Who this notice covers
Harbor provides church management tools. Churches decide which records to enter, who can access them and why they are used. Harbor operates the service and handles account, support and service-security information. For church-managed records, start with your church administrator; you can also reach Harbor at gabe@harborchurchhub.com.
Information handled by Harbor
Google sign-in supplies an account identifier, name and email address. We store church memberships, permissions, invitations and necessary session cookies. Churches and users can provide contact details, household information, photos, volunteer assignments, attendance, group and service plans, giving records, accounting records, staff hours and pay rates, chat messages and files. Church affiliation and pastoral notes may reveal sensitive religious or personal information. Churches should collect only what they need and obtain any required notices and permissions.
When you enable notifications, we store a device push subscription. Hosting services process technical request information, such as IP addresses and errors, to deliver and protect the app. Support emails contain information you choose to send. Harbor does not request Gmail inbox or Google Drive access for sign-in.
How information is used
We use information to authenticate accounts, separate church workspaces, enforce permissions, provide the tools you request, send enabled notifications, answer support requests, investigate problems and recover records. The current app has no advertising tracking or sale-of-data feature. We do not use church records to serve targeted advertising.
Who can access it
Church owners control access. Staff and other users see records allowed by their roles; financial and payroll access is restricted. Members can view their own giving history and manage their own profile. Chat participants can see messages and shared files in rooms they can access. Harbor operators may access information as needed for service operation, support, recovery and legal obligations; we do not promise end-to-end encryption.
Cloudflare hosts the application, database, file storage and backups. Google provides sign-in and Harbor’s support email. Browser push services deliver enabled notifications. Stripe is the planned payment provider; current payment integrations are limited to test mode. If enabled later, Stripe-hosted checkout will collect payment details directly, while Harbor stores billing identifiers and status. We may disclose information when required by law or reasonably necessary to protect users and the service.
Retention and recovery
Church records remain until removed through supported tools or an approved support request, subject to lawful accounting, audit and dispute-retention needs. Some financial history is append-only and requires an operator-reviewed retention process. Daily backup snapshots are configured to expire after 35 days; provider expiration is asynchronous, and backup copies are not individually editable. A recovery must account for deletion requests made after the snapshot. Authentication sessions expire after seven days. Broader retention schedules and export/deletion procedures must be finalized before public launch.
Your choices and requests
You can update your profile, disable notifications in your browser and sign out. Contact your church to correct its records or change access. Contact Harbor to request access, correction, export, deletion or review of a denied request. We verify identity and authority, coordinate with the church where appropriate, and consider applicable law and recordkeeping obligations. Do not send sensitive records as proof in an initial email.
Children and location
The pilot is intended for U.S. churches and adult account users. It is not offered for children under 13 to create their own accounts. Churches may enter family or child records only with appropriate authority and required parental permissions. Contact Harbor about information entered improperly. Hosting and providers may process information in multiple locations; Harbor does not currently promise U.S.-only storage.
Changes and contact
Material changes will be presented before public enrollment. The final notice must identify the operator and applicable rights and procedures. Questions or requests can be sent using this privacy contact link.