Privacy policy

Definitions

In this policy, the service means the Harbourd website and community. Personal information means information that identifies you or can reasonably be linked to you. Service providers process information to support the service. Cookies are small files stored in your browser.

Information we collect

We collect invitation-request email addresses and reasons. For members, we collect email addresses, usernames, passkey public keys, recovery-code hashes, security settings, adult eligibility declarations, sessions, device and IP information, invitations, and contributions. We do not collect birth dates.

Usernames, biographies, published contributions, and karma are public and may be copied or indexed by others. Invitation requests, drafts, bookmarks, individual votes, security records, and notifications are private; aggregate vote scores are public. New image uploads, uploaded-image delivery, and image attachments in downloads are disabled.

Use of information and legal bases

We use account information to provide requested services, security information to prevent abuse, and contributions to operate the community. Where the GDPR applies, the proposed bases are performance of the user agreement for necessary account and community services, legitimate interests for proportionate security and moderation, and consent where required for optional communications. Purpose-specific assessments and provider reviews remain subject to approval.

Inviters must confirm that the recipient requested or expressly agreed to an invitation. This declaration does not establish independently verified consent or permission for unrelated marketing. Invitation opt-outs are checked before queueing and sending; they do not suppress necessary security messages.

Service providers and international transfers

Cloudflare provides hosting, database and object storage, transactional email, and Turnstile abuse protection. Better Auth runs within Harbourd. Zoho business email hosts the privacy mailbox in its Canada data centre. These services may process information internationally. Cloudflare’s customer DPA is incorporated into its standard terms; verification of the applicable executed Zoho DPA remains outstanding. Canadian operation alone does not establish that every onward transfer is covered by an adequacy decision.

Cookies and security

Essential cookies support authentication. We use Cloudflare Turnstile to detect and block bots, including through invisible checks. Cloudflare processes signals such as IP address, TLS fingerprint, user-agent header, and the site key and associated origin to provide Turnstile and improve its bot detection. Cloudflare acts as our processor for site protection and as a controller when improving its bot detection. See the Cloudflare Turnstile Privacy Addendum linked below. We do not include advertising trackers.

Passkeys, access controls, restricted storage, and encrypted privacy-recovery records support account and data protection. Passwords, authentication tokens, private content, and downloads must not appear in application logs. No security measure eliminates every risk.

Retention

Account data, drafts, bookmarks, and votes are kept for the account lifetime unless removed earlier. Sessions expire after one hour of inactivity or 24 hours for members, and 15 minutes of inactivity or 12 hours for staff. Expired access is rejected when used; scheduled cleanup removes expired records.

Invitation requests remain pending for at most 30 days. Reasons clear on a decision. Rejected addresses clear after the 30-day reapplication cooldown; approved request evidence clears within the 35-day invitation-history window. Rejection sends no email. Invitations expire after seven days. Tokens and consent evidence clear on redemption, revocation, or expiry; addresses remain in private invitation history for up to 35 days unless unsubscribe or erasure requires earlier deletion.

Undelivered email payloads last at most seven days and may expire earlier with their purpose. Delivered payloads clear immediately; delivery metadata lasts seven days. Notifications last 90 days. Closed moderation records normally last 180 days, with open cases reviewed every 30 days. Minimal completed privacy-request records normally last 24 months. Downloads expire after 24 hours.

Unreferenced historical images become eligible for cleanup after 24 hours. Sanitized recovery copies follow the verified database recovery window of seven or 30 days; privacy erasure takes precedence. Minimal erasure journals last for that window plus seven days. Keyed email fingerprints are retained only as needed to honour invitation opt-outs. Justified exceptions require a restricted hold with a reason and review date.

Your choices and privacy requests

When privacy controls are available, Settings provides a passkey-confirmed account-data download and account deletion. Downloads exclude credentials, authentication tokens, other invitees’ addresses, confidential third-party information, and uploaded-image files. They do not replace an assessed access request.

Contact the Harbourd privacy team using the address on this page for access, correction, erasure, restriction, objection, portability, withdrawal of consent, or a privacy concern. People who cannot sign in or whose accounts are suspended can also contact us. We verify requests proportionately and do not routinely ask for identity documents. Do not email passwords, authentication tokens, or recovery codes.

We aim to complete requests within 21 days and track applicable legal deadlines separately. Depending on your location and the processing, you may complain to the Office of the Privacy Commissioner of Canada or an applicable European supervisory authority. If we cannot fulfil a request, we explain the reason and available complaint routes.

Deletion and recovery

Account deletion erases identifying account information and authored content. Neutral, locked placeholders may remain to preserve other members’ replies. Deletion cannot remove copies independently made by others. Necessary evidence may be retained privately under a documented, reviewed hold. Recovery procedures must replay later privacy removals and revoke affected access before the service reopens.

Links to other websites

Community posts may link to external websites. Those websites apply their own privacy policies; information you provide to them is outside Harbourd’s controls. Review their policies before sharing personal information.

Children’s privacy

Harbourd is intended for adults aged 18 and over. If you believe a person under 18 has provided personal information to Harbourd, contact the privacy team so the information and account can be reviewed for removal.

Changes to this policy

Updates will be published on this page with a revised date. Review this page for the current description of our privacy practices. This policy does not constitute blanket consent for new purposes or optional communications.

Contact us

For questions about this policy or your personal information, email privacy@harbourd.com. Provider and operational reviews remain in progress; this policy does not claim certified or worldwide compliance.