Security and data

Who operates it

Harbor is a small, independent product, built and run by its founder. Questions go to hello@harborppm.com. Weekday replies are typical.

What we store

Your account (name, email, sign-in provider). The portfolios, programs, projects, people, and files you put in a harbor. Stripe customer and subscription ids if you Keep. We do not see your full card number.

Signing in

Sign in with email and a password, or with Google. Passwords are stored only as salted hashes. Anyone who signs in with a password can turn on two-step sign-in from their account menu: after the password, Harbor asks for a code from an authenticator app, or one of ten single-use backup codes. The app's secret and the backup codes are stored encrypted. Ten wrong codes in a row lock the account for 15 minutes. Signing in with Google uses Google's own 2-Step Verification. Signed-in devices, in the same menu, lists every browser signed in to your account and signs out any of them. A harbor's owner can remove anyone from it on People, which ends their access at once, and anyone else can leave. The owner can also hand the harbor to someone already aboard.

Draft

Draft sends the sentence you type to Anthropic (Claude) so it can propose a board. It does not send the rest of the harbor. Harbor does not use your boards to train a model. Anthropic’s terms apply to that prompt. Draft proposes; it does not move cards, assign people, or message the crew.

AI apps you connect

You can connect Claude or another MCP app to Harbor (see the AI page). Harbor asks you first, every time, and you can allow reading only. A connected app sees only the harbors you belong to, and what it reads goes to that app under its own terms. Its changes show in History with its name, it cannot delete anything, and Connected apps in Settings disconnects it at once.

Analytics

Public pages may send a page view to Google Analytics unless your browser sends Do Not Track. We also keep an anonymous visit count on those pages. Boards, tasks, and names stay off it.

Export and deletion

A harbor’s owner can download a copy of everything in it at any time: Download a copy… in Settings gives one JSON file of the whole harbor, or every task as a spreadsheet, and harbor export harbor does the same in the terminal. Anyone can export a project’s tasks or the register from those pages. Delete your account… in Settings closes your account: a harbor you own alone is deleted with it (download a copy first), one with others aboard is handed to one of them first, and in other people’s harbors your work stays under “Former member”. It asks you to sign in again first, with your two-step code if you use one. To delete a harbor and keep your account, write hello@harborppm.com. Deletion removes it from Harbor. Stripe keeps payment records as they are required to.

After you cancel Keep

Cancel stops the next charge. You keep the boards through the period you already paid. After that the harbor remains unless you ask us to delete it. Keep is membership, not a lock on the data.

Integrations

Tasks come in from a spreadsheet or a CSV exported from Asana, Jira, Trello or anywhere else. Where a harbor is offered it, its owner can link a project to a Jira or Asana project: Harbor reads the tasks there and keeps them in step, and never changes anything in Jira or Asana. AI apps connect over MCP. A harbor’s owner can add webhooks, which send signed events (tasks added, done or moved, comments, health changes) to an https address they choose, such as Zapier; Harbor refuses addresses inside private networks. Sign-in is email and password (with optional two-step sign-in), or Google. Payments are Stripe.

More on storage: Privacy. Use: Terms. Write hello@harborppm.com.