Privacy Policy

1. Information we handle

• Account and membership details: names, email addresses, password hashes, profile photos, roles, invitations, authentication records, and workspace memberships.
• Workspace content: vessel details and locations, crew and vendor contacts, work orders, maintenance records, documents, photos, chat messages, inventory, expenses, receipts, reports, voyage information, and assistant conversations or saved guidance.
• Billing information: selected plan, customer and subscription identifiers, payment status, and related transaction records. Payment details are collected through Stripe's payment interfaces; do not send card numbers to our support team.
• Technical and support information: IP addresses, browser/device information, request and security logs, error diagnostics, activity records, and messages or attachments you send to support.

Workspace owners and members may provide information about other people. Only upload information you are authorized to share. Files and photos can include personal information or embedded metadata; review them before uploading.

2. How we use information

We use information to authenticate users, enforce workspace permissions, provide vessel workflows, process subscriptions, send account and operational messages, respond to support requests, diagnose problems, prevent abuse, and maintain backups and recovery safeguards. We also use technical information to improve reliability and usability.

We may retain or disclose information when necessary to comply with applicable legal obligations, resolve disputes, or protect the service and its users.

3. Workspace access and service providers

A workspace is a shared environment, not a private personal inbox. Its authorized members can access content according to their roles and vessel permissions. Owners and access managers control membership. Adding a profile photo allows it to appear alongside your activity, including crew chat. Exports and files downloaded by members may remain in their possession.

Harbor Command support and operations personnel may access information as needed for support, security, billing, and service operation. An ordinary customer role does not grant access to unrelated workspaces.

Our service uses providers including Vercel for hosting and file storage, Neon for the production database, Cloudflare R2 for encrypted backup storage, GitHub Actions for backup and recovery processing, Resend for transactional email, and Stripe for billing. These providers process information needed for their services. Requested marine forecast lookups may send relevant coordinates to forecast providers. External websites you choose to visit have their own privacy practices.

We do not sell personal information or share workspace content with advertisers for cross-context behavioral advertising. Sharing within your workspace and processing by our service providers are distinct from selling your information.

4. Assistant conversations and saved guidance

The current work-order assistant uses Harbor Command's application rules to interpret requests and prepare drafts. Conversations and saved guidance are stored with the relevant workspace and vessel. They are not sent to an external language-model provider by the current assistant, and private customer content is not pooled across workspaces to train a shared model.

Forgetting saved guidance removes it from active guidance, but does not rewrite earlier conversations, outputs, or retained backups. Do not put passwords, access codes, or unnecessary sensitive information into the assistant. Any future use materially different from this notice requires an updated disclosure and any consent required by applicable law before that use begins.

5. Cookies and information on your device

We use authentication cookies and browser storage for sessions, preferences, remembered email addresses when selected, app caching, and supported offline work. Locally queued changes may remain on the device until they synchronize or are removed. The public demo uses sample data; photos selected there stay in the demo tab.

Browser settings let you clear cookies and site storage. Doing so can sign you out and remove unsynchronized work, so synchronize needed changes first. Protect shared devices and sign out when finished. Search Console reports about public search visibility are separate from private workspace records.

6. Retention, backups, and deletion

We retain live account and workspace information as needed to provide the service and for the purposes described here. Backup rotation does not remove your live vessel history. Canceling a subscription is not the same as requesting deletion, and we do not promise indefinite archival storage after service ends.

Workspace deletion: the owner must confirm the workspace name after recent sign-in. Once accepted, workspace access is blocked and cleanup is queued. Records and uploads are removed in staged background processing; large inventories or retries can take additional time. Other workspaces are not deleted by that request.

Personal account deletion: this is separate from deleting a workspace. An owner must first resolve the workspaces they own. Deleting an identity does not authorize removal of another owner's shared operational history. Contact support for a request involving personal information in a workspace you do not own.

Recovery copies: our backup policy keeps recovery points for a 14-day window and preserves the latest verified point until a replacement exists. That latest point can be older than 14 days when content does not change. Retention cleanup is staged, so deletion is not an immediate erasure of every backup byte. Recovery safeguards check deletion records and current account/workspace status to prevent deleted subjects from being reopened through a restore.

Limited deletion identifiers, security/audit records, billing records, and information subject to legal obligations or disputes may remain when needed for those purposes. Daily backups cannot guarantee recovery of changes made after the latest successful copy. We cannot remove copies that recipients have independently downloaded.

7. Your choices and requests

You can update available profile fields, manage supported notification preferences, and use account/workspace deletion controls when authorized. Workspace owners manage shared access. Contact support to request access, correction, a copy, or deletion of personal information, or to ask about other rights that apply where you live.

We may verify identity and authority before acting, and may need to coordinate with the workspace owner. Applicable law can provide additional rights or exceptions; we will not treat this notice as a waiver of those rights. Where required, you may complain to your local privacy regulator. If available controls do not address your request, email us rather than sending credentials or payment details.

Where applicable, you may also request restriction of processing or data portability, object to certain processing, or withdraw consent for future consent-based processing. We respond within applicable legal deadlines. Harbor Command is responsible for its account, billing, security, and website processing. For personal information a workspace customer supplies about others, we generally process it on that customer's instructions to deliver the service; the customer is responsible for its own lawful collection and use.

8. Security and processing location

We use measures including server-verified authentication, workspace access controls, encrypted transport, encrypted backup storage, and operational monitoring. No online system, backup, or transmission is guaranteed completely secure or uninterrupted.

Harbor Command is based in the United States. Our providers may process information in the United States and other countries where they operate; protections can differ from those in your country. Contact us about regional requirements before uploading information that requires a specific hosting location or contractual safeguard.

Where applicable privacy law requires a legal basis, we use information as necessary to perform our agreement, meet legal obligations, and pursue legitimate interests such as protecting the service and providing support, subject to your rights. We seek consent where required. International availability is not a promise of local data residency. Where required, applicable transfer safeguards and data-processing arrangements must be in place; contact support to discuss these before providing regulated data.

9. Children

Harbor Command is intended for adult vessel owners and professionals, not children. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information, contact support so we can investigate and take appropriate action.

10. Changes and contact

We will identify the effective date of the published notice and update it when practices change. For material changes, we will provide appropriate notice and obtain consent where required; posting new wording alone does not authorize a previously undisclosed use.

Harbor Command
Miami, Florida, United States
support@harborcommand.app