Harbor Privacy Policy

Last updated: 13 October 2026

Harbor is a personal wellbeing app with an AI companion called Solaris. This policy explains what data Harbor collects, why, where it is kept, who helps process it, and the choices you have. Harbor is in private development and is not open to the public yet.

Questions or requests: privacy@ordinaryfuture.ai.

1. What we collect

Your account: your email address, used to send you sign-in codes.
What you record in Harbor: tasks, habits, mood, notes and their photos, goals, reflections, sleep, movement, food, finances, focus sessions and similar entries you choose to add.
Conversations with Solaris: your messages, photos you send her, her replies, and the memories she keeps about you to help you over time.
Notifications: your device's push token, so Harbor and Solaris can reach you.
Voice input: when you dictate, your phone's own speech recognition service turns speech into text. Harbor receives only the text.
Google data, only if you connect a Google account: see section 4.

2. How we use it

Only to provide Harbor and Solaris to you: to store and show your entries, to let Solaris understand your situation, remember what matters to you, check in with you and act on your requests. We do not sell your data, use it for advertising, or share it with anyone for their own purposes.

3. Where it is stored and who processes it

Supabase (database, sign-in and file storage), in the European Union (Ireland).
Hetzner (Harbor's server), in the European Union (Finland). The text search that powers Solaris' memory runs on this server; that text is not sent elsewhere for this purpose.
OpenAI (the AI model behind Solaris). When Solaris thinks or answers, the relevant content (your messages, the entries and memories she reads, and any Google data she reads for your request) is sent to OpenAI's API to be processed. Under OpenAI's API terms, this data is not used to train their models. When Solaris searches the web, her search goes through OpenAI's search tool.
Expo (push notification delivery): the text of a notification passes through Expo's push service on its way to your phone.
An email delivery provider, to send your sign-in codes.

4. Google user data

Connecting a Google account is optional. If you connect one, Harbor asks only for the permissions you approve on Google's screen, and uses them only for the features you use:

Gmail (gmail.modify): Solaris can search and read your email, organise it (labels, archive) and prepare drafts. She never sends an email without your explicit confirmation in the app for that email.
Google Drive (drive.file): Solaris can create documents and spreadsheets in your Drive, and work only with files Harbor created or that you opened with Harbor. She cannot see the rest of your Drive.
Google Calendar (calendar.events): Solaris can read your events and add or change events in your calendar. Anything that notifies other people, such as sending an invitation, needs your confirmation in the app.

Limited Use. Harbor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google data is used only to provide the features you ask Harbor and Solaris for, inside Harbor.
It is never sold, never used for advertising, and never used to train generalised AI or machine-learning models.
It is shared only with the processors needed to provide those features (OpenAI, to process your request, as described in section 3).
No person reads it, unless you ask us to, it is needed for security or abuse investigation, or the law requires it.

Your email and files are read live from Google when needed. They are not copied into Harbor's database. Solaris may keep a short note in her memory of something relevant she read, as she does with anything you tell her; you can see and delete her memories in the app. The access tokens Google gives Harbor are stored encrypted. You can disconnect a Google account in Harbor at any time, which deletes its tokens, or revoke Harbor's access at myaccount.google.com/permissions.

5. How long we keep it

Your data is kept while you have an account. Items you delete in the app are removed permanently within about 30 days. To delete your account and all its data, email privacy@ordinaryfuture.ai; we will delete it within 30 days.

6. Security

Data travels encrypted (HTTPS). Each person's data is isolated at the database level, and access to the servers is restricted to the operator.

7. Your rights

You can ask to access, correct, export or delete your data, or object to how it is used, by writing to privacy@ordinaryfuture.ai. You can also complain to your local data protection authority.

8. Children

Harbor is not intended for anyone under 16.

9. Changes

If this policy changes, the date at the top changes. If a change affects how Google data or health-related entries are used, you will be told in the app before it applies.