not you: it does not log IP addresses, request bodies, bearer tokens, email addresses, message content, or coordinates.
3. How We Use Your Data
We use personal information only to:
- Run your account — sign you in by emailed code, hold your settings and preferences.
- Operate the marketplace — publish your listings, show you nearby matches, let you connect with other members.
- Deliver messages — move encrypted messages between you and the member you are talking to.
- Send you notifications you asked for — in-app, and by email where you have enabled it.
- Maintain reputation — compute the floored reputation figure shown on your profile.
- Keep the marketplace safe — review reports, moderate listings and certification claims, and act on abuse.
- Produce advisory market information — in aggregate form only, from public listings, with no identifiers attached.
- Meet legal obligations and respond to your privacy requests.
We do not sell personal information. We do not share it with advertisers. We do not track you across other websites. There is no advertising network, data broker, or cross-site tracker in Harvestkin.
Data minimisation as architecture
Several of the limits above are enforced by the software rather than by policy, and would take a deliberate schema change — not a config toggle — to undo:
| Commitment | How it is enforced |
|---|---|
| No precise location is stored | Database triggers snap every location to the 0.01° grid on every write |
| No trade value is recorded | No value, price, or amount column exists on the trade record |
| Market ratios cannot be traced to a person | The ratio table has no user, listing, or trade key, and a minimum-sample rule is enforced by a database constraint |
| We cannot read your messages | The server holds ciphertext; the decryption keys are generated and held on your device |
| Moderators cannot read your messages | No administrative permission on any messaging table exists in the database |
| A single rating cannot be inferred from your profile | Reputation is hidden below three revealed ratings, in the public view definition |
| Reports are never mined | The report note is treated as opaque text and is sent to no automated system |
Lawful bases for processing (EU/UK data subjects)
If you are in the EU or UK, we rely on:
| Purpose | Lawful basis (GDPR Art. 6) |
|---|---|
| Creating and running your account; publishing your listings; delivering your messages | Contract — Art. 6(1)(b): performance of the terms you accepted |
| Sending transactional notifications you have enabled | Contract — Art. 6(1)(b) |
| Moderation, abuse handling, and security | Legitimate interests — Art. 6(1)(f): keeping a marketplace safe for its members |
| Producing aggregate advisory market information from public listings | Legitimate interests — Art. 6(1)(f): providing market information to members, using aggregated, non-identifying data |
| Optional marketing communications, if we ever send them | Consent — Art. 6(1)(a), withdrawable at any time |
| Retaining records to meet legal or accounting obligations | Legal obligation — Art. 6(1)(c) |
We do not process special-category data (GDPR Art. 9) and ask for none.
4. Third-Party Processors
These are every third party that receives data in the course of running Harvestkin. We keep this list short on purpose, and we will update it here when it changes.
| Processor | Role | What it receives | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | Everything described in Section 2, including your email address and your listing photos | US-hosted infrastructure |
| Vercel | Hosting for harvestkin.com and app.harvestkin.com |
Ordinary web request logs (IP address, user agent, path) | Global edge network |
| Railway | Hosting for our API | API request traffic and application logs | US-hosted infrastructure |
| Resend | Transactional email delivery | Your email address, a subject line, and a short message body which may include a listing title | US-based |
| Anthropic | The commodity-name resolver — the single AI feature in Harvestkin | Only the short free-text name of a good you typed (trimmed to 100 characters) together with candidate names from our own catalogue | US-based |
What we send to Anthropic, precisely
Harvestkin makes exactly one call to an AI model, and only when you type a name for a good that our catalogue does not already recognise. It receives a fixed instruction, a list of our own commodity names, and the words you typed — nothing else.
It does not receive: your user id, your email address, your session token, your IP address, your location, your listing, your messages, your ratings, or any other identifier. Its only possible effect is to propose a new name for our catalogue, which a human moderator must approve before it is used.
Third parties your browser contacts directly
- OpenFreeMap (
tiles.openfreemap.org) serves the background map tiles in the app. Because your browser requests those tiles directly, OpenFreeMap can see your IP address and which map areas you are looking at. We do not send it your account or your pin. We are working to serve map tiles ourselves, which will remove this third party entirely.
There are no other third-party origins that either site is permitted to contact — this is enforced by a Content-Security-Policy on the app origin, not merely by convention.
5. Cookies, Storage, and Analytics
Harvestkin sets no cookies. Not one. There is no cookie banner because there is nothing to consent to.
We run no analytics today. No Google Analytics, no advertising pixel, no session recorder, no error-tracking service, no third-party tag of any kind. If we later add analytics, we intend to use a cookieless, first-party, aggregate measure — visits, referrers, and page counts, with no cookie, no cross-site identifier, and no profile of you — and we will update this section before we do.
No tracking cookies. No cross-site tracking. We never sell your data.
