Privacy Policy

Welcome to Harbour.

Harbour is a messaging platform designed to help people have better conversations. In addition to messaging, Harbour offers optional AI-assisted features that can support communication, facilitate conversation mediation and provide other tools to help users communicate more effectively.

We recognise that conversations often contain personal and sensitive information. Protecting your privacy is fundamental to the way Harbour is designed and operated. This Privacy Policy explains how we collect, use, store, share and protect your personal data when you use Harbour.

Please read this Privacy Policy carefully before creating an account or using the Service.

By using Harbour, you acknowledge that your personal data will be processed as described in this Privacy Policy.

For the purposes of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection laws, the data controller responsible for Harbour is:

Matt Scott

Trading as Harbour

Email: hello@harbour-app.com

Website: https://harbour-app.com

Throughout this Privacy Policy, references to "Harbour", "we", "our" or "us" refer to Matt Scott, trading as Harbour.

If ownership of Harbour changes, or Harbour begins operating through a registered company, this Privacy Policy will be updated accordingly.

This Privacy Policy applies to:

• the Harbour mobile application;
• the Harbour website;
• AI-powered features provided through Harbour;
• customer support services;
• communications between you and Harbour; and
• any other products or services that link to this Privacy Policy.

This Privacy Policy does not apply to products, services or websites operated by third parties, even where Harbour provides a link to them. Those services operate under their own privacy policies, and we encourage you to review them before providing any personal information.

Harbour is intended for individuals who are 16 years of age or older.

We do not knowingly allow children under the age of 16 to create Harbour accounts or use the Service.

If we become aware that personal data has been collected from a child below the minimum permitted age, we will take reasonable steps to suspend or remove the account and delete the associated personal data where appropriate.

If you believe a child has used Harbour in breach of this requirement, please contact us using the details provided at the end of this Privacy Policy.

The personal data we collect depends on how you use Harbour and the features you choose to use.

We collect personal data directly from you, automatically through your use of the Service, and, in limited circumstances, from other users where this is necessary to provide Harbour's functionality.

The categories of personal data we process are described below.

5.1 Account Information

When you create a Harbour account, we collect information necessary to identify you and provide the Service.

This may include:

• your email address;
• your chosen username;
• your display name;
• your encrypted authentication credentials (managed through our authentication provider);
• records confirming acceptance of our Privacy Policy and Terms of Service; and
• account creation and account status information.

You are responsible for ensuring that the information associated with your account remains accurate and up to date.

5.2 Profile Information

You may choose to personalise your Harbour profile by providing additional information.

Depending on the features available, this may include:

• a profile photograph;
• an avatar;
• a display name;
• optional profile details; and
• other information you choose to make available to other Harbour users.

Certain profile information, including your display name, username and profile picture, is visible to users with whom you interact so they can identify you within Harbour.

5.3 Messages and Conversation Data

Providing messaging services is the core purpose of Harbour.

When you send or receive messages, we process the information necessary to deliver, display and manage those conversations.

This includes:

• messages you send;
• messages you receive;
• message timestamps;
• delivery and read status;
• conversation membership;
• conversation settings;
• message attachments;
• system messages generated by Harbour; and
• metadata required to operate the messaging service.

Where you choose to use Harbour's AI-assisted conversation features, additional processing may occur as described in Section 8 of this Privacy Policy.

Harbour does not use the contents of your private conversations to build advertising profiles or deliver targeted advertising.

5.4 Media You Upload

If you upload photographs, videos or other supported files, we process those files so they can be securely stored and made available to participants in the relevant conversation.

This includes information such as:

• the uploaded file;
• file type;
• file size;
• upload date and time; and
• technical information required to store and retrieve the file securely.

Media is only made available to users who have permission to access the relevant conversation.

Where you delete media that you uploaded, Harbour will remove the underlying media file in accordance with our data retention practices, while preserving the integrity of conversation records where appropriate.

5.5 Voice Features

Harbour supports voice-based communication features.

When you use these features, we may process:

• voice recordings;
• voice transcripts;
• message duration;
• timestamps; and
• technical information required to provide voice messaging and transcription services.

Voice recordings and transcripts are processed solely to provide the features you choose to use and are not used for advertising purposes.

5.6 Contacts and Invitations

Harbour allows users to connect with one another through contact requests and invitations.

To provide these features, we process information including:

• contact requests you send and receive;
• contact relationships;
• blocked users;
• paused conversations;
• invitation status; and
• invitation details required to deliver or manage an invitation.

If you invite someone to join Harbour, you should ensure that you have permission to provide their contact information.

Invitation records are retained only for as long as necessary to operate the invitation process and are routinely removed once they have expired or are no longer required.

