Privacy Policy

1. Who We Are

Harbor Privacy operates twelve products: a DNS-based network protection service (Harbor Privacy DNS), a scheduling platform (Harbor Booking), a personal budgeting tool that reads forwarded transaction emails (Harbor Money), a private invite-only social app for a single family (Harbor Family), a secure anonymous fax service (Harbor Privacy Fax), an AI-powered career document tool (Career by Harbor Privacy), a multi-tenant neighbor portal for shared networks (Harbor Neighbor), a data broker opt-out service that finds and removes your personal info from people-search sites (Harbor Scan), a daily email data-breach checker (Harbor Breach Monitor), a zero-knowledge self-destructing note tool (Harbor Burn), a link shortener with an optional zero-knowledge encrypted mode (Harbor Snip, at snip.harborprivacy.com and hrbor.us), and a free browser extension that blocks trackers and ads locally (Harbor Shield). All products are operated under the Harbor Privacy brand from Pembroke, MA.

Questions: privacy@harborprivacy.com or open a ticket at help.harborprivacy.com.

2. What We Collect and Why

Harbor Privacy DNS

DNS queries are processed in memory only and never written to disk or retained. We collect:

• Your email address (to create and manage your account)
• Payment information (processed entirely by Stripe -- we never see or store your card details)
• Your assigned AdGuard client ID (to provision your DNS endpoint)

Harbor Privacy Fax

• Your document is uploaded, converted, and transmitted to the destination fax number via Telnyx
• The file is permanently deleted the moment Telnyx confirms delivery via webhook
• We do not store the fax number dialed, document contents, or cover page message after transmission
• No account is required to send a fax
• Payment is processed by Stripe. We do not store card details.
• The only record retained is a Stripe transaction ID, amount, and timestamp for billing reconciliation

Career by Harbor Privacy

• Resume and job description text is submitted to Anthropic's Claude API to generate your document
• Submitted content is not retained after your document is delivered
• We do not use your resume content to train AI models
• Payment is processed by Stripe via access codes

Harbor Booking

• Scheduling data (client names, email addresses, phone numbers, appointment times) is stored to operate the service
• Scheduling notes are for coordination only — do not enter medical or clinical information
• We do not sell, share, or use scheduling data for advertising or analytics
• Appointment data is deleted within 30 days of account closure
• A single session cookie is used for login — no advertising or tracking cookies
• Confirmation and reminder emails are sent via Resend. Email addresses are not shared beyond delivery
• Payment is processed by Stripe. We do not store card details
• Harbor Booking is a scheduling tool only and is not a HIPAA-covered service. Do not use it to store protected health information without a signed Business Associate Agreement

Harbor Money

We never connect to your bank. Harbor Money does not request, store, or transmit any banking credentials. Instead you forward bank-issued transaction emails to a private address we generate for you.

• Your email address (account login + outbound notifications)
• Your unique inbound address (e.g. tx-XXXX@money.harborprivacy.com) — rotate it any time from Settings
• Forwarded transaction emails: from address, subject, plaintext body (truncated to 64KB) — kept for audit and re-parse only
• Parsed transaction fields: date, amount, merchant, last-four digits of the card if the email mentions it
• Account labels you create (e.g. "Chase Sapphire ····4582")
• Optional uploaded CSV statements — used to reconcile and find missing transactions
• Categories, goals, and recurring-bill expectations you configure

What we explicitly do not store:

• Bank usernames, passwords, account numbers (only last-four when present in an email)
• Account balances pulled from your bank (we don't have your bank)
• Anything from emails you do not forward to your Harbor Money address

If we send your transaction text to an AI model as a fallback parser (when our built-in parsers fail), we send only the subject + plaintext body — no other account data — and the model provider's policy applies to that one request. AI parsing is opt-out in Settings.