What the app does store on your device, all of it necessary for the app to work:
| Store | What is in it | Why |
|---|---|---|
| Local storage | Your sign-in session token | So you stay signed in |
| Indexed database | Your message encryption keys, held so they cannot be exported | So you — and only you — can read your messages |
| Cache storage | The app's own files | So the app works offline |
None of these is shared with any third party, and none is used to track you anywhere else.
Global Privacy Control (GPC). We honour GPC signals by construction: there is nothing to opt out of, because we neither sell nor share personal information for cross-context behavioural advertising.
6. Data Retention
This table describes how long data actually lives today, not an aspiration. Where the honest answer is "indefinitely, until you ask", it says so.
| Data | Retention today | How it ends |
|---|---|---|
| Email address and account | Kept while your account exists | Deleted on account deletion (Section 7) |
| Profile, handle, settings, consents | Kept while your account exists | Deleted with the account |
| Listings, including expired and withdrawn ones | Kept indefinitely. Expiry hides a listing from the board; it does not delete it | Deleted when you delete the listing, or with the account |
| Listing photos | Kept while the listing exists | Deleted with the listing. Note: the stored image files are not yet automatically removed when their listing is deleted — this is a known gap we are fixing, and the files are not publicly reachable |
| Connections and trade records | Kept indefinitely, and cannot be deleted by either party. They hold no value and no goods detail — only that two members connected and confirmed | Deleted only when one party's account is deleted |
| Messages (ciphertext) and their key wraps | Kept indefinitely. There is no automatic expiry, and messages are immutable — neither you nor we can edit or selectively delete one | Deleted when the connection they belong to is deleted, or with the account |
| Encryption keys: public key log | Kept indefinitely and append-only — it is the record that lets others verify your keys were not swapped | Deleted with the account |
| Encryption keys: sealed backup bundle | Kept while your account exists | Deleted with the account |
| Notifications | Kept indefinitely — there is no cleanup job today | Deleted with the account |
| Ratings you received | Kept while your account exists | Deleted with your account |
| Ratings you gave | Kept after your account is deleted, with your identity removed | The score survives; the link to you does not |
| Reports and their notes | Kept indefinitely, and cannot be deleted by anyone including moderators | Your identity as reporter is removed if your account is deleted |
| Advisory market ratios | One period at a time. The whole table is replaced each day from a rolling 90-day window of public listings | Automatic — nothing accumulates, and no figure is traceable to a person |
| Sign-in codes | Short-lived, single-purpose | Expire automatically |
| Infrastructure logs (Vercel, Railway, Supabase) | Per each provider's own retention | Outside our direct control; we set no application-level log of you |
Why some things survive your departure
Two rules are deliberate, and you should know them before you rate someone or make a trade:
- A rating you gave survives your leaving, with your name removed. Otherwise deleting an account would be a way to erase criticism, and the reputation figure other members rely on would be worth nothing.
- A trade record cannot be deleted by either party. A trade has two sides, and one side should not be able to erase the other's history. The record contains no value and no goods detail.
Where this policy says data is "anonymised", we mean the link to an identified person is removed and cannot be restored by us.
7. Your Rights
How deletion and export work — read this first
We would rather be accurate than impressive:
- Export is self-service. Settings → Privacy → Download my data assembles everything we hold about you that we can read and saves it as one file, in one request. The file states plainly which sections it does not contain and why — your messages are end-to-end encrypted and we cannot read them, your private keys never reached us, ratings written about you are withheld until their reveal time, and no precise location exists to include. You can also put a formal request on record if you want the statutory clock started; you do not need to.
- Deletion is self-service, with a 14-day grace period. Settings → Privacy → Delete my account schedules the deletion and shows you the date it will happen. You can cancel it yourself at any point inside those 14 days. The delay is deliberate: your trades have counterparties, and a deletion made in a bad hour should be recoverable in a better one. After the date passes it runs automatically and cannot be undone.
- Deletion is permanent and it cascades. Deleting your account removes your profile, settings, listings, photos, connections, conversations and messages, notifications, keys, and the ratings you received. It anonymises — rather than deletes — the ratings you gave and any reports you filed. A trade record has two sides and is not erased by one of them.
To make any request below, email us at the address in Section 11. We respond within 30 days. We may ask you to confirm your identity, using the email address on the account, before we act.
EU and UK — GDPR and UK Data Protection Act 2018
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate. Most of it you can edit yourself.
- Erasure — deletion, subject to the two survival rules named in Section 6.
- Portability — your data in a structured, machine-readable form.
- Restriction — ask us to limit processing in certain circumstances.
- Objection — object to processing we base on legitimate interests.
- Withdraw consent — where we rely on consent, at any time, without affecting what came before.
- Complain — to your national supervisory authority (the ICO in the UK, or your Member State's data protection authority).
Canada — PIPEDA and BC PIPA
- Access the personal information we hold about you, and be told how it has been used.
