Privacy Policy
Version 2026-11-08-v1 · Last updated November 8, 2026 · Effective November 8, 2026
Harborline Inc. uses account information to provide the dashboard, record verified activity, manage support requests and protect access. This page explains what information these services handle and how to contact us about it.
The short version
- Supabase provides authentication and stores account profiles, financial records, preferences and submitted support tickets.
- Supabase handles account authentication. Identity details and required government-issued ID files are submitted within Harborline for manual compliance-staff review. Bank destinations are recorded through a separate manual review process; there is no hosted bank-login widget.
- Crypto verification uses public blockchain records and Tatum. Shared deposit addresses require a separate ownership review.
- Chat, market widgets and remotely loaded fonts and scripts involve outside services. Their processing is separate from Harborline’s account database.
- You can update profile information and email us to request access, correction or deletion. Opening an email draft does not submit a request.
What we collect
Information you provide
- Sign-in and profile: name, email, password submitted to Supabase Authentication, optional phone number, mailing address, uploaded profile picture and account-type preference. An account-type preference does not open a financial account.
- Funding requests: amounts, assets and networks, destination bank or wallet details entered in the relevant flow, public transaction hashes, transfer references and information supplied for manual ownership or settlement review.
- Support: names, topics, references and message text submitted to the support inbox; emails and any attachments you send yourself; and messages you exchange through the configured chat service. The support form does not upload files.
- Identity review: Harborline stores your submitted legal name, country of residence, adult declaration, consent version, submission time, government-issued ID file and review outcome in Supabase. Accepted IDs are passports, driver’s licences and national IDs, uploaded as JPEG, PNG, WebP or PDF files up to 8 MB. Files may contain document numbers, your photograph, date of birth, nationality and other information printed on the ID. Original filenames are not retained. Authorized compliance reviewers record evidence references and customer-visible responses. The flow does not request a separate selfie or provide automated biometric matching, document-authenticity verification or sanctions screening.
Account and technical records
- Account identifiers and opening timestamps; recorded holdings, cash, deposits, withdrawals, sale/conversion requests, settled securities entries and monthly summaries.
- Watchlists, price-alert rules, notification preferences, balance-visibility settings and signup document versions and timestamps.
- Authentication sessions, IP addresses, browser/device information, activity timestamps, authenticator enrollment and verification status. Passkeys remain disabled until the site’s relying-party configuration is enabled; any future registration records are handled through Supabase.
- Manual review identifiers, consent versions, outcomes, and operator review or settlement records. Historical provider records may remain under applicable retention and deletion procedures. Hosting, authentication and API providers also process technical request and error logs.
Information from external sources
We receive public blockchain transaction details and customer identity declarations. Authorized staff record manual review outcomes. Operators may record evidence from received bank payments or externally completed trades and payouts. Harborline records these reviews as platform activity, separately from the external transactions they describe.
How we use information
- Authenticate users, maintain profiles and preferences, and display each customer’s recorded account activity.
- Verify transfers and ownership, reserve requested withdrawals, reconcile manual payouts, and record actual sale proceeds or securities settlements.
- Operate manual identity and destination-review flows, investigate errors and restrict unauthorized access.
- Respond to support and privacy requests, retain relevant review records and address applicable recordkeeping obligations.
Automatic tax-form delivery, guaranteed security-alert emails, automatic SMS alerts and recorded phone calls are not part of the configured application. Email confirmation and password recovery are handled by Supabase Authentication and its configured email delivery. SMS phone verification requires a separately configured provider; storing a phone number does not send a code or verify ownership.
Services that handle information
These descriptions distinguish application records from information a provider receives directly. A provider may collect technical data when its page, script or widget loads, even if you do not submit a message. See its own privacy information for details.
| Service | Purpose and information involved |
|---|---|
| Supabase | Authentication, database and backend functions. Handles account credentials, sessions, profiles, settings, holdings, funding and settlement records, support tickets and verification/linking metadata. Backend credentials are kept server-side. Identity details, private ID files and review/access audit records are stored with restricted access. Files are transmitted over HTTPS to encrypted-at-rest Supabase Storage; this is not end-to-end encryption. Customers can upload only to their own reserved path. Stored ID downloads require an authorized reviewer’s authenticated, MFA-verified session and a short-lived access grant; public links are not provided. Privacy information. |
| Backblaze B2 | Stores private, encrypted disaster-recovery archives of database records and uploaded identity documents. These archives can include account profiles, financial activity, support and review records, and ID files present when a backup is captured. Archives are encrypted before upload, and recovery keys are safeguarded separately from the stored archives. Backblaze also processes storage-object metadata and technical access records. Backup copies have a separate retention and deletion process from active platform records. Recurring automated backups are not currently activated. |
| Tatum and public blockchain networks | Monitoring and verification of supported crypto transfers. Requests involve public wallet addresses, network identifiers and transaction hashes. Harborline separately links a claim to a customer during ownership review. Public blockchain records are not controlled by Harborline. Tatum supplies public transaction data for the review process. Privacy information. |
| Resend | Delivers staff notifications about support tickets and pending identity or payout-destination reviews. Emails contain only a request reference and a link to the authenticated staff page; the application does not include customer names, ID files, bank account numbers, wallet addresses or customer messages in these notifications. Delivery and retry metadata are recorded. Email-provider acceptance does not guarantee inbox delivery. Privacy information. |
| Tawk.to | Configured live-chat service. Its widget may receive browser/request data, visitor details supplied by the application and chat messages. Its conversation storage is separate from the built-in automatic fallback chat. Privacy information. |
| TradingView | Embedded charts, ticker and news widgets receive technical browser information and selected market symbols when loaded. The application does not intentionally send customer balances or transaction history to these widgets. Privacy information. |
| CoinGecko and Twelve Data | Backend market-price requests send asset identifiers and service credentials. These requests do not include customer names, holdings quantities or account balances. Provider technical logs may include the requesting server’s address. CoinGecko privacy · Twelve Data privacy. |
| Netlify, Google Fonts and script/CDN providers | The deployed website is hosted on Netlify. Pages also request remote fonts and application libraries from Google Fonts, jsDelivr and, for some exports, cdnjs. These services receive standard request information such as IP address, browser headers and the requested resource. Netlify privacy · Google privacy. |
| Email services | Messages sent to harborline_us@protonmail.com are handled through Proton Mail and your sending provider. They include the contents and attachments you choose to send. Authentication email delivery uses the sender configured for Supabase. Proton privacy. |
| Authorized operators and required disclosures | Allowlisted reviewers can access the records needed for the review tools they use. We may disclose information in response to a valid legal requirement, limited to the data lawfully requested. |
Harborline administers its software environment and internal records using the technology providers described above. No advertising network or data-sale integration is configured in this version.
