These are the service providers that process personal data to run Harbor, what each one receives, and when. The list is kept in the code and checked against what Harbor actually uses. We update this page at least 30 days before adding or replacing one (see the Data Processing Agreement). Services a creator connects to their own app (for example Slack, Notion or Airtable) act for that creator and are not listed here.
Supabase
Main database (Postgres), including the data Harbor apps store, and Harbor account sign-in.
- When: Always
- Data: Account details (name, email address), Sign-in records, Content and data people store in Harbor and in Harbor apps
- Based in: United States
- Data location: AWS us-west-2 (Oregon, United States)
- Privacy policy · Data processing terms
Railway
Hosts the Harbor website and its server (harbor.it.com).
- When: Always
- Data: Everything sent to Harbor's server: account details, content, and the IP address of each request
- Based in: United States
- Privacy policy · Data processing terms
Cloudflare
Serves every published app, game and website (Workers), stores their files and uploads (R2), runs multiplayer game rooms (Durable Objects), renders pages for search engines (Browser Rendering), receives email for Harbor addresses (Email Routing and Email Workers), connects customers' own domains (Cloudflare for SaaS), and looks up domain records (DNS over HTTPS).
- When: Always
- Data: Visitor IP addresses and request details, Files people upload, Email messages sent to Harbor addresses, Multiplayer game messages
- Based in: United States
- Privacy policy · Data processing terms
Anthropic
The AI (Claude) that builds apps, games and websites, writes listings, powers agents and support chat, and answers the AI features inside Harbor apps (including web search in research mode).
- When: Always
- Data: Prompts and messages people write, App source code and content sent for building or review, Text end users send to AI features in Harbor apps
- Based in: United States
- Privacy policy · Data processing terms
OpenRouter
Routes AI requests to non-Anthropic models. Requests are restricted to upstream providers that do not store or train on the data and keep zero data retention (data_collection: deny, zdr: true).
- When: Only when a Harbor admin selects an OpenRouter model for a task
- Data: Prompts and app source code for the build or task that uses the selected model
- Based in: United States
- Privacy policy
OpenRouter upstream model providers
The company that actually runs the selected model behind OpenRouter (which one depends on the model and on OpenRouter's routing). Only providers with a no-retention, no-training policy are eligible.
- When: Only when a Harbor admin selects an OpenRouter model for a task
- Data: Prompts and app source code for that request
- Privacy policy
OpenAI
Generates game art (sprites, backgrounds) from a text description during a game build.
E2B
Temporary cloud sandboxes where apps and games are built and previewed.
- When: While an app or game is being built, edited or previewed
- Data: App source code and content, Data the app under construction handles in preview
- Privacy policy
Stripe
Takes payments for Harbor plans and credits, and for app owners selling through their apps (Stripe Connect payouts).
- When: When someone pays, or an app owner sets up selling
- Data: Name and email address, Payment details (handled by Stripe; Harbor never sees card numbers), Purchase history, Seller identity and payout details (Connect)
- Based in: United States
- Privacy policy · Data processing terms
Resend
Sends email: Harbor's own messages (sign-in links, receipts, alerts) and the email Harbor apps send their users, including replies from app owners' own domains.
Google
"Sign in with Google".
- When: Only for people who choose to sign in with Google (and only while it is switched on)
- Data: Name and email address from the Google account
- Based in: United States
- Privacy policy
GitHub
"Sign in with GitHub", and pushing an app's source code to the owner's own GitHub repository when they ask.
- When: Only for people who sign in with GitHub or connect GitHub to export code
- Data: GitHub username, name and email address, App source code the owner chooses to push
- Based in: United States
- Privacy policy · Data processing terms
LastLap Analytics
Cookieless visit counting on the Harbor home page, and on Harbor apps whose owner turns it on. Run by LastLap Lab LLC, the same company as Harbor.
- When: Harbor home page; apps only when their owner turns analytics on
- Data: Page-view details, Visitor IP address, as sent by the browser (counted through a visitor hash that changes daily; no cookies; Do Not Track honoured)
- Transfer safeguard: Same company — not a transfer to a third party
- Privacy policy
Bunny Fonts (bunny.net)
Delivers the web fonts a published website uses. No-logging font service.
- When: Published websites whose theme uses a web font
- Data: Visitor IP address (not logged, per Bunny Fonts' policy)
- Based in: Slovenia (EU)
- Privacy policy
thum.io
Takes a screenshot of a published app's public page for its listing picture.
- When: When an app is published or its picture is refreshed
- Data: The public address of the published app (no personal data)