Privacy Policy

1. What Information We Collect

When you create a TokHarvest account or use the Service, we may collect the following:

• • Email address — used for account login and account-related communications
• • Name (optional) — if you provide it during registration
• • Device identifier — a hashed, anonymised ID used to manage desktop app sessions (no hardware serial is stored)
• • Subscription status — your current plan, billing cycle, and subscription expiry date
• • Daily usage count — a running counter used to enforce plan limits (the count only, not URLs)
• • IP address — logged briefly for security purposes and rate limiting

2. What We Do NOT Collect

We want to be explicit about what we do not collect or store:

• ✗ We do not store any media files you import. Files go directly from the source to your device.
• ✗ We do not log or store the content URLs or content IDs you manage
• ✗ We do not access your accounts on any third-party platform
• ✗ We do not store any platform usernames, passwords, or session cookies
• ✗ We do not collect browsing history, search history, or content interaction data
• ✗ We do not sell, rent, or trade your personal data to any third party
• ✗ We do not use your data for advertising profiling or retargeting

3. How We Use Your Information

The information we collect is used solely to:

• • Provide, operate, and maintain the TokHarvest Service
• • Authenticate your account and manage desktop app device sessions
• • Enforce plan usage limits and quota tracking
• • Send transactional emails (password reset, subscription receipts)
• • Respond to support requests
• • Prevent abuse, fraud, and violations of our Terms of Service

We do not use your data for any purpose not listed above.

4. How We Store and Protect Data

Your account data is stored on secure, encrypted servers. We use industry-standard security practices including TLS/HTTPS for all data in transit and bcrypt hashing for passwords.

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

The desktop app stores a session token locally on your machine at ~/.tokharvest/session.json. This token does not contain your password. You can revoke it at any time from My Devices or by logging out of the desktop app.

5. Payments — Processed by Paddle

TokHarvest uses Paddle as our payment processor. Paddle is a Merchant of Record, which means they process all payments, handle VAT/tax compliance, and manage subscription billing on our behalf.

Paddle does share with us: your subscription status, billing cycle, subscription ID, and a Paddle customer ID (not your payment method details). We use this to activate your plan on TokHarvest.

6. Cookies and Tracking

TokHarvest uses a minimal set of cookies:

• • Session cookie — keeps you logged in to the web dashboard (cleared on logout)
• • CSRF token — a security token that protects web forms

We do not use advertising cookies, third-party tracking pixels, Google Analytics, Facebook Pixel, or any behavioral tracking tools.

Paddle may set cookies during the checkout process. These are controlled by Paddle and are necessary to complete your payment.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• ✓ Access — request a copy of the data we hold about you
• ✓ Rectification — request correction of inaccurate data
• ✓ Deletion — request deletion of your account and associated data
• ✓ Portability — request an export of your data in a machine-readable format
• ✓ Objection — object to processing of your data in certain circumstances

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Contact

If you have any questions about this Privacy Policy or your personal data, please contact us:

Email: [email protected]

We aim to respond to all privacy inquiries within 5 business days.