Providers may process information in different countries. This application does not guarantee that data remains in your country or that a particular residency arrangement is in place. Contact us about a provider or processing location before supplying sensitive information if you need further details.
Cookies and browser storage
| Storage | Purpose and duration |
|---|---|
Supabase authentication tokens and harborline-auth-persistence: preference | Unchecked “Keep me signed in” uses tab/session storage; checked uses persistent local storage. Sign-out removes the session tokens. Tokens can expire or be revoked; browser session restore can retain session storage. Clearing browser data removes locally saved values. |
harborline-user | Tab/session copy of name, email and signup metadata used during navigation. Removed on explicit Harborline sign-out or when the browser discards the session. |
harborline-chat:v2: | Built-in fallback transcript keyed by project and signed-in user, in tab/session storage. Removed on sign-out or a detected account switch. Pending automatic replies are cancelled. This cleanup does not delete Tawk.to’s own records. |
harborline-masked | Remembers balance visibility in local storage until changed or cleared. Account settings also save the customer’s preference in the database. |
| Design-preview storage | Local preview accounts/settings and practice activity can use browser storage only when preview modes are enabled. Practice financial data is disabled in the current real-account configuration; it is not the source of customer balances. |
Third-party chat and market widgets may use their own cookies or storage. This version does not provide a site-wide cookie preference center. Browser controls can restrict storage or block external resources, which may prevent sign-in, chat or widgets from working.
Account security
- Use the HTTPS deployment for public access. Local HTTP preview is for development.
- Supabase manages authentication. The application uses account-scoped database access and restricted reviewer functions; access and behavior depend on the deployed database policies and backend configuration.
- Authenticator-based two-factor verification is available for enrollment. Its challenges apply when configured; it is not automatically enrolled for every customer. Passkey login remains hidden until enabled for the site domain.
- Backend credentials are restricted to server functions. Private ID files and review-access audit references are not readable by customer accounts. File access grants expire after 60 seconds. Downloaded copies must be handled by authorized staff using approved devices. No system can guarantee absolute security.
Do not send passwords, verification codes, private keys or recovery phrases to support. Submit required ID files only through the secure ID upload field. Do not send identity documents through email or support chat. Do not upload a separate selfie. Report suspected account misuse to harborline_us@protonmail.com.
Retention and deletion
The application retains account, transaction, review, signup-declaration and support records until an authorized retention or deletion process addresses them. There is no configured automatic purge schedule or universal six-year deletion rule. Closing an account requests restrictions and review; it does not instantly erase financial or audit records.
Ask us which records can be deleted and which must remain for an unresolved transfer, security investigation or applicable obligation. Provider records and backups have separate retention processes. A browser-storage cleanup does not erase server records, historical verification records, a Tawk.to conversation or public blockchain history. Unused upload reservations expire after one hour, but expiry does not delete a stored file. ID files and access/review audit records remain until an authorized retention or deletion process addresses them. Retention and deletion are administered by authorized staff, taking account of applicable obligations, unresolved activity and security investigations. Automatic deletion is currently disabled. Backup copies are managed separately from active records; deleting an active record does not immediately remove it from an existing backup. Contact us for the retention information applicable to your records.
Your choices and rights
This opens a draft in your email app. Review it and send it to harborline_us@protonmail.com, preferably from your account email. Opening the draft does not submit a request.
No email app configured? Copy the request
Paste this message into your email service. Send it to harborline_us@protonmail.com with the subject “Harborline personal data access request”.
Do not include passwords, verification codes, recovery phrases, bank account numbers or ID documents. If identity verification is needed, ask for secure instructions.
Depending on where you live, you may have the right to:
- Know what personal information we hold and get a copy of it.
- Correct information that's wrong.
- Ask us to delete information. We may need to keep some records because the law requires it, and we'll tell you if so.
- Limit how we share information with affiliates for marketing, where the law gives you that choice.
- Not be treated differently for using these rights.
To request a copy of your data, send the email described above. The privacy team may need to verify your identity before releasing account information. This page does not submit requests or generate download links.
Children
The service is intended for adults aged 18 and over. The current signup form does not include an automated age check. An account-type preference for a custodial account does not provide a minor-onboarding flow. Contact us if you believe a child has supplied information so it can be reviewed.
Changes to this policy
The date and version above identify this policy. Signup records reference the specific document version shown at signup; an earlier record does not mean a customer acknowledged a later policy. Updated policies are published here. This version does not include an automated policy-change email service.
Contact us
Harborline Inc.
30 Southport Lane, Unit C, Boynton Beach, Florida 33436, USA
Email: harborline_us@protonmail.com
Phone: (720) 263-2492
You can also message us through live chat in the app.