Harbor Neighbor

Harbor Neighbor is a multi-tenant portal for shared physical networks. Each neighbor gets their own VLAN, SSID, and (where supported) WireGuard VPN peer. We collect only what is needed to provision and manage your slice of the network:

• Your email address (account login and invitation delivery)
• The VLAN, SSID name, and WireGuard peer assignments tied to your account
• Device names you optionally label in the portal (e.g. "Living Room TV") — purely for your own UI convenience
• Authentication session cookie — no advertising or tracking cookies

What we explicitly do not store:

• Browsing data of any kind. We do not log, retain, or have access to the websites your devices visit, DNS queries from your VLAN, or the contents of any traffic flowing through the network. DNS resolution, if used, is handled by Harbor Privacy DNS under its own no-logs policy
• Bandwidth-per-site, per-device traffic histories, or any per-flow metadata
• Passwords or PSKs in plaintext — SSID PSKs are stored only on the network controller, not in our application database

Account deletion. When you delete your Harbor Neighbor account, all device names you entered are permanently removed along with the rest of your record. We do not retain device labels after deletion — there is no "soft delete" archive of device names tied to a former neighbor.

Harbor Scan

Harbor Scan finds your personal information on data broker / people-search sites (Spokeo, Whitepages, BeenVerified, etc.) and files automated CCPA opt-out requests on your behalf as your authorized agent under Cal. Civ. Code § 1798.135(c). To do this we must collect, store, and transmit the identifiers brokers use to index people. We do not minimize this data because brokers will not act on partial requests.

What we collect and store:

• Your full legal name and any aliases / former names you give us
• Date of birth (used by brokers for disambiguation; never required)
• All email addresses, phone numbers, and physical addresses (current and prior) that you want removed
• Names of relatives or associates (only to help us match your record vs. someone with the same name)
• A signed CCPA agent-authorization form linking your identity to Harbor Privacy
• Per-broker scan findings: the listing URL we found, the broker's snapshot of your record, our confidence score, and timestamps
• Per-broker opt-out request status: when we submitted, when the broker confirmed, when we verified removal
• Inbound emails from brokers (to extract confirmation links) — stored for audit; never analyzed beyond URL extraction

What we send to brokers (this is the entire point of the service):

• Your identifiers in the CCPA letter / opt-out form, including everything in the list above
• The Harbor Privacy authorization reference for your account
• A reply-to address at support@harborprivacy.app for confirmation links

What we explicitly do not do:

• Sell, share, or rent your identifiers to anyone other than the specific brokers you have asked us to file against
• Use your identifiers for advertising, analytics, profile-building, or AI training
• Submit any request before we have a signed authorization on file for the matching profile (the engine refuses with status blocked_unauthorized)

Retention & deletion. Harbor Scan honors two automatic deletion clocks:

• Free scan signups: all data is deleted 7 days after signup — your name, address, emails, phones, the listings we found for you, and any inbound broker correspondence tied to your profile. After 7 days there is no record we ever scanned you.
• Paid plans: we retain your data while your subscription is active so we can keep re-scanning and re-filing. When you cancel, we delete everything within 30 days.
• Inbound broker emails: the raw confirmation emails brokers send us are deleted 30 days after receipt regardless of which profile they belong to.

Deletion is enforced by an automated nightly purge — there is no human review step that could keep your data around longer. Brokers may retain previously-filed opt-out requests in their own logs; you can re-request deletion from them directly under CCPA at any point.

Harbor Breach Monitor

Harbor Breach Monitor (breach.harborprivacy.com) checks the email addresses you choose to monitor against known data breach records once a day, and emails you the first time a new breach shows up. It is included free for any active Harbor Privacy customer, including Harbor Light, up to 3 monitored emails; a paid add-on raises that to 8.

What we collect and store:

• The email address(es) you choose to monitor
• Which named breaches each monitored email has appeared in, and when we first saw it

Every monitored email address and breach record is stored as AES-256-GCM ciphertext, not plain text — the same encryption pattern used for personal data across Harbor's other products. We do not store breach contents (passwords, personal details exposed in a given breach), only the fact that an email appeared in a named breach.

