Privacy Policy
Effective 2026-08-23 · Draft — review with counsel before public launch.
The short version
Local agents run on your computer. Their messages, books, memory and your Robinhood connection stay on your machine unless you sign in and turn on cloud sync. We never see your Claude credentials. We never hold a Robinhood password.
What we collect when you sign in
- Account: your email address (sign-in is a one-time code; there is no password).
- Agents you sync or run in the cloud: agent configuration, thread messages, paper/live ledger entries, run logs and decision logs — so the mobile app can show them and cloud agents can run.
- Robinhood cloud grant (cloud agents only): an OAuth token sealed to our worker's public key on your device. Only the cloud worker can open it. It is used solely to run the agents you created.
- Portfolio snapshots: equity, positions and buying power, published so your phone can display them. The phone never holds a Robinhood token.
- Subscription (if any): plan and entitlement; payment details are handled by the payment processor, not us.
What we do not do
- We do not sell data. We do not run ads inside the app.
- We do not upload your Claude.ai login or tokens — ever.
- Cloud agents think on a platform-issued model key metered to your plan; prompts include only what your agent needs (its plan, book, recent thread).
We send sign-in codes and account/agent notifications from auth.harborbots.com. Product updates, if any, are a separate list you opt into and can leave with one click.
Retention & deletion
Delete an agent and its data goes with it. Delete your account from the app and everything tied to it is removed. Cloud logs age out on a rolling basis.
This website
harborbots.com counts page views with Vercel Web Analytics. It is cookieless, sets nothing on your device, does not follow you to other sites, and does not build a profile of you — it records the page, referrer, country and device type of a visit, nothing that identifies you. The app itself has no analytics or telemetry in it.
Where data lives
United States (Oregon): Supabase for account and agent data, Google Cloud for cloud agent execution, SendGrid for email delivery. Website analytics are processed by Vercel.