Privacy
What we keep, and for how long.
Requesting a berth
When you request a berth we store the name, email address, organization, and note you give us, which products you asked about, and a one-way hash of your network address used only to slow down abuse. We email you once to confirm the address is yours. Nothing is shown to anyone until you've done that.
Requests we decline, and requests never confirmed, are deleted after ninety days. Requests we approve become an account; the details then live with that account until it's closed.
Notes from the yard
If you leave an email address in the box on the front page we store that address, the time, and the same one-way hash of your network address. We send one email asking you to confirm; until you do, the address isn't on any list, and it's deleted after seven days. Confirmed addresses are used only to send notes from the yard, which are rare, and are removed on request. Each note, and how many addresses received it, is kept in the admin history.
Reports
When you ask for one of our reports we store your name, email address, organization, the role you give us, whether you ticked the box for notes from the yard, which page sent you to us, and the same one-way hash of your network address. We use them to send the report and to follow up about it. The download link we mail is good for 14 days, and we record when the file is downloaded and how many times.
If the link is never used, your details are deleted 30 days after we sent it. Once you have downloaded the report they stay for two years, or until you ask us to remove them. If you ticked the box for notes, your first download confirms the address for that list, and it is then kept as described above.
Your content stays yours
Every conversation, file, skill, goal and preference in Harbor belongs to one account and is only ever shown to that account. Personal skills and memories never enter another person's prompts. The only shared material is skills an Officer has explicitly published for the crew.
We do not train models on your content. Your conversations are sent to the model providers we run, to answer you, and nowhere else.
Activity is logged. Sign-ins, tool approvals, permission changes, and administrative actions are written to an append-only audit trail, so both you and we can see what happened to your account. Accounts that put the platform or other people at risk can be disabled without notice.
Usage records
To show you your allowances, and to keep the platform fair and within budget, Harbor counts what each account uses: for every hour, per model and kind of work, how many replies and agent runs, how many tokens went in and out, how many runs failed, and how quickly replies started. These are counts and timings only. No prompt, reply, file name or tool argument is ever part of a usage record.
You can see your own records under Your usage, signed in with the same Shipwright account you use for Harbor, and download them as a spreadsheet. Officers see the same figures for everyone, plus an estimate of what the models cost to run; nobody else sees them. When an account is deleted, its usage records are detached from it and remain only as anonymous totals.
Signing in here sets one cookie, which holds a random session number and nothing else. It lasts twelve hours and ends when you sign out.
Retention
| What | How long |
|---|---|
| Your conversations, files, and skills | Until you delete them. Deleted conversations can be restored for 30 days, then everything under them is erased. |
| Uploads (images, documents) | Erased with the conversation that referenced them, on the same 30-day schedule. |
| Data exports you request | Download link for 24 hours, then the archive is deleted. |
| Guest accounts | Disabled after 90 days without a sign-in; erased 90 days after that. Crew and Officer accounts do not idle out. |
| Deleted accounts | Content is trashed the moment you confirm. Rows, workspaces and uploads are erased on the next hourly sweep. |
| Berth requests we decline or that go unconfirmed | Ninety days. |
| Notes from the yard (the email box on the front page) | Unconfirmed addresses are deleted after seven days. Confirmed addresses stay until you ask us to remove them. Each note we send, and how many addresses received it, stays in the admin history. |
| Report requests (the form on each report's page) | Deleted 30 days after the link was sent when it is never used. Kept for two years after a download, or until you ask us to remove them. |
| Usage records (counts and timings, per hour) | 35 days at hourly detail, then folded into daily totals kept for 400 days. Deleting your account detaches them from you. |
| Sign-in sessions on this site | Twelve hours, or until you sign out or your account is disabled. |
| Server logs (request lines, errors) | Ninety days. |
| Visit counts (per hour, no addresses) | 35 days at hourly detail, then folded into daily totals kept for 400 days. The one-way hash used to count a visitor is deleted the day after. |
| Page engagement (how long a page stayed open, how far it was scrolled, which buttons were pressed) | One day for the visit, then daily totals kept for 400 days. The script stays quiet when the browser asks not to be tracked. |
| Location and network owner (country, region, city, and the network's name) | 35 days at hourly detail, then daily totals kept for 400 days. The network address is never stored. |
| Security and audit events (sign-ins, permission changes, admin actions) | 365 days, then archived to an encrypted export we control. |
Your rights, self-service
In Harbor, open Account. Export my data builds a zip of your profile, conversations, workspace files, uploads and skills; the link is shown to you (and emailed, when mail is configured) and works for 24 hours. Delete my account asks you to type DELETE, trashes all your content immediately, and then hands you to the sign-in service to confirm the deletion there too. You don't have to ask anyone.
Terms of use
These are the terms every account accepts on first sign-in (the same text is shown by the sign-in service). Harbor is a small, invitation-only alpha; using it means you agree to them.
- Keep secrets and other people's data out. Don't paste passwords, API keys, private keys, or personal data about other people into Harbor. Anything you type may be sent to a model provider to answer you.
- No illegal, abusive, or deceptive use. No malware, harassment, fraud, attacks on this or any other system, and no attempts to reach other people's accounts or content.
- Activity is logged. Sign-ins, tool approvals, permission changes, and administrative actions are written to an append-only audit trail. Outbound requests made by tools on your behalf are checked and recorded.
- Your content stays yours and is not used for training. We don't train models on your conversations or files, and we don't show them to other users.
- Allowances apply. Each tier has usage limits. When you reach one, Harbor slows down or says so; it never bills you.
- You can leave with your data. Account › Export my data gives you a zip of everything you own; Delete my account erases it. You don't have to ask anyone.
- Accounts can be disabled without notice when they put the platform, its models or other people at risk, or after long inactivity on a Guest berth.
Where it lives
Harbor runs on hardware we operate. Databases and uploads sit on an encrypted drive with encrypted nightly backups. Sign-in is handled by our own identity service; passwords are stored only there, hashed. Secrets are never stored in the tables that hold your content.
No advertising pixels and no third-party trackers. One small script of our own reports how long a page stayed open, how far it was scrolled, and which of our buttons were pressed. It sends that to this site only, and it stays quiet when your browser asks not to be tracked. The only outside service that loads here is Cloudflare's bot check on the request form, the report forms and the email box.
The server records the country, region and city of the network address, and the name of the network's owner, such as a company, a hospital, or an internet provider. It records them as hourly totals and never stores the address. It also counts which page was served, which site sent the visitor, a phone or a desk, and the name of a crawler when one asks. A visitor is counted for one day with a one-way hash of the network address, and that hash is deleted the next day.
Questions or removal requests: access@shipwrightcode.ai.