To check a monitored email, we send that email address to XposedOrNot, a third-party breach-lookup service, once per day. See the third-party table below for what that service receives.

What we explicitly do not do:

• Re-alert you for a breach we've already told you about — each breach triggers exactly one email, ever
• Use monitored email addresses for advertising, analytics, or anything outside the breach check itself
• Track opens or clicks on breach alert emails

Deleting your data. Remove a monitored email from your dashboard at any time and its record (including breach history) is deleted immediately. If you've purchased the extra-emails add-on, cancelling it (via the link in your confirmation email or by contacting support@harborprivacy.com) stops that $2.99/month charge without affecting your underlying Harbor Light, Harbor Remote, or Harbor ad-blocking subscription — they are billed and cancelled independently. Losing Breach Monitor eligibility (for example, cancelling your Harbor Privacy plan entirely) does not by itself delete already-stored monitored emails; remove them from the dashboard first, or ask support to delete them for you.

Harbor Stickers (Shop)

We do not run the checkout — Stripe does. When you preorder or buy a sticker, the whole payment and order form is hosted and processed by Stripe. Stripe collects your name, email address, shipping address, and payment details directly. We never see or store your card number.

• From Stripe we receive only what we need to fill your order: the items purchased, your name, your shipping address, and your email
• Your shipping address is used to print a mailing label and send your stickers, and for nothing else
• Your email is used to send an order confirmation and a note the day your order ships. We do not add you to a marketing list
• We do not sell or share any of this, and we never store payment card details at any point
• The only records we keep are the order and shipping details needed to fulfill it, plus a Stripe transaction ID for billing reconciliation. These are deleted once the order is shipped and the return window has passed
• Free sticker requests emailed to us contain only the mailing address you choose to give us, used once to mail your sticker and then discarded

Harbor Family

Harbor Family (harborfamily.us) is a private, invite-only social app for a single family: a photo/update feed, comments and reactions, shared photo albums, a shared calendar, and 1:1/group messaging. It has its own Privacy Policy; in summary:

• There is no public signup. Access is by email invite from a family admin, or a family-controlled join code that admins can disable or regenerate at any time
• Everything posted (feed updates, comments, album photos, calendar events, messages) is visible only to members of that one family's account — never public, never shared with other Harbor Family accounts
• Photos are never served publicly. Every photo request is checked against a valid login first, and uploaded photos are automatically stripped of EXIF/location data before saving
• This domain runs Cloudflare's CSAM Scanning Tool, and any member can report a post, photo, or message, which hides it immediately pending admin review
• Members can, at any time and without asking an admin, download a zip of everything they've posted, deactivate their account (reversible), or permanently delete their account and content (their posts, comments, messages, and uploaded photos — shared albums, events, and conversations they started are kept for the rest of the family with their name removed as creator)
• We do not use Harbor Family content for advertising, AI training, or anything beyond displaying it to the family it was posted to

Harbor Help (Support Tickets)

Support tickets opened at help.harborprivacy.com contain only what you write to us: your email, an optional name, a category, a subject, and a message body. We use this to reply to you and nothing else — never for marketing, never shared with third parties.

Retention. Tickets are automatically deleted 30 days after they are closed. Open tickets stay until they are resolved or you ask us to discard them. The same nightly purge that enforces the Harbor Scan deletion clocks also enforces this one.

Play Park (Games)

Play Park (harborplay.us) is a family games site you can play with no account and no personal information. It has its own privacy policy and no-logs policy; in summary:

• No account, name, or email is required to play. Leaderboard entries are only self-chosen 3-letter initials, a score, and a timestamp
• Preferences, progress, and achievements are stored in your browser. No advertising or tracking cookies are used; analytics are cookieless (Umami)
• Play Park Pro is an optional one-time purchase via Stripe. We store only your email address and a random per-account token to confirm membership, send restore links (via Resend), and sync your own settings/progress (display name, themes, high scores, achievements) across your devices. No card details, no contacts, no location, no game-by-game history. A few first-party functional cookies remember Pro on your device
• Live multiplayer games temporarily store the game board and a random game code so both players stay in sync; this holds nothing personal and is deleted automatically within a couple of hours
• We never sell, rent, or trade any of it. You can ask us to delete your Pro data or a leaderboard entry at any time

