Privacy Policy

Last updated: October 19, 2026

This Privacy Policy explains how Harpo Labs LLC ("Harpo," "we," "us," or "our") collects, uses, and protects information in connection with the Harpo web application (the "Service").

1. Information We Collect

Account information. When you sign up, we collect your name and email address through our authentication provider, Supabase (or through Google, if you choose "Continue with Google").

Payment information. When you subscribe, our payment processor, Stripe, collects your billing details directly. Harpo does not receive or store your full card number — we only receive limited information from Stripe needed to manage your subscription (such as your subscription status and renewal date).

Session and content configuration data. As you use Harpo, we store the therapy session configurations, flashcard sets, target selections, and similar materials you create, so you can access them later. Session labels should be a client's initials only. Please do not enter names or other identifying information about your clients/students, or protected health information or student records, into Harpo.

Usage data. We collect basic technical information needed to run the Service, such as authentication session identifiers (cookies) that keep you logged in. We also use PostHog, a product analytics service, to understand how Harpo is used, for example which pages are visited, which activities are opened and completed, and where people get stuck. PostHog stores an anonymous identifier in a cookie and in your browser's local storage, and records basic device and browser details and approximate location. When you're signed in, this activity is linked to an internal account ID, not your name or email. We do not use session recordings, and we do not send your clients' information, session labels, word lists, or anything you type into Harpo to PostHog. Page addresses are shortened to the page path before they're sent.

2. How We Use Information

We use the information above to: provide and maintain the Service; process your subscription and billing; authenticate your account; communicate with you about your account, billing, or support requests; and improve the Service.

We do not sell your personal information.

3. Third-Party Service Providers

We work with the following providers to operate Harpo, each of which processes data on our behalf:

Supabase — authentication and database hosting
Stripe — payment processing and subscription billing
Vercel — application hosting
PostHog — product analytics (how the Service is used); data is processed in the United States
Anthropic — AI story writing. When you generate a story, we send the sound target, the theme, and the practice words to Anthropic to write it
Google — optional "Continue with Google" sign-in (we receive your name and email), and the web fonts our pages load

These providers only receive the information necessary to perform their function and are bound by their own privacy and security commitments.

4. Data Retention

We keep your account and session data while your account is active. If you cancel, we hold on to it so everything's still here if you decide to come back. If you'd rather it be gone, just ask (see Section 11) and we'll delete or anonymize it within a reasonable period. We may keep certain records, like billing records, where the law requires us to.

5. Data Security

We rely on industry-standard security practices provided by our infrastructure partners (Supabase, Stripe, Vercel), including encryption in transit. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your information.

6. Your Rights and Choices

You can review and update your name at any time from your account settings. To request a copy of your data, request deletion of your account, or ask any other privacy-related question, contact us at support@useharpo.com. We will respond to verified requests within a reasonable timeframe.

7. California Privacy Rights

As a California LLC, we're committed to honoring the spirit of California privacy law for all our users, regardless of whether the California Consumer Privacy Act's specific thresholds apply to a business our size. If you are a California resident, you may contact us to request access to, correction of, or deletion of your personal information, or to ask what categories of information we hold about you.

8. Children's Privacy

Harpo is a professional tool intended for use by adult clinicians and educators, not by children. We do not knowingly collect personal information directly from children through the Service.

9. Data Location

Our infrastructure providers host data in the United States. By using the Service, you consent to the transfer and processing of information in the United States.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date. Material changes will be communicated to active subscribers where reasonably practicable.

11. Contact

Questions about this policy or your data? Contact us at support@useharpo.com.