Legal

Data Policy

Effective November 2, 2026

This policy explains what Harbor stores when someone creates a short link, opens one, or signs in to the admin panel. It applies to this installation only. Read it with the Terms of Use. People in the European Union should also read European Union: GDPR.

Who is responsible

The person or organization that hosts this installation decides why the records are kept and how long they stay. Harbor is the tool they use. There is no separate company behind every copy of the software.

Link records

When a short link is created, the service stores:

the destination address
the short alias
an optional title, which is visible only in the admin panel
whether the link is active or paused
whether it was created on the public page or in the admin panel
the time it was created and last updated
a count of clicks

There is no public directory of these links. They are shown in the admin panel to a signed-in administrator.

Click records

When someone opens an active short link, the service shows a waiting page for 20 seconds and stores a private click record. The Get link button appears when the wait ends and opens the saved destination. Signed-in administrators can read:

the time of the visit, kept in UTC and displayed in the time zone chosen in settings
the referring page, when the browser sends one
the browser’s user-agent string, shortened for storage

Those three fields stay in readable form so the operator can review the history. The destination address and the short alias are also stored as written. They are not reduced to a hash.

The visitor’s connection address is handled separately. Before it is saved, the service combines it with a secret kept only on the server and reduces that value to a SHA-512 hash. SHA-512 is a one-way function. The same address produces the same hash on this installation, so repeat visits can be counted together. The admin panel uses the hash to estimate unique visitors. It does not display the address, and it has no function that turns the hash back into the address.

The hash is an estimate of distinct connections. It is not a name, an account, or a way to look up a person. Replacing the server secret, or moving the database to another installation, makes later hashes different from earlier ones.

The service hashes the address of the direct connection. It does not read forwarded-address headers.

Account and settings

The admin sign-in stores a username and a password hash. The password itself is not stored. Settings may include the site name, time zone, an optional public base URL, and whether the public page may create links.

Cookies

The site uses one first-party session cookie, named harbor_session. It is limited to this site, marked HttpOnly, and sent with the Secure flag when the page is served over HTTPS.

On the public page, the cookie supports the form security token, the hourly creation limit, and the short link shown after you create one. Opening a short link does not start a session and does not set that cookie.

In the admin panel, the cookie keeps you signed in. Failed sign-in attempts are counted in the session so the form can pause after repeated failures.

Fonts

Pages load typefaces from Google Fonts. Your browser contacts Google to fetch those files, and Google may receive your IP address and browser details under its own policy. The fonts are used only to display the interface. If that request is blocked, the pages still work with the fonts already on your device.

What this service does not do

It does not sell personal information.
It does not run advertising or a third-party analytics product.
It does not publish a list of short links.
It does not sell the waiting page as an advertisement. The page only counts 20 seconds, then offers Get link.
It does not write the visitor’s connection address in plain text. That value is stored only as the SHA-512 hash described above.

A destination opened by a short link is a separate site. Its operator may collect information under a different policy.

How long records are kept

Link and click records stay until an administrator deletes the link. Deleting a link also deletes its click history. Account and settings records stay for as long as this installation is in use. Server logs, if the host keeps them, are controlled by the host rather than by this policy.

Who can see the records

Signed-in administrators can see link details and the readable parts of click history. They can export links to a CSV file. That file lists aliases, destinations, titles, status, and click totals. It does not include individual visits or SHA-512 visitor hashes. Visitors cannot browse other people’s links. The SHA-512 value is not shown as a readable address.

Security

Admin passwords are stored as password hashes. The password itself is not stored. Visitor connection addresses in click records are stored as SHA-512 hashes, as described under Click records. Time, referrer, user-agent, destination, and alias remain readable for the administrator. Admin forms use a session token. The database and application files are meant to stay outside public browsing. No method of storage is perfect. The operator is responsible for hosting, backups, and who receives an admin password.

Your choices

You can choose not to create a link. You can choose not to open one. If a record concerns you, contact the operator of this installation and ask them to delete the link. Deleting it removes the saved destination and the click history tied to it.

This service is not directed at children, and it does not ask for a name, email address, or date of birth.

When this installation is used to offer the service to people in the European Union or the European Economic Area, Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), applies to the operator. Harbor is the software. It is not a separate controller for each copy.

Controller

The person or organization that hosts this installation is the controller. They decide why the records are kept. This page does not name a company, a postal address, or a data protection officer, because those details belong to the operator of this copy. If the GDPR requires the operator to publish an identity, a contact address, a representative in the Union, or a data protection officer, the operator must add that information. Privacy requests go to that operator.

Personal data in these records

For someone who opens a short link, the service processes the time of the visit, the referring page when the browser sends one, a shortened user-agent string, and a SHA-512 hash of the connection address combined with a secret kept on the server. The plain connection address is not stored. The hash is still treated as personal data. The operator keeps the secret, and the same address produces the same hash on this installation, so the value can single out a connection. The admin panel has no control that turns the hash back into the address.

A destination, alias, or title is personal data when the person who created the link put personal data in it. The admin username is account data for the operator. The session cookie identifies a browser session on this site. The service does not ask visitors for a name, email address, or account.

Why the data is used

The operator is responsible for having a lawful basis. This software is built for these uses:

Creating a short link and redirecting visitors to the saved destination, at the request of the person who submitted it. The basis is steps taken at that person’s request, or the operator’s legitimate interest in running the service they were asked to provide.
Keeping click history, including the SHA-512 hash used to estimate unique visitors. The basis is the operator’s legitimate interest in seeing how the links they publish are used.
The admin session, the sign-in lockout, and the hourly limit on public link creation. The basis is the operator’s legitimate interest in keeping the service secure.

The service does not use these records for advertising, for sale, or for automated decisions that produce legal effects or similarly significant effects.

How long they are kept

Link and click records stay until an administrator deletes the link. Deleting the link deletes the click history tied to it, including the SHA-512 hashes. The operator should delete a record when it is no longer needed for the purpose above. Account and settings records stay while this installation is in use.

Rights

A person in the European Union or the European Economic Area can ask the operator for access, correction, erasure, or restriction, and for a copy of the personal data the operator holds about them. They can object to processing that relies on legitimate interests. They can withdraw from creating or opening links at any time. These requests go to the operator. This installation has no public form for them.

The SHA-512 hash does not contain a name. If the operator cannot tell which records belong to the person who asked, the operator may request more detail or may be unable to complete the request. Deleting a link is the erasure step this software provides: it removes the destination and the click history for that link.

Complaint to an authority

A person may lodge a complaint with a supervisory authority, in particular in the EU member state where they live, where they work, or where the issue happened. The European Data Protection Board publishes the list of those authorities.

Transfers outside the Union

The link and click records stay on the server the operator chooses. If that server is outside the European Economic Area, the records are stored there, and the operator is responsible for a lawful transfer. Pages also ask the browser to load typefaces from Google Fonts. That request can send the connection address and browser details to Google, which may process them outside the European Economic Area under Google’s own terms. Blocking that request leaves the pages usable with the fonts already on the device.

Changes

This policy may be updated by replacing this page. The effective date at the top will change when that happens.

Contact

Privacy questions go to the person or organization that operates this installation of Harbor.