Harbor Burn

Harbor Burn (burn.harborprivacy.com) is a zero-knowledge, self-destructing note tool. Encryption and decryption happen entirely in your browser — the key lives in the link's URL fragment (the part after #), which browsers never send to any server. We cannot read a note's contents at any point, before or after you create it. Harbor Burn is text-only and does not accept file, image, or attachment uploads.

• What we store: the ciphertext blob, expiration time, remaining view count, and whether a password was set. We cannot decrypt any of it
• No account or email is required to use Harbor Burn
• A hash of your IP address (never the address itself) is kept temporarily to enforce rate limits and to act on abuse reports against repeat offenders
• Notes are permanently and automatically deleted once they expire (up to 24 hours free, up to 7 days for Pro) or once their view limit is reached, whichever comes first
• Harbor Burn Pro (optional) unlocks larger notes, more views, and longer expiration via a Stripe-purchased credit pack tied to a random token stored in your browser — no email or account required
• Cloudflare Turnstile runs at note creation to block automated abuse; see the third-party table below
• Anyone who receives a link can report it as abusive. Because we cannot read the content, a report immediately deletes the note and counts against the sender's IP hash; repeated reports block that IP hash from creating new notes

Harbor Snip

Harbor Snip (snip.harborprivacy.com and hrbor.us) is a link shortener with two modes you choose per link. Private mode is zero-knowledge: the destination URL is encrypted in your browser before it is sent, and the decryption key lives only in the shortened link's URL fragment (the part after #), which browsers never send to any server. We cannot read where a Private link points, before or after it is created — the trade-off is a longer link, since the key has to travel with it. Fast mode stores the destination as plain text on our server, like a traditional URL shortener (e.g. Bitly), so it can issue an instant server-side redirect and produce a short link with no key attached. We can read a Fast link's destination; a Private link's, we cannot.

• Private mode: we store the ciphertext blob, an optional expiration time, and a hit counter. We cannot decrypt the destination
• Fast mode: we store the destination URL as text, an optional expiration time, and a hit counter. We can read it, and could be compelled to disclose it under a valid legal request
• Fast-mode destinations are checked against local, offline copies of HaGeZi's Threat Intelligence and Badware Hoster domain blocklists (the same lists used by Harbor's own AdGuard Home instances) before a link is created. This is a local lookup against a daily-refreshed list -- no destination is ever sent to a third party to perform this check
• Neither mode requires an account or email
• Our web server (nginx) does not write access logs for snip.harborprivacy.com or hrbor.us for either mode — visiting a link is not logged, regardless of which mode created it
• A hash of your IP address (never the address itself) is kept for up to one hour solely to rate-limit link creation and deter automated abuse, then is automatically deleted
• Cloudflare Turnstile runs at link creation to block automated abuse; see the third-party table below
• Anyone can report a link as abusive. A report immediately deletes the link and counts against the creator's IP hash; repeated reports block that IP hash from creating new links

Harbor Shield (Browser Extension)

Harbor Shield is a free Chrome/Edge extension that blocks trackers and ads and strips tracking parameters from links. Every bit of that runs locally in your browser using Chrome's built-in declarativeNetRequest blocking engine — Harbor Shield has no account, no login, and no server of its own. Install it and it runs standalone.