5.7 Customer Support

If you contact Harbour for support or provide feedback, we may process information including:

• your name;
• your email address;
• information relating to your enquiry;
• screenshots or files that you choose to provide;
• technical information necessary to investigate an issue; and
• our correspondence with you.

We use this information solely to respond to your enquiry, improve the Service and fulfil our legal obligations.

5.8 Technical and Device Information

When you use Harbour, we automatically collect limited technical information that is necessary to operate, secure and improve the Service.

Depending on your device and operating system, this may include:

• device type;
• operating system;
• application version;
• language and regional settings;
• authentication session information;
• network information required to establish secure connections;
• diagnostic information; and
• application crash or error reports.

This information is not used to build advertising profiles or to track your activity across third-party websites or applications.

We use your personal data only where we have a valid reason to do so.

Depending on how you use Harbour, we may use your personal data to:

• create and manage your account;
• authenticate your identity;
• deliver messages and media;
• synchronise conversations across your devices;
• provide AI-assisted features that you choose to use;
• process voice recordings and transcripts;
• manage contacts and invitations;
• respond to customer support requests;
• improve the reliability, performance and security of Harbour;
• detect, prevent and investigate fraud, abuse or misuse;
• comply with legal obligations;
• enforce our Terms of Service; and
• communicate with you regarding your account or the Service.

We do not sell your personal data.

We do not use the contents of your private conversations for advertising purposes.

Where UK GDPR applies, we process your personal data only where we have a lawful basis for doing so.

The lawful basis depends on the purpose for which your personal data is processed.

7.1 Performance of a Contract

Most of the personal data processed by Harbour is necessary to provide the Service you have requested.

This includes processing necessary to:

• create your account;
• authenticate you;
• deliver messages;
• store conversations;
• deliver uploaded media;
• synchronise your conversations;
• provide voice messaging;
• enable AI features that you choose to use; and
• provide customer support.

Without this processing, Harbour would not be able to provide its core functionality.

7.2 Legitimate Interests

We also process personal data where it is necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.

These legitimate interests include:

• protecting the security of Harbour;
• detecting and preventing fraud;
• investigating misuse of the Service;
• improving the stability and reliability of Harbour;
• maintaining audit records;
• protecting users from abuse;
• defending legal claims; and
• improving our products and services.

Where we rely on legitimate interests, we consider the impact on your privacy before processing your personal data.

7.3 Consent

Some processing activities are carried out only with your consent.

These may include:

• receiving marketing communications;
• providing optional information within your profile; or
• other processing where consent is required by law.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.

7.4 Legal Obligations

In certain circumstances, we may process your personal data because we are required to do so by law.

This may include processing necessary to:

• comply with court orders;
• respond to lawful requests from public authorities;
• comply with regulatory obligations;
• investigate criminal activity where required by law; or
• fulfil other legal obligations that apply to Harbour.

Artificial intelligence is an important part of Harbour, but it is always intended to support—not replace—human communication.

Harbour offers optional AI-powered features designed to assist users with conversations. Depending on the feature being used, AI may:

• assist with drafting messages;
• provide communication coaching;
• mediate conversations between participants;
• generate conversation insights or summaries;
• transcribe voice recordings; or
• provide other AI-assisted functionality introduced in future versions of Harbour.

When you choose to use an AI-powered feature, Harbour may process the information necessary to provide that feature.

Depending on the context, this may include:

• message content;
• relevant conversation history;
• participant display names;
• voice transcripts; and
• other information reasonably necessary for the AI feature to function.

We share only the information reasonably necessary to provide the AI feature that you have requested.

AI-generated responses are produced automatically and may occasionally be inaccurate, incomplete or unsuitable for your particular circumstances. They should not be relied upon as legal, medical, financial, psychological or other professional advice.

You remain responsible for the decisions you make, the messages you send and the way you use AI-generated content within Harbour.

As Harbour develops, we may improve our AI features by changing models, providers or processing methods. Where those changes materially affect how personal data is processed, we will update this Privacy Policy accordingly.

We do not sell your personal data.

We share personal data only where necessary to operate Harbour, comply with legal obligations or protect the rights, safety and security of our users.

Depending on the circumstances, we may share personal data with:

• providers of cloud hosting, databases and secure storage;
• authentication providers;
• AI service providers;
• voice transcription providers;
• email and SMS delivery providers;
• infrastructure and security providers;
• professional advisers where necessary;
• regulators or public authorities where required by law; and
• law enforcement agencies where we are legally required to do so.

All third-party service providers are required to process personal data only for the purposes of providing services to Harbour and in accordance with applicable data protection laws.

