# Privacy Policy

How Harvest collects and uses personal data on the Harvest website, documentation and app.

*Last updated: November 1, 2026*

## Summary

Harvest provides a website with documentation and public yield data, and an app that lets you use Harvest vaults with your own self-custodial wallet. We do not require an account, we never take custody of your assets, and we do not ask for your name, postal address or payment details.

We do collect a limited amount of personal data:

- **visit statistics** on the website, recorded for every visit in our own database, to count traffic;
- **usage data** from analytics tools (Google Analytics and Amplitude), only after you accept analytics cookies, to understand how the website and app are used;
- **technical data** such as IP addresses, which our hosting and security providers process to deliver the site and protect it from abuse;
- **wallet data** in the app: your public wallet address and on-chain activity, which the app reads from the blockchain to show your positions;
- **the content of messages** you send us.

We do not sell personal data and we do not use advertising or cross-site tracking cookies.

## Who is responsible for your data

The Farmer Chad Foundation, a foundation established in the Republic of Panama and the operator of Harvest ("Harvest", "we", "us"), is responsible for the processing described in this policy. You can contact us about privacy at support@harvest.finance.

This policy covers the Harvest website (harvest.finance, including harvest.finance/docs) and the Harvest app (app.harvest.finance). The Harvest Discord server has its own policy: [Privacy Policy – Discord Server](https://harvest.finance/docs/legal/privacy-policy-discord-server).

## What we collect

### Usage data (analytics)

We use Google Analytics 4 on the website and documentation, and Amplitude and Google Analytics in the app. These tools load only after you accept analytics cookies in the cookie banner. Once you accept, they collect:

- pages and screens you view and how long you spend on them;
- the referring page (where you came from);
- approximate location (country or city), derived from your IP address by the analytics provider;
- device, browser and operating system details, such as browser version and screen size;
- interactions such as clicks on links and buttons;
- an identifier stored in a cookie, so repeat visits can be counted as the same anonymous visitor.

### Visit statistics (all visitors)

Whatever you choose in the cookie banner, we record basic information about each visit to the website in our own database to count traffic: the page, where you came from, your browser and device type, and your approximate location (country, region or city), which is looked up from your IP address by ipapi.co. A random visit identifier is stored in your browser so that pages viewed in one visit are counted together. We do not use advertising cookies for this and we do not link this data to your identity.

### Technical data

Like any website, our hosting and content delivery providers receive your IP address, the address of the page you request, the time of the request and your browser's user agent. They use this to deliver the site, keep it available and protect it against attacks. This happens whether or not you consent to analytics.

As set out in our [Terms and Conditions](https://harvest.finance/docs/legal/terms-and-conditions), we may also check IP addresses and wallet addresses that interact with the website or app against restricted jurisdictions and sanctions lists, and block access where required.

### Wallet and on-chain data (app)

When you connect a wallet to the Harvest app, the app reads your public wallet address and related public blockchain data (balances, deposits, withdrawals and rewards) to show your positions and earnings. This information is public on the blockchain. Harvest does not store it in a database linked to your identity, and does not link your wallet address to you unless you tell us, for example in an email.

Your wallet application (for example MetaMask or WalletConnect) may collect data for its own purposes. Wallet applications are not controlled by Harvest and are outside the scope of this policy; please read their privacy policies.

### Communications

If you email us, we receive your email address and the content of your message.

