Privacy Policy

Effective date: September 17, 2026 — public preview, revision 5

Public preview. QuantHarbor.ai is available to users age 18 or older who create or sign in to an account and complete the required acknowledgment. Preview features, limits, data sources, and availability may change. Document version: 2026-09-17.public-preview-v5.

Instrument version: 2026-09-17.privacy-v3
Entity: QuantHarbor.ai LLC, a Missouri limited liability company

This policy describes personal information collected and used by the QuantHarbor.ai Service.

Information and sources

Account information includes the identifier, name, and email supplied through Clerk and the user's chosen Google, Microsoft, or Apple identity provider. QuantHarbor.ai LLC does not receive the user's identity-provider password. User content includes watchlists, saved tickers, notes, preferences, feedback, and issue reports. Technical and usage data includes requests, pages, timestamps, errors, session cookies, IP address, approximate country header, user-agent, and device/browser information.

Every legal acceptance creates an append-only evidence event containing the account identifier; email at acceptance when available; exact statements; document versions and SHA-256 hashes; timestamp; IP address and source header; approximate country header; user-agent; idempotency identifier; and evidence checksum. A separate current-version row supports fast access control. Information comes from the user, identity providers and Clerk, the browser, device, network and infrastructure headers, and Service activity. We do not buy consumer profiles from data brokers.

Uses and legal bases

Information is used to authenticate and provide the Service; store user content and preferences; operate requested features; secure, monitor, debug, and prevent abuse; administer tiers; respond to feedback; document contracts and consent; investigate disputes; enforce agreements; and comply with law. Where the GDPR or UK GDPR applies, bases may include contract, legitimate interests in operation and security, consent where required, and legal obligation.

Sharing

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. Service providers include Clerk (authentication), Railway (hosting and managed database), the selected identity provider, AI providers for requested features, and market-data providers queried by ticker. Market-summary prompts are designed not to include account identity or watchlists. Information may also be disclosed to comply with law, enforce agreements, protect users or the Service, or complete a corporate transaction.

Location and transfers

The Service is hosted in the United States. Users outside the United States understand that information may be processed in the United States and other provider locations. Where required, appropriate transfer mechanisms are used.

Retention

Account and content data is kept while needed to provide the Service. Page-view and guest-access diagnostics use a 90-day rolling window. Account deletion removes ordinary user-owned application content, subject to backups and legal requirements. Consent-event evidence is preserved separately for six years from acceptance, or longer during a legal hold or when law requires it, even after account deletion; the event is marked with the deletion time. This supports proof of contract and consent, security, and dispute handling.

Security

Controls include encryption in transit, managed infrastructure, access controls, append-only consent events, and administrative audit access. No system is perfectly secure.

Choices and regional rights

Depending on applicable law, a person may request access, correction, deletion, portability, objection, or restriction. Ordinary account content can be deleted from Account & privacy. Other requests may be sent to [email protected]. Identity may be verified. Limited records may be retained to comply with law, establish or defend claims, prevent fraud, or document a transaction. Consent can be withdrawn for future processing where it is the legal basis, but withdrawal does not invalidate prior processing and may prevent continued use.

The Service is not for anyone under 18. Material policy changes will be notified in the Service and renewed acknowledgment will be required where appropriate.

Contact: [email protected]. Missouri law applies to the contractual aspects of the Service except where mandatory privacy law provides otherwise.