Where appropriate, we use contractual and organisational safeguards to protect personal data shared with our service providers.

Some of the organisations that help us operate Harbour may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place in accordance with applicable data protection laws. These safeguards may include:

• transfers to countries recognised as providing an adequate level of data protection;
• contractual safeguards approved under applicable law; or
• other lawful transfer mechanisms designed to protect your personal data.

Where applicable, we require our service providers to implement appropriate technical and organisational measures to safeguard the personal data they process on our behalf.

We retain personal data only for as long as it is necessary to provide Harbour, fulfil the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes and enforce our legal rights.

The length of time that personal data is retained depends on the type of information involved.

11.1 Account Information

Your account information is generally retained for as long as your Harbour account remains active.

If you choose to delete your account, we will delete or anonymise your account information where appropriate, unless we are required or permitted by law to retain certain information.

11.2 Messages

Messages form part of shared conversations between users.

Deleting your Harbour account does not automatically remove messages that have already been delivered to other participants.

Those messages may remain visible within the conversation history of other participants unless they are separately deleted in accordance with Harbour's functionality.

11.3 Uploaded Media

Media that you upload is retained while it is required to support the relevant conversation.

Where you delete media that you uploaded, Harbour will remove the underlying media file where technically possible.

In some circumstances, limited records relating to deleted media may be retained where necessary to preserve the integrity of conversations, maintain security or comply with legal obligations.

11.4 Voice Recordings and Transcripts

Voice recordings and transcripts are retained only for as long as they remain associated with the relevant conversation or are otherwise required to provide Harbour's functionality.

11.5 AI Conversations

Where Harbour provides private AI-assisted conversations or coaching features, those records are retained while associated with your account unless you delete them or your account is removed.

11.6 Invitations

Invitation records are retained only for as long as necessary to manage invitations and maintain the security and integrity of the invitation process.

Expired invitation records are routinely removed.

11.7 Audit and Security Records

We maintain limited operational records relating to matters such as:

• account activity;
• legal acceptance records;
• security events;
• moderation actions;
• data export requests; and
• other operational logs.

These records are retained only for legitimate operational, legal and security purposes.

They do not contain copies of your exported personal data.

We take the security of personal data seriously.

Harbour uses a combination of technical and organisational measures designed to protect personal data from unauthorised access, disclosure, alteration or destruction.

These measures include, where appropriate:

• encrypted network communications;
• authenticated user access;
• secure cloud infrastructure;
• database access controls;
• secure storage for uploaded media;
• authentication and session management;
• audit logging;
• monitoring for suspicious activity; and
• access controls based on the principle of least privilege.

Although we work hard to protect your personal data, no internet-based service can guarantee absolute security.

You are responsible for keeping your login credentials secure and notifying us promptly if you believe your account has been accessed without your permission.

Depending on your location and the laws that apply to you, you may have certain rights regarding your personal data.

These rights may include the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• object to certain types of processing;
• request restriction of processing;
• request a copy of your personal data in a portable format;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory authority.

Some of these rights are subject to legal limitations and may not apply in every circumstance.

Harbour provides a number of self-service privacy tools within the application, including:

• editing your profile;
• downloading your personal data;
• deleting your account; and
• managing your communication preferences.

Where a request cannot be completed through the application, you may contact us using the details provided at the end of this Privacy Policy.

For security reasons, we may ask you to verify your identity before responding to certain requests.

Harbour provides a Download My Data feature that allows you to obtain a copy of the personal data associated with your account.

Depending on how you use Harbour, your export may include:

• account information;
• profile information;
• contacts;
• conversations;
• message history;
• uploaded media, subject to technical limitations;
• AI conversation history associated with your account; and
• other personal data that you are entitled to access.

Exports are generated securely and are available only to the authenticated account holder.

Where technical limitations prevent certain files from being included, Harbour will explain which items could not be exported and the reason why they were omitted.

You may permanently delete your Harbour account at any time using the account settings within the application.

Deleting your account generally results in:

• removal of your profile;
• removal of your contacts;
• deletion of your uploaded avatar;
• deletion of media that you own where technically possible;
• removal or anonymisation of associated account information where appropriate; and
• termination of your access to Harbour.

Deleting your account does not automatically remove messages that have already been delivered to other users.

Those messages may continue to appear within the conversation histories of other participants.

Certain information may be retained where necessary to:

• comply with legal obligations;
• investigate fraud or abuse;
• protect the safety and security of users;
• resolve disputes; or
• establish, exercise or defend legal claims.

