Privacy policy

In short

• HarborKey Verify exists to approve sign-ins to your organization. It has no ads, no analytics and no tracking.
• We do not sell, rent or share your information for advertising.
• Your device keys never leave your phone. Your authenticator-app codes stay on your phone.

What stays on your phone

• Device keys. When you add an account, the app creates two signing keys in your phone’s hardware-backed keystore (Secure Enclave on iPhone, Android Keystore / StrongBox on Android). The private keys cannot be exported; only the public keys are sent to your organization’s HarborKey service.
• Account details. The organization name and logo, your username, and identifiers for your device, stored in the platform’s encrypted secure storage on this device only.
• Authenticator codes for other services. If you add a third-party account (a 6-digit code), its secret is stored in the same encrypted secure storage. It is never sent to HarborKey or anyone else.
• Settings such as appearance and notification preferences.

This data is excluded from device backups and device-to-device copies, so it is not restored to another phone. To move to a new phone, use “Move to a new phone” in the app, which creates new keys there. Uninstalling the app deletes it.

Face ID, Touch ID, fingerprint and screen-lock checks are performed by your phone’s operating system. The app only learns whether the check succeeded; your biometric data never reaches the app or HarborKey. The camera is used only to scan setup codes; images are not stored or sent.

What the app sends

The app only talks to the HarborKey service of the organizations you added. It sends:

• Your device’s public keys, a name for the device (for example “Pixel 8”), its platform and app version, and whether its keys are hardware-protected.
• A push notification token from Apple (APNs) or Google (Firebase Cloud Messaging), so the service can tell your phone that a sign-in request is waiting. The notification itself contains only an opaque request identifier, not the sign-in details.
• Requests signed with your device key: fetching pending sign-in requests, and your approve or deny decisions (including “report as suspicious”).

What the app shows you

To help you decide whether a sign-in is really you, a request shows the application, your username, the browser and operating system, a partially masked IP address, an approximate location when one is available, and the time. This comes from your organization’s HarborKey service and is not kept on your phone after you answer.

What the HarborKey service stores

On behalf of your organization, the service stores:

• Your account profile: name, username and email address, provided by your organization or its directory.
• Your sign-in methods: device public keys and device details, your push token (encrypted at rest), and passkeys or other methods you set up.
• Security records: sign-in attempts and decisions, with time, IP address, browser and device, kept in an audit log so your organization can investigate suspicious activity.

Your organization’s administrators can see this information for their own organization. Push notifications are delivered through Apple or Google, which receive the push token and the opaque request identifier only. We do not use any other third parties to process your data.

How information is used

Only to sign you in, protect your account (for example blocking repeated unwanted requests and alerting your organization to reported requests), and operate and secure the service. Not for advertising, profiling or sale.

Keeping and deleting data

• Remove a device: remove the account in the app, from your account’s Security page in a browser, or ask your administrator. The device is revoked at once and can no longer receive or approve requests.
• Delete your account: your organization controls your account. Ask its administrator to deactivate or delete it.
• Security and audit records are kept for as long as your organization needs them for security and compliance. When an organization closes its HarborKey account, its data is deleted after a 30-day recovery window.

For access, correction or deletion requests, contact your organization first. You can also write to us at gplayers@gmail.com and we will work with your organization to respond.

Security

Connections use HTTPS. Every approval is signed by a key that never leaves your phone, and the service checks that signature before it signs anyone in. Organizations’ data is kept separate from each other’s.

Children

HarborKey Verify is a workplace sign-in tool provided through organizations. It is not directed to children under 13, and we do not knowingly collect their data.

Changes to this policy

If we change this policy we will update the date above, and for significant changes we will tell organizations using HarborKey before they take effect.

Contact

wiTech Solutions, operator of HarborKey: gplayers@gmail.com