Privacy policy

Last updated October 5, 2026. Written in plain language.

What we collect

An email address and a password hash when you create an account. API key identifiers and their last used time. A metering record for every tool call, holding the account, the source, the tool name, the outcome and the timestamp. Billing identifiers from Stripe if you subscribe. A delivery record for each account email we send, holding the recipient address, the subject and what the mail provider reported about it. Standard server logs.

If you use the playground, we store your conversations. That means the questions you ask, the answers, and the arguments the model chose to pass to a tool. It does not include the data those tools returned: for the playground we keep the call and drop the payload, the same rule the rest of the product follows. This is the only part of HARBOR Port that holds what you asked for rather than what was called, and it is a change from what this page said before October 5, 2026.

What we deliberately do not collect

We do not store the arguments you pass to a tool, and we do not store the data a source returns to you. Metering records what was called and whether it succeeded, not what you asked for or what you received. We keep the audit row and drop the payload. The first exception is the response cache, which holds upstream responses so they can be served again, and which is never associated with your account. The second is the playground, described above: a tool call you make from your own browser has no API key behind it, so for that path alone we keep the question, the answer and the arguments the model passed. Even there the returned payload is not stored. It is bounded by a switch on each conversation that stops it storing anything, by a limit of your 20 most recent conversations, and by the truncation described below.

Why we collect it

To authenticate you, to enforce the quota your plan provides, to show you your own usage, to bill you correctly, to diagnose faults, and to keep one customer from degrading the service for others.

Cookies

One session cookie, set when you sign in, marked http only and same site. It is required for the dashboard to work. There are no advertising cookies and no third party analytics on this site.

Who else sees it

We do not sell personal data, and we do not share it with the government sources we proxy beyond what is necessary to make an upstream request, which never includes your identity. Six other parties handle data on our behalf, and each one sees only what its job needs.

• Stripe processes payments, so your billing details and email address go to Stripe if you subscribe.
• Our infrastructure provider hosts the servers, so everything stored here is on their hardware.
• Resend delivers our email. Your address and the contents of the message go to Resend, and Resend reports back what happened to each message, which is the delivery record described above. We do not use Resend for marketing.
• OpenRouter routes playground questions to the model that answers them. It sees the question, the conversation so far, and the data the tools returned.
• The model provider receives that same content from OpenRouter and generates the answer. Which company that is depends on the model and on the routing OpenRouter chooses: Poolside for the two Laguna models, and OpenAI or Azure for GPT-6 Luna. The published policies say these providers do not train on prompts sent this way and that they do retain them. We do not currently ask for a zero retention endpoint, so we cannot promise your question is not retained by the model provider. The two Laguna models have no zero retention endpoint available for them at all; GPT-6 Luna does, and routing to it is a choice we have not made. Their terms are at poolside.ai/legal/privacy, openai.com/policies/privacy-policy and microsoft.com/licensing/terms, and the retention figures are published at openrouter.ai/docs/guides/privacy/provider-logging. Do not put anything into a playground question that you would not send to a third party model provider.
• An operator alert channel. Account and system notices reach the operator through a private alerting service. A new signup notice carries the address, and a mail problem notice carries the recipient, the subject and the provider's delivery detail. We deliberately do not include your IP address in these notices. This channel is not enabled on every deployment; when it is off, nothing is sent.

There are no analytics services, no advertising networks, and no third party scripts on this site.

Public records and personal data

Some government sources publish records that contain personal information, such as contact details on award records or named individuals on filings. We suppress those fields at the gateway for the fields we can identify, which covers the structured responses from most sources. The suppression works on named fields in structured data, so it does not reliably catch personal information a source returns inside a block of free text. Treat any record here as a public record that may name somebody.

How long we keep things

Your plan sets how long metering records are kept. The window is stamped when each record is written, not when you read it.

• Free: 90 days of usage history, then deleted. Query the last 30 days.
• Builder: 365 days of usage history, then deleted. Query the last 90 days.
• Team: Usage history is never deleted while your plan is active. Query the last 365 days.
• Enterprise: Usage history is never deleted while your plan is active. Query the last 365 days.

Because the window is stamped when a record is written, changing plan affects new records only. Moving from Builder to Free keeps the 365 day window on the records you already have. Moving from Free to Builder leaves the records from yesterday expiring at 90 days. Records created before we tracked plans per organization were stamped with the plan the account held at that time, so a recently upgraded account's older records may be treated more generously than the list above.

Daily totals outlive the individual records on every plan. When your raw metering records pass their window we keep a per-day count for the day, the source and the tool, with no key, no account and no request detail attached. That is what makes a lifetime total and a multi-year trend possible at all, and it is why your usage page can show a period older than your plan's window. It is a count, not a log: it cannot tell anyone what you asked for.

Delivery records are kept for 180 days, then deleted. They say what the mail provider reported about a message, not what was in it beyond its subject line.

The audit log is kept for 730 days on every plan, including Free. It records account, key and sign-in events. Its window is the same on the cheapest plan as on the most expensive one, and downgrading a plan does not shorten it.

Unverified accounts. An account that never confirms its email address is deleted after 30 days. It is kept if it holds a key, has made a call, is the bootstrap administrator, or shares an organization with another member.

Playground conversations are kept while your account exists, and they are the longest lived thing we hold about your use of the service. We keep your 20 most recent conversations and delete older ones as new ones start, so the limit is a count rather than a period, and a Free account's 90 day window does not apply to them. A conversation you mark as not saved is not written down at all. Each tool result is truncated to 32,768 characters before it is stored, and a single conversation is capped at 262,144 characters.

Account records themselves are kept while the account exists.

Closing your account. Use the contact page and we will close it by hand. There is no self-serve deletion. If you are the only member of your organization, closing your account closes the organization with it, and its keys, its metering records and its daily totals go too. If you share an organization, closing your account removes you from it and leaves the organization working for everyone else, with its keys and its usage records intact, because those are the organization's records and it is still a customer. If you are the last owner of an organization that still has other members, we will ask you to hand ownership to someone else first, because otherwise you would be leaving a team nobody can administer. Playground conversations are deleted with your account, by the same deletion that removes your other records. If you share an organization, closing your account does not hand your conversations to it: they belong to you rather than to the organization, and an organization owner cannot read them at any point while the account exists. Either way your delivery records are deleted with your account, and the audit log is kept for its full 730 days, with your account detached from its rows but the email address on them retained. We keep that because a security record that disappears with the account it names cannot do the job it exists for. We also keep whatever tax and accounting rules require.

Your choices

You can rotate or revoke keys from the dashboard, and see your usage there for as far back as your plan allows. Revoking takes effect immediately. Rotating issues a replacement and keeps the old key working for seven days, so an integration that is already running does not break. For anything else, use the contact page.