Where you have chosen to receive marketing communications, Harbour may send you information about:

• new features;
• product updates;
• newsletters;
• surveys;
• beta programmes;
• promotions; and
• other information relating to Harbour.

You may unsubscribe from marketing communications at any time by using the unsubscribe link included within those communications or by contacting us.

Even if you opt out of marketing communications, we may continue to send important service-related communications, including security alerts, password reset emails, legal notices and information necessary to administer your account.

Harbour uses only the technologies necessary to operate the Service securely and efficiently.

These technologies may include cookies, local storage and similar technologies that enable essential functionality, such as:

• keeping you signed in;
• maintaining secure authenticated sessions;
• remembering application preferences;
• storing accessibility settings;
• protecting against fraudulent or unauthorised access; and
• improving the stability and reliability of the Service.

Harbour does not currently use third-party advertising cookies or technologies designed to track your browsing activity across other websites or applications for advertising purposes.

If Harbour introduces non-essential cookies or similar technologies in the future, we will update this Privacy Policy and, where required by law, request your consent before those technologies are used.

To help maintain a reliable and secure service, Harbour collects limited diagnostic and technical information when errors occur.

This information may include:

• application version;
• operating system;
• device type;
• crash reports;
• diagnostic logs;
• technical error messages; and
• information necessary to investigate software faults.

We use this information solely to:

• investigate technical issues;
• improve application performance;
• improve reliability;
• identify software defects;
• maintain security; and
• prevent service disruption.

We do not intentionally use diagnostic information to monitor your behaviour or create advertising profiles.

Where diagnostic information unintentionally contains personal data, access is restricted to authorised personnel responsible for maintaining Harbour.

Creating a safe environment is an important part of operating Harbour.

We may process personal data where reasonably necessary to:

• detect spam;
• investigate abuse or misuse of the Service;
• respond to reports submitted by users;
• protect the rights, property or safety of Harbour, our users or others;
• investigate suspected fraud;
• prevent unauthorised access to Harbour; or
• comply with legal obligations.

Where appropriate, Harbour may temporarily retain information relating to moderation or security investigations until the matter has been resolved.

Access to this information is restricted to authorised individuals who require access to perform their responsibilities.

We do not use safety or moderation information for advertising or marketing purposes.

Harbour uses automated technologies, including artificial intelligence, to provide certain optional features.

These technologies are intended to assist users with communication and improve the functionality of the Service.

Harbour does not make decisions that produce legal or similarly significant effects solely through automated processing.

AI-generated suggestions are intended to assist users and should not be considered a substitute for independent judgement or professional advice.

Users remain responsible for reviewing AI-generated content before relying upon it or sharing it with others.

Harbour may contain links to websites, applications or services operated by third parties.

Those services operate independently of Harbour and are governed by their own privacy policies and terms.

We are not responsible for the privacy practices, security or content of third-party services and encourage you to review their privacy policies before providing them with personal data.

We may update this Privacy Policy from time to time to reflect:

• changes to applicable laws or regulations;
• improvements to Harbour;
• new products or features;
• changes to the way we process personal data; or
• changes to the organisations that help us provide the Service.

Where changes materially affect your rights or the way your personal data is processed, we will take reasonable steps to notify you before those changes take effect.

Depending on the nature of the change, we may notify you:

• within the Harbour application;
• by email;
• through our website; or
• by another appropriate method.

The most recent version of this Privacy Policy will always be available through Harbour and on our website.

The version number and "Last Updated" date shown at the beginning of this document identify the current version.

If you have any questions about this Privacy Policy or how Harbour processes your personal data, you can contact us using the details below.

Data Controller

Matt Scott

Trading as Harbour

Email

hello@harbour-app.com

Website

https://harbour-app.com

We aim to respond to privacy-related enquiries within a reasonable period and, where applicable law applies, within the timeframes required by law.

If you believe that Harbour has not handled your personal data in accordance with applicable data protection laws, we encourage you to contact us first so that we have an opportunity to address your concerns.

If you remain dissatisfied, you may have the right to lodge a complaint with the supervisory authority responsible for data protection in your jurisdiction.

If you are located in the United Kingdom, the relevant supervisory authority is:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk

Making a complaint to the ICO does not affect any other legal rights or remedies that may be available to you.

At Harbour, privacy is not simply a legal requirement—it is a fundamental part of how we design and operate our Service.

We are committed to:

• collecting only the personal data necessary to provide Harbour;
• being transparent about how your personal data is used;
• providing clear controls over your information;
• protecting your personal data using appropriate technical and organisational safeguards;
• supporting your rights under applicable data protection laws; and
• continually improving our privacy practices as Harbour evolves.

Thank you for choosing Harbour and for trusting us with your conversations.