Privacy Policy

1. Introduction

Harken is a feedback collection platform operated by Cone Crows LLC ("we," "us," or "our"). This Privacy Policy explains how we collect, use, and protect information when you use our service.

Harken serves two types of users: Platform Users (our customers who use the Harken console to collect and manage feedback) and End Users (users of our customers' applications who submit feedback through the Harken SDK).

2. Information We Collect

Platform Users (Our Customers)

When you create a Harken account, we collect:

• Email address (for authentication and communication)
• Password (securely hashed, never stored in plain text)
• Organization and application information you provide (tenant name, app names)

End Users (Your Customers)

Harken is designed with privacy in mind. By default, end users are pseudonymous. We collect:

• A randomly generated anonymous identifier (stored locally on the device)
• Feedback content (the message they submit)
• Feedback category (bug, idea, etc.)
• Optional device metadata (app version, platform, device type) if provided by the SDK integration
• Optional file attachments (screenshots, etc.)

We do not collect end user email addresses, names, or other personally identifiable information unless explicitly provided in feedback content by the end user themselves.

3. How We Use Information

We use collected information to:

• Provide and operate the Harken service
• Authenticate platform users
• Send transactional emails (account verification, password resets)
• Improve our service and fix issues
• Respond to support requests

We do not use your data for advertising or sell it to third parties.

4. Data Storage and Security

Your data is stored using Supabase, which provides secure, encrypted database storage with modern access controls. We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, or destruction.

File attachments are stored in secure cloud storage with access controlled by time-limited signed URLs.

5. Data Sharing

We do not sell your personal data.

We may share information with:

• Service providers who assist in operating our platform (e.g., hosting, email delivery)
• Law enforcement or government agencies when required by law

Platform users can access and export feedback data collected through their applications via the Harken console.

6. Data Retention and Deletion

We retain your data for as long as your account is active or as needed to provide services. Specific retention periods by data category:

• Account data (email, profile): retained while your account is active; deleted within 30 days of account deletion
• Feedback data (submissions, attachments): retained until deleted by the platform user or upon account deletion
• Usage logs (API access, authentication events): retained for up to 90 days for security and debugging purposes
• Local storage data (browser preferences, session tokens): expires automatically after 30 days of inactivity

Platform users can delete their account and all associated data through the Harken console. Feedback data is owned by the platform user (our customer) who collected it. Platform users can delete individual feedback items or all data associated with their applications through the console.

For deletion requests or questions, contact us at privacy@conecrows.com.

7. Children's Privacy

Harken is not intended for use by children under 18. We do not knowingly collect information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your personal data
• Portability — request your data in a structured, machine-readable format
• Restriction — request that we limit processing of your data
• Objection — object to processing of your data in certain circumstances
• Withdraw consent — withdraw previously given consent at any time

You can exercise many of these rights directly through the Harken console (e.g., account deletion, data export). For other requests, contact us at privacy@conecrows.com. We will respond to verified requests within 30 days.

9. Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR and PIPEDA. If the breach is likely to result in a high risk to you, we will also notify affected individuals without undue delay.

10. Sub-Processors

We use the following third-party sub-processors to operate the Harken platform:

• Supabase — authentication, database, and file storage
• Lemon Squeezy — subscription billing and payment processing
• Fly.io — backend application hosting
• Vercel — frontend application hosting

Each sub-processor is bound by data processing agreements and processes data only as necessary to provide their services.

11. Cross-Border Data Transfers

Harken is operated from the United States. By using our service, you acknowledge that your data may be transferred to and processed in the United States and other jurisdictions where our sub-processors operate. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Categories of Personal Information Collected

• Identifiers (email address, anonymous device identifiers)
• Internet or network activity (feedback submissions, usage data, device metadata)
• Commercial information (subscription and billing records via Lemon Squeezy)

Do Not Sell or Share My Personal Information

We do not sell or share your personal information for cross-context behavioral advertising purposes. We have not sold or shared personal information in the preceding 12 months.

Your California Rights

• Right to know — request disclosure of the personal information we have collected about you
• Right to delete — request deletion of your personal information
• Right to correct — request correction of inaccurate personal information
• Right to opt out — opt out of the sale or sharing of your personal information (we do not sell or share, so no opt-out is necessary)
• Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights

How to Exercise Your Rights

You can exercise your rights through the Harken console (account deletion, data export) or by contacting us at privacy@conecrows.com. We will verify your identity before processing your request and respond within 45 days.

13. Canadian Privacy Rights (PIPEDA)

If you are a Canadian resident, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to how we handle your personal information.

• Consent — we collect and process your personal information based on your consent, which you provide by creating an account and using our service
• Access and correction — you may request access to your personal information and request corrections to any inaccurate data
• Cross-border transfers — your data may be transferred to and processed in the United States. By using Harken, you acknowledge and consent to this transfer

For privacy inquiries under PIPEDA, contact our privacy officer at privacy@conecrows.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify platform users of material changes by email or through the Harken console. Your continued use of Harken after changes become effective constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Cone Crows LLC
Email: privacy@conecrows.com