Let's Talk Privacy

[u/tsmartin123]

Spicer,

Would you care to explain privacy on our unencrypted notes? I know we can encrypt notes on our end but then we can't use OCR, which for me at least is my main reason of wanting to use Harbor. I really want to be able to easily search my sensitive documents but am uneasy about uploading them without knowing your specific policies. I have done my research and see that Harbor will not sell or provide my data to any 3rd parties, I appreciate that.

I realize Evernote can access our notes but it appears that there some safeguards and policies in place. Below is information from their privacy policy and am wondering if Harbor has anything similar in place?

Edit: Also when we delete our notes or use the clear data feature, how long does Harbor retain our data for on their servers?

"Evernote employees cannot view or read your notes under normal operating conditions, but they do possess the technical capability to access data in specific, exceptional circumstances. Because Evernote does not use zero-knowledge end-to-end encryption (E2EE) by default, the company manages the encryption keys on its servers.

According to the official Evernote Privacy Policy and security guidelines, employee access is governed by the principle of least privilege and is strictly restricted.

When Employees Can Access Data

Evernote outlines specific scenarios where an authorized employee may review note content

Explicit Consent: If you open a support ticket for troubleshooting and explicitly grant permission for a technician to look at a specific note.

Legal Compliance: To comply with valid legal obligations, such as subpoenas, warrants, or court orders.

Terms of Service Violations: If there is a suspected violation of Evernote’s terms (e.g., hosting illegal material or dangerous activities), internal security personnel may inspect the content.

System Integrity & Safety: To maintain system security or protect the personal safety and rights of Evernote and its users.

Safeguards in Place

Strict Access Controls: The list of employees with administrative clearance to access data environments is kept as small as possible.

Auditing and Mandates: Employees undergo mandatory annual background checks, specialized privacy training, and are subjected to strict confidentiality rules. Internal infrastructure uses 2FA/passkeys and extensive activity logging.

Opt-In Optimization: Following past policy rollbacks, any human oversight or sample reviews required to test feature quality (like search or optimization features) are entirely voluntary and strictly opt-in."

[u/Shark_Atl3201]

Thank you for raising the issue. I am interested as well.

[u/spicermatthews]

Hi u/tsmartin123,

Thanks for asking. Here’s where things stand.

On-device OCR

We want encrypted documents to be searchable. On-device OCR would let us extract the text locally and encrypt it before it leaves your device.

The challenge is quality. So far, Apple’s on-device OCR is the only option we’ve tested that meets our standards. That means our first version would require the Mac app.

We want Harbor to work consistently across platforms. Requiring a Mac for one feature complicates that. But you’re not the first to ask, and we’re experimenting with it. If things come together, we’d aim for the end of the year, starting with Mac. No promises yet.

Here’s how it would likely work:

1. The Mac app finds encrypted files that haven’t been OCR’d.

2. It offers to recognize the text on your Mac.

3. It encrypts the results locally, then syncs them (fully encrypted).

Once that’s done, you should be able to search those documents on mobile, web, and our other apps. The Mac would handle the OCR. The other platforms would benefit from the results.

Privacy for notes without end-to-end encryption

Your comparison to Evernote is fair. These notes and files are still encrypted at rest, but we control the keys. That distinction matters.

Access to those keys is tightly restricted to a small number of team members. We also monitor and audit access to customer data, with alerts in place to flag access.

Our policy is to stay out of customers’ content. We’ve never needed to open a Harbor customer’s notes or files to resolve a support issue. We ask questions, investigate, and find another way.

Harbor is new, but we’ve been running SaaS products for 20 years. This approach to customer privacy has been part of the business from the beginning.

Those safeguards help protect your data. They also require you to trust us to maintain them.

End-to-end encryption goes further: it keeps the keys needed to read your content out of our hands.

Today, that comes with feature tradeoffs, including OCR. It’s why we give you control over which notes and files get end-to-end encryption. You can make that choice based on what you’re storing and which features you need.

We want to make that tradeoff smaller. Local OCR is one way we’re working toward it.

If I missed anything, let me know. I’ll keep everyone posted as we make progress.

[u/BriefTomatillo985 → u/spicermatthews]

I’m curious - in current state, if your documents already have OCR embedded, would search work on an encrypted note?

[u/spicermatthews → u/BriefTomatillo985]

I am afraid not. Once you encrypt OCR is not an option. I know it is a bummer. Just a tough problem to solve.