Privacy Policy

Effective April 25, 2026 · Last updated April 25, 2026

1. Who we are

HarvestEngine ("we", "us", "our") is a software service that automates tax-loss harvesting and direct indexing on a user's own brokerage account. We are not a registered investment advisor (RIA), broker-dealer, or custodian. You connect your existing brokerage account; we run analytics and present trade proposals; you approve them; the broker executes them. Your money never leaves your broker.

This policy explains what data we collect, how we use it, who we share it with, and what rights you have.

2. What we collect

We collect three categories of data:

From you, when you sign up:

Email address (required for account identification + communications)
Name and profile picture (optional; from your SSO provider)
Phone number (optional; required if you enable SMS authentication or notifications)
State of residence and tax filing status (used to compute your effective tax rates for harvest sizing)

From your brokerage, after you connect it via OAuth:

Account list and identifiers (account numbers, account types)
Positions and tax lots (symbols, quantities, cost basis, acquisition dates)
Realized gains and losses for the current and prior tax years
Cash balances
Order history, status, and fill prices for trades placed through HarvestEngine

We do not ask for nor receive your brokerage password. OAuth tokens — encrypted at rest — are how we access this data, and you can revoke them at any time from your broker's website.

Automatically, when you use the service:

IP address, browser user-agent, device type
Pages viewed, actions taken (proposal approvals, settings changes)
Sign-in events (timestamp, location, IP)

3. How we use it

We use your data only to:

Run the tax-loss harvesting and rebalancing algorithms on your portfolio
Generate trade proposals for your approval
Authenticate you and protect your account from unauthorized access
Send transactional notifications (sign-in codes, trade-approval links, account alerts)
Improve the service through aggregate analytics (we do not sell or share individual user data with marketers — see §4)
Comply with legal obligations (tax reporting, subpoenas, etc.)

We do not use your portfolio data, trade history, or balances for advertising. We do not show ads to logged-in users. We do not train AI models on your individual data without your explicit opt-in.

We share data only with vendors who help us run the service. Each is bound by a data processing agreement and handles data only as instructed:

Google Cloud Platform — hosting, database, key management
Twilio — SMS delivery for authentication codes and notifications
Anthropic and/or OpenAI — AI inference for the chat assistant and portfolio designer; we send relevant context (positions, proposed trades) but not your name, email, or phone number
Massive (formerly Polygon) — market data feed
Finnhub — earnings calendar data
Your brokerage (E*TRADE, Schwab, Fidelity, IBKR, or others as we add them) — we read positions and place orders on your behalf via OAuth
Stripe — payment processing (when paid tiers launch)

We do not sell, rent, or trade your personal information to anyone for marketing purposes.

5. Mobile messaging

If you provide a phone number and consent to SMS, we send you transactional messages: authentication codes, trade-approval links, post-execution summaries, and account-security alerts.

You opt in by entering your phone number during sign-up and confirming with a verification code.
Reply STOP at any time to opt out. Reply HELP for support.
Message and data rates from your carrier may apply.
We never share your phone number with third parties for their marketing purposes.
SMS data — including phone numbers, opt-in status, and consent records — is not shared with third parties or affiliates for marketing.

6. Data retention

Account data (email, profile, settings): retained while your account is active, plus 30 days after deletion request.
Brokerage data (positions, trades, lots): retained for 7 years to support tax reporting and audit requirements (IRS recommended retention).
Authentication logs (sign-ins, IP addresses): 90 days.
SMS records (delivery logs, opt-in/opt-out): 18 months.
Backups: 30 days; deleted on schedule.

7. Security

All connections use TLS 1.2 or higher.
Brokerage OAuth tokens are encrypted at rest using envelope encryption (KMS-managed master key wraps a per-user data encryption key).
Passwords (when applicable) use scrypt with high cost factors.
SMS-based MFA can be enabled on any account.
You can review and revoke trusted devices from your account settings.
We monitor for suspicious activity and notify you of unusual sign-ins.

No system is perfectly secure. Use a unique, strong password, enable MFA, and notify us immediately at the contact email below if you suspect your account has been compromised.

8. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you
Correct inaccurate information
Delete your account and associated personal data (subject to retention requirements above)
Export your data in a machine-readable format
Object to or restrict processing
Opt out of the sale or sharing of your personal information (we do not sell or share for behavioral advertising, but you may make this request as a matter of right)

To exercise any of these rights, email us at the contact below from the email address on file. We respond within 30 days.

California residents have additional rights under the CCPA/CPRA. EU residents have additional rights under GDPR. We honor all such requests through the same contact channel.

9. Children

HarvestEngine is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected such information, contact us and we will delete it.

10. Updates to this policy

We may update this policy as the service evolves. Material changes will be announced via in-app notice and email at least 30 days before they take effect. The "Last updated" date at the top reflects the most recent change.

11. Contact

Email: privacy@harvestengine.ai

For data-rights requests, please send your request from the email address associated with your account so we can verify your identity.