Privacy

What Harbor stores

Harbor stores your account email address, the financial records you type in, your name if you set one, your household's name, and your household's shared time zone.

If you arrived at Harbor through a campaign link, Harbor also stores that link's short campaign code (for example, "google") with your account. It is deleted with your account.

If you connect a financial institution through Plaid, Harbor also stores the account, balance, transaction, and loan records Plaid provides, and an encrypted Plaid access token used for syncing.

Your records are visible only to members of your household. Harbor does not sell your data, does not use it to build advertising profiles, and does not use your financial data to train AI models.

Optional bank connections through Plaid

On paid plans, you can choose to connect financial accounts through Plaid. Manual entry remains available, and connecting a bank is never required.

You sign in through Plaid's or your bank's secure connection screen. Harbor never receives or stores your bank username or password.

Plaid sends Harbor a limited, read-only view of the accounts you choose: account names and types, balances, transactions, and loan details your institution shares. Harbor stores those records in your household alongside records entered by hand. Harbor cannot move money, make payments, or change anything at your bank.

Harbor also stores the Plaid access token needed to keep the connection working, in encrypted form. Plaid handles your information under its End User Privacy Policy, which you can review before connecting.

You can disconnect a linked institution at any time from Settings. Disconnecting stops future syncing; records already imported remain in your household unless deleted under Harbor's account-deletion process.

Harbor does not verify hand-entered records. Synced records are only as accurate and current as the information your institution provides through Plaid, and can be delayed or contain errors.

Who processes data on our behalf

Harbor runs on a small number of service providers, each doing one job. They process data only to provide their service to us, under their own security obligations:

• Supabase — hosts Harbor's database and authentication. All of your records and account data live here, encrypted at rest.
• Vercel — hosts and serves the Harbor application, and provides aggregate, cookie-free page-view counts for Harbor's public pages.
• Plaid — connects your financial accounts when you choose to link a bank. Plaid's handling of your data is described in Plaid's End User Privacy Policy. Harbor stores the access credentials Plaid issues in encrypted form and never sees or stores your bank username or password.
• Stripe — processes subscription payments. Your card details go directly to Stripe; Harbor never sees or stores full card numbers.
• Google Workspace — powers our support and operational mailboxes (what you send to support@ is handled there).

We don't sell your data to anyone, and no provider on this list is permitted to use your financial records for its own purposes. If this list changes, this page changes with it.

Email Harbor sends you

Harbor sends transactional email only: confirming your address, resetting your password, confirming a change of account email, subscription confirmations, renewal reminders, card-expiry reminders, payment-failure and grace-period notices, cancellation confirmations, and price-change notices. Harbor does not send marketing email.

Changing your account email requires confirmation at both the old and the new address, so an address cannot be moved by someone who has only gained access to your session.

Taking your data with you

With Harbor Plus, you can download the records you have entered as category-by-category CSV files from Settings while signed in. Exports contain your household's records in a plain, portable format.

Account deletion

You can start a deletion request from Settings while signed in. The request opens an email to Harbor; Harbor does not claim it was submitted or acknowledged automatically, and sending it does not delete your account immediately.

Because Harbor holds financial records, deletion begins a manual identity-verification process. Once verified, Harbor normally completes deletion from active systems within seven days, ends active access and sessions, and confirms completion through the verified contact path.

After deletion from active systems, encrypted backup copies expire on the provider's applicable backup-retention schedule. Harbor does not publish an exact backup expiration period, because that behavior has not yet been verified against current provider practice and Harbor will not state a number it has not confirmed.

Records kept because the law or an active security matter requires it are retained only for as long as that requirement lasts, and are then purged.

What Harbor keeps after deletion

Minimal deletion evidence contains a request ID, internal user ID, timestamps, and completion status — but no user financial contents — and is retained for 12 months before purge. Minimal security evidence follows the same 12-month rule.

Migration and release records contain no user financial data and may be retained indefinitely.

Children

Harbor is intended for adults. The one exception is a teen aged 16 or 17 whom a parent or legal guardian invites into their Family household; Harbor records that invitation as the parent's consent. Harbor does not verify ages; the parent or guardian is responsible for the invitation. Harbor is not directed to children under 16 and does not knowingly collect personal information from them. If you believe a child under 16 has provided information to Harbor, contact us and it will be removed.

Changes to this page

Harbor may update this page as the product changes. When a change materially affects how your information is handled, Harbor will make reasonable efforts to tell account holders before it takes effect.

Questions and security concerns

Privacy questions: support@harborfinancialapp.com.

Security concerns: security@harborfinancialapp.com. Please do not include passwords, tokens, or financial documents in your report.