## Why we use it and on what legal basis

| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Counting visits to the website | Visit statistics | Our legitimate interest in measuring traffic to our website (Art. 6(1)(f)) |
| Understanding how the website and app are used, to improve them | Usage data | Your consent (Art. 6(1)(a)) |
| Delivering the website and app and keeping them secure | Technical data | Our legitimate interest in running a secure service (Art. 6(1)(f)) |
| Showing your positions and earnings in the app | Wallet and on-chain data | Providing the service you request (Art. 6(1)(b)) |
| Answering your messages | Communications | Our legitimate interest in responding to you (Art. 6(1)(f)) |
| Blocking access from restricted jurisdictions and sanctioned addresses | IP addresses, wallet addresses | Legal obligation and our legitimate interest in complying with sanctions laws (Art. 6(1)(c) and (f)) |
| Meeting legal obligations | Any of the above, where required | Legal obligation (Art. 6(1)(c)) |

## Cookies and similar technologies

| Category | What it does | Consent needed |
|---|---|---|
| Strictly necessary | Keeps the site working and remembers your cookie choice | No |
| Analytics: Google Analytics 4 (website, documentation and app) | Counts visits and measures how pages are used; sets cookies such as `_ga` and `_ga_*` | Yes |
| Analytics: Amplitude (app) | Measures how app screens and features are used; stores an anonymous device identifier in a cookie or local storage | Yes |

Analytics tools are not loaded before you make a choice. Until you accept, Google Analytics is not loaded and sets no cookies, and Amplitude is not started. Visit statistics are recorded regardless of your choice, as described above.

We do not use advertising cookies, retargeting pixels or cross-site tracking identifiers.

## Your choices and consent

On your first visit to the website, the documentation or the app, you see a cookie banner. Google Analytics and Amplitude start, set their cookies and send data only after you click accept. If you reject, Google Analytics and Amplitude are not used. You can change or withdraw your consent at any time through the "Cookie settings" link in the footer, or by deleting cookies for this site in your browser. Withdrawing consent does not affect processing that took place before.

## Who we share data with

We share personal data only with service providers that process it on our behalf and under our instructions:

- **analytics providers** (Google Analytics, provided by Google; Amplitude, provided by Amplitude, Inc.);
- **Supabase**, which hosts our visit statistics database, and **ipapi.co**, which looks up approximate location from IP addresses;
- **hosting, content delivery and security providers** (Vercel for the website and documentation; Cloudflare and Heroku for the app);
- **our email provider** (Proton Mail), for messages sent to support@harvest.finance.

We do not sell personal data, and we do not share it with advertising networks or with other companies for their marketing. We may disclose data if the law requires it.

## International transfers

Some of our providers process data outside the European Economic Area, including in the United States (Google, Amplitude, Vercel, Cloudflare, Heroku, Supabase, ipapi.co) and Switzerland (Proton Mail, covered by an EU adequacy decision). Where they do, the transfer is protected by the European Commission's standard contractual clauses or by the provider's certification under the EU–US Data Privacy Framework.

## How long we keep data

- **Analytics data and visit statistics:** up to 14 months, after which they are deleted.
- **Screening data** (IP addresses and wallet addresses checked against restricted jurisdictions and sanctions lists): only for the time needed to perform the check, unless the law requires us to keep it longer.
- **Technical data in server and security logs:** for the short period set by our hosting and security providers.
- **Emails:** as long as needed to handle your request and any follow-up, then deleted unless the law requires us to keep them.
- **Wallet and on-chain data:** not stored by Harvest; the app reads it from the blockchain each time.

## Security

We use HTTPS throughout, limit access to analytics and email accounts, and rely on providers with established security programmes. No method of transmission or storage is completely secure, but we work to protect the data we hold.

## Your rights

Depending on where you live, you can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw consent to analytics at any time. You also have the right to complain to your local data protection authority.

Because we do not ask you to identify yourself, we usually cannot link analytics data to you. If you have emailed us and want that correspondence deleted, write to support@harvest.finance from the same address.

## Minors

The Harvest website and app are not intended for anyone under 18, and we do not knowingly collect personal data from minors.

## Links to other sites and services

The website and app link to third-party sites, protocols and services. Their privacy practices are their own; please read their policies.

## Changes to this policy

We may update this policy when the website, app or law changes. The date at the top shows the latest version. If a change affects what we collect or why, we will also announce it through the cookie banner.

## Contact

Questions about this policy or your data: support@harvest.finance.