Where your data sits

Harbor runs on a server in the European Union. The archive for your account stays on that server. It is not shown on the public site.

Signing in sets an httpOnly cookie named harbor_session. The cookie lasts 30 days. Signing out deletes that session. Choosing a new password signs out other sessions as well.

Password reset mail is sent from Harbor <noreply@harbor.gammameon.eu>. The message contains a one-time link that lasts two hours. The page you submit never shows that link, and knowing an email address does not change the password.

Device connections use the provider’s own approval screen. Harbor stores the resulting token on your account so later syncs can run. You can disconnect from Settings.