01This policy
This policy explains what personal information harbor0 collects when you use the website, the web app, the desktop app, and the API they use (together, the “service”), how we use it, and the choices you have.
It sits alongside our Terms of Service. In short: your files are yours, we collect what we need to run the service, and we don’t sell your data or track you for advertising.
02What we collect
- Account details — your email address, display name and @username. Your password is handled by our sign-in provider and stored only as a salted hash; we never see or store it in plain text.
- Your files — the files you upload, sync or back up, their names, sizes, folders and saved versions, and who you share them with.
- Devices — the name and platform of each device you sign in on, its sessions, the folders you sync or back up from it.
- Activity — a record of actions on your account, such as uploads, downloads, shares and sign-ins, shown to you and used for security.
- Technical logs — server logs of requests to the service, which can include your IP address, the time and the request made.
- Messages — what you send us when you email us for help.
We don’t use advertising or analytics trackers, and we don’t buy data about you from anyone else.
03How we use it
We use your information to:
- run the service: store, sync, back up and deliver your files;
- let other people find you by @username, and show your name on files you share or send;
- send you account email — verification codes, password resets, invitations, and notices about your account or these policies;
- keep the service secure, and prevent fraud, abuse and breaches of our terms;
- answer your questions, and fix problems you report;
- meet our legal obligations.
We don’t look inside your files to profile you, and we don’t use them to train models or target advertising. We don’t sell or rent your personal information.
04Who can see your information
- People you share with — the files and folders you share or send, and your display name and @username. Anyone who knows your @username can send you files.
- Our staff — a small team can see your account details, storage use, devices and activity to help you and keep the service safe. Our staff tools can’t open your files, every staff action is logged, and staff sign-in requires two-factor authentication.
- Service providers — the companies below, which process data only on our instructions.
- The law — authorities, when we’re legally required to disclose it, or when it’s needed to protect someone from serious harm. Where we can, we’ll tell you first.
- A new owner — if harbor0 is sold or merged, under this policy or one that protects you at least as well.
05Service providers
- Amazon Web Services (United States) — hosting, the database, sign-in, email delivery and server logs.
- Cloudflare (United States) — storage for the contents of your files.
We’ll update this list before we add a provider that handles your personal information.
06Where your data is stored
harbor0 stores your data in the United States. If you live elsewhere, your information is transferred there, and we rely on appropriate safeguards, such as standard contractual clauses, where the law requires them.
07Security
Data travels to and from harbor0 over encrypted connections, and is encrypted at rest by our storage providers. Sign-in sessions use secure, HTTP-only cookies in the browser, and the operating system’s secure credential store in the desktop app. Access to our infrastructure is limited to the people who need it.
By default, files are not end-to-end encrypted: harbor0 holds the keys, which is what lets us build ZIP downloads and deliver shares. You can turn on end-to-end encryption in Settings. Your devices then encrypt files and file names before upload with a key protected by your passphrase and recovery key, neither of which we receive, so we can’t read or recover those files. No system is perfectly secure; if a breach affects your information, we’ll tell you without undue delay.
08How long we keep it
- Account details and files: while your account is open.
- Files in the trash: until you restore them or empty the trash.
- Transfers nobody accepts: they expire after 30 days.
- Your account activity: 90 days.
- Server logs: about 30 days.
- After you delete your account: your files and account data are permanently deleted 30 days later.
We may keep a minimal record longer where the law requires it, or to resolve a dispute or enforce our terms — for example, a record that an account was closed for abuse.
10Your choices and rights
You can see and change your account details in Settings, download your files at any time, sign devices out, and delete your account.
Depending on where you live — for example under the GDPR in the UK and EU, or state privacy laws in the US — you may also have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict how we use it. Email contact@harbor0.com to make a request; we’ll answer within 30 days, and won’t treat you differently for asking. You can also complain to your local data protection authority.
Where the GDPR applies, we rely on performing our contract with you to run the service, on our legitimate interests to keep it secure and improve it, and on legal obligation where the law requires us to act.
11Children
harbor0 is not for children under 13, or under the minimum age to consent to online services where they live. We don’t knowingly collect their information; if you believe a child has an account, email us and we’ll delete it.
12Changes to this policy
If we change this policy in a way that materially affects you, we’ll email you or notify you in the app at least 30 days before the change takes effect. The date at the top shows when it last changed.
13Contact
Questions or requests about your privacy? Email contact@harbor0.com.