Privacy Policy

Harbor exists to hold sensitive information — account details, credentials, documents, and instructions a designated successor may need in an emergency. Because of what we store, we treat security and honesty about our practices as part of the product. Where this Policy makes a claim about how data is protected, we intend it to be literally true. If you ever find a statement here that does not match how Harbor works, tell us at help@harborvaults.com.

2.1 Information you provide when you create an account

When you sign up, we collect your name and email address, and we assign you an account identifier. If you set up two-factor authentication (which we require), we store the information needed to verify your authenticator and your recovery codes in hashed form.

2.2 Information you choose to store in your vault

Harbor is a vault, so most of what we hold is information you deliberately put in. Depending on how you use Harbor, this may include:

• Financial account information, including account names, numbers, and login credentials
• Documents you upload, such as wills, trusts, deeds, insurance policies, and statements
• Personal and household details, and information about people you designate as successors or key contacts
• Sensitive identifiers you choose to store, which may include Social Security numbers, and, if you use relevant features, other high-sensitivity data

You decide what goes into your vault. You can export or delete this information at any time (see Section 8).

2.3 Account and support information we maintain

To operate your account we keep limited internal records — for example, your subscription and billing status, support correspondence, and internal account notes our team may add to help provide service. These internal records are administrative and are kept separate from your vault contents.

2.4 Information collected automatically

When you use Harbor, we and our service providers automatically receive standard technical information such as IP address, browser and device type, pages viewed, and timestamps, along with error and security logs. We use aggregate analytics to understand traffic and improve the product.

Some commitments are important enough to state plainly:

• We do not sell your personal information.
• We do not use the contents of your vault — your documents, credentials, or account details — for advertising, and we do not share them with advertisers.
• We do not use your vault contents to train artificial-intelligence models, and we do not send your vault contents to third-party AI providers for that purpose.
• Our internal administrative tools surface only contact and account information. They do not surface the contents of your vault.

Harbor uses cookies and similar technologies that are necessary to run the service — for example, to keep you logged in and to protect your account. We also use analytics technologies to understand how the service is used so we can improve it. We may also use analytics and advertising technologies (such as Google Analytics or advertising pixels) to measure our marketing and reach people who might benefit from Harbor. Any such technologies relate to marketing our service and are never applied to the contents of your vault. Where the law requires consent for non-essential cookies, we will ask for it. You can also control cookies through your browser settings; disabling some cookies may affect how Harbor works.

We use information to:

• Provide, maintain, and secure Harbor, including authenticating you and enforcing two-factor requirements
• Operate the successor-access process you set up, at your direction and under the conditions you configure
• Process payments and manage subscriptions
• Respond to support requests and communicate with you about the service
• Understand usage in aggregate and improve the product
• Comply with law and enforce our Terms

A defining feature of Harbor is that you can designate a successor who may receive access to your vault in an emergency. This process is one you control:

• You choose who your successor is and what parts of your vault they may see
• A successor must complete two-factor authentication before they can access anything
• When a successor requests access, there is a waiting period during which you are notified and can cancel the request
• If you do not respond within that period, access may be granted automatically — this is by design, because the feature exists for situations where you cannot respond

Harbor is not a law firm and a successor designation in Harbor is not a will, a power of attorney, or any legal instrument. It does not by itself grant anyone legal authority over your accounts or estate. See our Terms of Service.

We share information only as needed to run Harbor:

• With service providers who host our infrastructure, store data, process payments, or send email on our behalf. Our current providers include our application and hosting platform (Lovable) and its underlying database and storage (Supabase), our off-platform backup storage provider (Backblaze B2), our payment processor (Stripe), and our domain and email provider (Squarespace).
• With a successor you have designated, under the conditions described in Section 6
• If required by law, or to protect the rights, safety, or property of Harbor, our users, or others
• In connection with a business transfer, in which case we will give you notice and honor the commitments in this Policy

You can access, export, or delete your information at any time. Harbor provides a one-click export of your vault, and you can delete your account, which removes your data as described in Section 9.

We are committed to following recognized data privacy standards, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and we extend the core protections they provide to all our users regardless of where they live. Depending on your location, you may have the right to know what personal information we hold about you, to access or receive a copy of it, to correct or delete it, to restrict or object to certain processing, and to opt out of the sale or sharing of personal information. We do not sell your personal information. To exercise any of these rights, contact us at help@harborvaults.com; we will verify your request and respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights. If you are in the EU or UK and believe we have not resolved your concern, you also have the right to lodge a complaint with your local data protection authority.

We keep your vault information for as long as your account is active, because Harbor is designed to be there for you over the long term. We do not retain personal data indefinitely, and we apply the following limits:

• Active accounts: we retain your information while your account is active and in good standing.
• Payment lapse: if a payment fails or your subscription lapses, we do not immediately delete your data. Your household is frozen rather than erased, so you can restore full access by resolving the billing issue.
• Prolonged dormancy: if an account remains both unpaid and inactive for 24 consecutive months, we will notify the email address on file and provide at least 60 days to respond or reactivate. If we receive no response within that period, we will permanently delete the account and its vault data.
• Account deletion: when you delete your account, we permanently remove your vault data within 30 days.
• Backups: residual copies of deleted data may persist in our encrypted, off-platform backups for a short period (approximately 35 days) before those backups age out and are overwritten.

After these periods, data is permanently and irreversibly deleted. We may retain limited non-vault records (such as billing history or records we are legally required to keep) for as long as the law requires, but these never include the contents of your vault.

Security is central to Harbor. Sensitive fields you store are encrypted, access to vaults is enforced at the database level, two-factor authentication is required, and we maintain encrypted, off-platform backups. Our public security overview describes our protections in detail and states plainly what we do and do not do. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security, but we work to hold ourselves to the standard our product promises.

Harbor is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

We may update this Policy as Harbor evolves. If we make a material change, we will take reasonable steps to notify you. The “effective date” above reflects the current version.

Questions about this Policy or your information: help@harborvaults.com. Harbor is operated by Grollman Holdings LLC, and this Policy is governed by the laws of the State of Illinois.