• Harbor Shield sends nothing to Harbor Privacy or anyone else, ever. There is no server it talks to, no analytics, and no telemetry — the extension's own settings page cannot even load a remote script, since Chrome's Manifest V3 rules block that outright.
• Which filter lists you've turned on, any custom domains you've chosen to block yourself, and your lifetime blocked-trackers count are stored only in your browser's local extension storage (chrome.storage.local). None of it leaves your device, and we have no way to see it.
• Nothing is on by default — Harbor Shield installs blank, and every filter list (EasyList, EasyPrivacy, AdGuard Base, uBlock Origin's filters, Peter Lowe's list, and regional EasyLists) has to be turned on individually in Settings before it does anything.
• Those filter lists ship bundled inside the extension itself and are periodically refreshed by Harbor Privacy from their public, open-source maintainers; matching happens entirely on your device using Chrome's blocking APIs; the sites you visit are never sent to us or to those list maintainers to check against them.
• The Settings page has optional links to other Harbor Privacy products (Scan, Dashboard, Booking, Money, Neighbor, Fax, Career) and to Harbor Adblock. These only do anything if you click them, and they open like any normal link in a new tab — the extension does not phone home to any of them on its own.
• Uninstalling Harbor Shield deletes all of its local browser storage immediately. There is nothing on our servers to delete, because nothing was ever sent there.

3. Third-Party Services — Full Disclosure

We use a minimal, carefully chosen set of third-party services. Here is every external service that touches your data across all Harbor Privacy products:

Service	Purpose	Products	Data Shared	Their Policy
Stripe	Payment processing	DNS, Booking, Fax, Career, Money, Neighbor, Stickers, Burn, Breach Monitor (where billing applies)	Payment card details, transaction amount, email, and (for sticker orders) shipping name and address. We never see or store raw card numbers. Harbor Burn Pro purchases use a random token instead of an email or account.	stripe.com/privacy
XposedOrNot	Data breach lookup	Breach Monitor	The email address being checked, sent once per monitored email per day. XposedOrNot returns which named breaches (if any) that email appears in; we do not send or receive passwords or other breach contents.	xposedornot.com/privacy
Cloudflare Turnstile	Bot/abuse verification at note or link creation	Burn, Snip	A verification token and your IP address are sent to Cloudflare to confirm you are not a bot. No note content or destination URL is ever sent — Turnstile runs before your content is encrypted or created.	cloudflare.com/privacypolicy
Cloudflare Email Routing	Receives transaction-alert emails forwarded by users to their private Harbor Money address	Money	The complete forwarded email (from address, subject, body) en route to our parser. Cloudflare acts as a conduit and does not retain forwarded mail after delivery.	cloudflare.com/privacypolicy
Anthropic (Claude Haiku)	Fallback transaction parser when our built-in parsers can't read an email, and extraction for uploaded bank/card statement files (PDF, photo, or screenshot)	Money (optional, can be disabled)	For email fallback: only the subject + plaintext body of the single email being parsed. For statement uploads: the statement file content (text or page images). No account login credentials are ever involved — Money never connects to your bank. Uploaded files auto-delete from our storage after 7 days.	anthropic.com/privacy
Telnyx	Fax transmission (T.38 FoIP)	Fax	Your document (temporarily, for transmission only), destination fax number, delivery status. Telnyx operates as a conduit and does not retain document contents after transmission.	telnyx.com/privacy-policy
Anthropic	AI document generation (Claude API)	Career	Resume text and job description submitted for document generation. Subject to Anthropic API data handling policies. We do not send identifying information beyond document content.	anthropic.com/privacy
Resend	Transactional email (receipts, login links, fax delivery, parse-failure notes, neighbor invitations, family invites and password resets)	DNS, Booking, Fax, Career, Money, Neighbor, Family	Your email address and the content of the transactional email (receipt or delivery notification). Not used for marketing.	resend.com/privacy
Umami Analytics	Privacy-respecting page view analytics (self-hosted by us)	DNS, Booking, Fax, Career, Money, Neighbor, Family	Aggregate page view counts and referrer sources only. No cookies, no fingerprinting, no individual tracking, no personally identifiable information collected.	umami.is/privacy
Oracle Cloud	Server infrastructure hosting	DNS, Booking, Fax, Career, Money, Neighbor, Family	All Harbor Privacy services run on Oracle Cloud Infrastructure (OCI) in the US. Oracle provides the compute environment but does not access application-level data.	oracle.com/legal/privacy
AdGuard Home	DNS filtering engine (self-hosted)	DNS	Self-hosted on our Oracle Cloud infrastructure. No data leaves our servers. AdGuard Home is open source (GPL v3). Query logs are disabled.	adguard.com/privacy

We do not use Google Analytics, Meta Pixel, or any advertising technology on any Harbor Privacy property. We do not sell, rent, or share your data with advertisers or data brokers.

