Privacy Policy

Your Harbor belongs to you

MendHarbor uses secure sign-in for identity. Harbor records—including memorials, messages, stories, memories, reflections, preferences, and Beacon history—are stored in owner-scoped Supabase Postgres tables. Authenticated users can read only records belonging to their own account.

Private files and device copies

Photos, recordings, videos, and documents are stored in a private Supabase Storage bucket. They are not public by default and are opened using short-lived signed links after ownership is checked.

MendHarbor keeps a limited device copy for draft recovery and continuity when a connection is interrupted. The cloud record is authoritative. Signing into the same account on another supported browser or device loads the same securely saved Harbor.

Optional personalized Beacons

Personalized Beacons may use an external AI provider only after you select that preference and explicitly request a Beacon. Limited Harbor information may be securely processed to generate personalized Beacon reflections: the Beacon category, an optional first name and relationship, selected non-sensitive themes, page context, and a small number of recent Beacon texts to reduce repetition.

Your message text, memories, ReMENDering entries, uploads, email address, and authentication data are not sent for Beacon generation. Generated Beacons may be held temporarily in a server-memory cache for up to 24 hours to reduce repeated processing and cost. AI-generated Beacons never create or alter your saved memories. Classic Beacons remain available without AI personalization.

Beacon feedback

If you rate a Beacon, MendHarbor records the rating together with the Beacon text, its category, and whether it came from AI, the curated library, or the safety fallback library. If you select “Not for me,” you may optionally share a reason or comment. Your private message to your loved one is not included in Beacon feedback.

Beacon feedback is used to review quality and improve future reflections. Optional comments may contain sensitive information and are available only within restricted administrative review. A rating may be changed; changing it to “Helpful” removes any earlier reason and comment attached to that rating.

Deletion and current limits

Deleting a memory or memorial removes its database records and associated private files. Deleting a Harbor removes the Harbor and its owner-scoped content while leaving the sign-in account in place. Backup retention, self-service export, and formal recovery windows still require final policy approval before public beta.