- Correction of inaccurate information.
- Withdraw consent for any non-essential processing.
- Description of recipients (BC PIPA s. 23) — ask us who we have disclosed your information to. Section 4 is that list, kept current.
- Complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.
Quebec — Law 25 (Act respecting the protection of personal information in the private sector)
- Access the personal information we hold, and rectification of what is wrong.
- Withdraw consent for non-essential processing.
- Portability — receive your computerised personal information in a structured, commonly used technological format.
- De-indexation — ask that your personal information be de-indexed, or that a hyperlink to it be ceased, where dissemination contravenes the law or causes serious injury to your reputation or privacy.
- Be informed of automated decision-making — Harvestkin makes no decision about you by automated means alone. The single AI feature (Section 4) classifies the name of a good, never a person, and its output requires human approval.
- Complain to the Commission d'accès à l'information du Québec (CAI).
California — CCPA/CPRA
- Know what personal information we collect, why, and who receives it — Sections 2 and 4.
- Delete personal information we hold, subject to the exceptions named in Section 6.
- Correct inaccurate personal information.
- Opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising, and we never have. There is nothing to opt out of.
- Limit use of sensitive personal information — we collect no sensitive personal information as CPRA defines it.
- Non-discrimination — we will not treat you differently for exercising a privacy right.
Brazil — LGPD
- Confirmation and access, correction, anonymisation, blocking, or deletion of unnecessary or excessive data, portability, information about with whom we share data, and revocation of consent.
- Complain to the Autoridade Nacional de Proteção de Dados (ANPD).
Australia — Privacy Act 1988
- Access and correction of your personal information under the Australian Privacy Principles.
- Complain to the Office of the Australian Information Commissioner (OAIC).
- Breach notification — where a data breach is likely to result in serious harm, we will notify affected individuals and, where applicable, the OAIC as soon as practicable, consistent with the Notifiable Data Breaches scheme. We apply this practice regardless of whether a small-business exemption might otherwise apply to us.
Everyone else
If you are somewhere not named above, ask us anyway. We apply the access, correction, and deletion rights above to every member, wherever you are.
8. International Data Transfers
Harvestkin is operated from [British Columbia, CANADA — OWNER CONFIRMS] and its processors (Section 4) are largely US-based, so your information will cross borders.
- From the EU/EEA to Canada. We rely on the European Commission's adequacy decision for Canada under GDPR Article 45, which covers personal data transferred to organisations subject to PIPEDA in the course of commercial activity. Our processing is such activity.
- From the UK to Canada. We rely on the UK's adequacy regulations for Canada on equivalent terms.
- Onward transfer to US-based processors. Personal data reaching the processors in Section 4 is protected by one or more of: EU-US Data Privacy Framework certification (with its UK extension), Standard Contractual Clauses approved by the European Commission, or the equivalent transfer mechanism available under the law of your jurisdiction.
- Within Canada. We apply PIPEDA and BC PIPA standards uniformly, and Law 25 standards to members in Quebec.
- Everywhere else. Where a regime not named above applies, we rely on the lawful transfer mechanisms it provides, including contractual safeguards and, where required, your consent.
9. Children
Harvestkin is not directed to children. You must be at least 16 to hold an account (the terms say the same).
We do not currently verify age at sign-up — we ask for an email address and nothing else, and we would rather say so than imply a check we do not perform. We do not knowingly collect personal information from anyone under 16. If you believe a child has an account, write to us at the address in Section 11 and we will delete it.
10. Security
- Sign-in is passwordless. We hold no password for your account, so there is no Harvestkin password to leak or reuse.
- Message content is encrypted on your device with keys we cannot open (Section 2).
- Access to data is enforced in the database, row by row, rather than only in application code — so a bug in a page cannot hand you someone else's data.
- The app origin runs a strict Content-Security-Policy that names every host the browser is allowed to contact, and forbids everything else.
- Photos are stored privately and served only through short-lived signed links.
- Administrator access is deliberately narrow. Moderators can act on listings, certification claims, and reports. They have no path to message content — not by policy, but because no such permission exists.
No system is perfect. If you find a security issue, please write to us at the address in Section 11 before disclosing it publicly, and we will work with you.
11. Updates and Contact
We will update this policy when what we do changes. The Last Updated date at the top of this document always reflects the current version, and this policy is published from a single source, so the version you read on the site and the version you read in the app are always the same text.
Where a change materially reduces your privacy, we will tell you in the app before it takes effect, and where the law requires consent, we will ask for it.
Contact
[Mailboxes below are placeholders pending owner confirmation.]
- Privacy requests and questions: privacy@harvestkin.com
- Everything else: support@harvestkin.com
- Postal address: [REGISTERED ADDRESS — OWNER CONFIRMS]
If you are in the EU or UK and are not satisfied with our response, you may complain to your supervisory authority. In Canada, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.