4. Cookies and Analytics

We use Umami Analytics -- a cookieless, privacy-respecting analytics platform. It collects no personally identifiable information, uses no cookies, and does not fingerprint your browser. It gives us aggregate traffic counts only.

No advertising or tracking cookies, and no tracking scripts, are present on any Harbor Privacy property. The only cookies we ever set are first-party functional ones — a session cookie to keep you logged in on account-based products, and a cookie that remembers a Play Park Pro purchase on your device.

5. Data Retention

• DNS queries: Never stored. Zero retention.
• Fax documents: Deleted immediately on Telnyx delivery confirmation. Maximum 30-minute failsafe cleanup if transmission does not complete.
• Career documents: Not retained after PDF delivery.
• DNS account data: Retained for the life of your subscription plus 30 days after cancellation, then permanently deleted.
• Harbor Neighbor browsing data: Never stored. Zero retention.
• Harbor Neighbor device names: Permanently deleted at account deletion — no retained archive.
• Harbor Family content: Kept until you delete it, your account is deleted, or an admin removes it — there is no automatic expiration, since this is meant to be a lasting family archive. Content confirmed for removal after a report is deleted immediately, including the file on disk.
• Payment records: Stripe transaction ID, amount, and timestamp retained as required for tax and financial records (typically 7 years). No document or query content is included.
• Fax delivery confirmation emails: Sent via Resend and not stored on our servers.
• Harbor Burn notes: Deleted automatically at expiration (max 7 days) or when the view limit is reached, whichever comes first — we cannot read them at any point regardless.
• Harbor Snip links: Kept until you set an expiration and it passes, or the link is reported and deleted. Private-mode destinations we cannot decrypt at any point; Fast-mode destinations are stored as text and are readable by us. The IP hash used to rate-limit link creation is deleted automatically after one hour.

6. Security

All data in transit is encrypted via TLS. Our servers run hardened Ubuntu instances on Oracle Cloud with restricted SSH access and no unnecessary open ports. API keys and secrets are stored in systemd environment variables, never in source code or logs. We do not operate shared hosting environments.

7. Your Rights

Because we collect so little, there is very little to act on -- but you have the right to request deletion of your account and associated data, ask what data we hold about you, and correct any inaccurate account information. Email privacy@harborprivacy.com and we will respond within 5 business days.

8. Law Enforcement

Because we do not log DNS queries, fax contents, or document submissions, there is nothing substantive to hand over. In the event of a valid legal request, we can only provide what we actually retain: account email addresses and Stripe payment records for DNS subscribers. We have no ability to produce browsing history, fax contents, or document contents because we do not store them. For Harbor Burn, we can provide only the ciphertext blob (which we cannot decrypt), an IP hash, and Stripe payment records for Pro purchases — never plaintext note content, because we never have it. For a Harbor Snip Private-mode link, we can provide only the encrypted destination blob, which we cannot decrypt, and no IP address, because the rate-limit hash is deleted after one hour and our web server keeps no access logs for the service. For a Fast-mode link, we can provide the destination URL as stored, since we can read it — but still no IP address, for the same reason.

9. Children

Harbor Privacy services are not directed at children under 13. We do not knowingly collect data from children.

10. Changes to This Policy

If we make material changes, we will update the date above and notify active DNS subscribers by email. Continued use after an update constitutes acceptance.

11. Contact

Harbor Privacy  |  privacy@harborprivacy.com  |  harborprivacy.com