Privacy policy
Last updated: September 30, 2026
What Harbor accesses, and why
- When you connect a Google, Microsoft or Zoho account, you sign in on Google's, Microsoft's or Zoho's own page. Harbor never sees your password.
- To build your inbox and sort it, Harbor reads message headers and short previews of your recent inbox messages (sender, recipients, subject, date, the provider's short preview, read/unread state, mailing-list and automated-mail headers, and Gmail categories or Outlook Focused/Other). It also reads the recipients and conversations of your recent sent mail, only to know who you write to and which conversations you have replied in.
- Full message bodies and attachments are fetched on demand, only to show them to you or to forward them when you ask, and are never stored.
- Harbor sends, replies, forwards, archives, marks, or moves a message to the trash only when you tap the button to do it, and only after you have turned that on for that account.
- When you add an account by typing its address, Harbor looks up the mail servers of the address's domain (only the domain name) with Cloudflare's public DNS service to know whether it is Google, Microsoft or Zoho.
- Pictures that load from the internet inside an email are blocked until you tap Show images (or choose to always show them for a sender). When you do, the sender's image server can see that the message was opened.
- If you tap Unsubscribe on a message and confirm, Harbor sends the sender the one-click unsubscribe request that the sender published in that message. Nothing else is sent.
How it is stored
- Everything is kept in a Cloudflare Durable Object dedicated to your copy of Harbor. It is not shared with anyone else's copy.
- Stored message data is limited to what the inbox list and sorting need (the headers and previews above, for up to 500 recent inbox messages per account), plus your own settings, snoozes, flags and sender rules.
- Stored data is encrypted with AES-256-GCM. Google, Microsoft and Zoho refresh tokens are encrypted with a separate key for each account. Access tokens are kept in memory only.
- No message bodies or attachments are stored. The text of replies you send is not stored.
What Harbor never does
- We do not sell your data, use it for advertising, or share or transfer it to third parties.
- Your data is not used to train AI models, and Harbor does not send your mail to any AI service.
- No person reads your mail except you.
Google user data
Harbor's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Keeping and deleting data
- Disconnecting an account in Harbor deletes that account's stored data immediately.
- You can ask the person who invited you to delete everything in your copy of Harbor.
Revoking access
- Google: Google Account > Security > Third-party access, then remove Harbor. Disconnecting in Harbor also revokes it.
- Microsoft: myaccount.microsoft.com > Apps & permissions, then remove Harbor.
- Zoho: Disconnecting in Harbor revokes its access at Zoho.
Security
You sign in to Harbor with a passkey (Face ID or Touch ID); there is no password. Harbor is only served over HTTPS, and sign-in sessions end after at most 8 hours.
Contact
Questions or requests: the person who invited you.