Privacy Policy.

Stone Harbor exists because men in difficult seasons deserve a private, respectful space. What you write here belongs to you. This policy explains, in plain language, what data we collect, why we collect it, how we use it, who we share it with (almost no one), and the rights you have over it.

Stone Harbor is operated by Stone Harbor. We are the data controller responsible for the personal information described in this policy.

Account information

When you create an account, we collect:

• Your email address and password (hashed and salted, never stored in plain text).
• Your display name and (optionally) a username.
• Your gender attestation (you affirm at signup that you identify as a man).
• The terms version you accepted, the date, the IP address, and the user-agent string of the device.

Profile information

If you choose to fill in your profile, we may collect:

• A profile photo and banner photo.
• A bio, location, hometown, work, education, relationship status, website, languages, interests, and a favorite quote — all optional.
• An optional birthday (month and day stored; year separately optional). Used only for the quiet acknowledgment tile — never to surface your age to other members.
• Your healing stage (Clarity, Calm, or Strength) and privacy preference.

Content you create

• Journal entries (treated as strictly private — see Section 5),
• Member posts and comments in the brotherhood feed,
• Direct messages between you and other members (private),
• Mood logs and roadmap progress markers.

Technical and usage information

• Your IP address, device type, operating system, browser.
• Request logs, authentication events, performance metrics.

Cookies and similar technologies

Stone Harbor uses a small number of cookies and local-storage items that are essential to the Service (an authentication cookie and a session token managed by Supabase Auth). We do not use third-party advertising cookies, behavioral tracking, or cross-site tracking.

What we do NOT collect

We use the data above only to:

• Provide the Service.
• Authenticate you and keep your account secure.
• Send service emails — account confirmation, password reset, terms updates, billing receipts, security alerts.
• Personalize content (daily reflection by pillar, acknowledgment by date).
• Investigate reported Terms violations.
• Operate the moderation system.
• Improve the Service through aggregate, non-identifying analytics.
• Comply with legal obligations.

What we do NOT use your data for

This is the most sensitive content in Stone Harbor, and we treat it as such.

When Stone Harbor may access private content

We may access your journal entries or direct messages only:

• When required by law (valid court order, subpoena, or warrant),
• When necessary to prevent imminent harm to you or another person,
• When necessary to investigate a serious Terms violation that has been formally reported, and only the specific content reasonably relevant,
• When you explicitly request it (e.g., technical support).

Encryption

All journal entries, messages, and other user content are stored in an encrypted database (Supabase, AES-256 at rest). Connections to the Service are protected by TLS 1.2 or higher.

Service providers (subprocessors)

These third parties process data on our behalf, under contractual data protection obligations:

Other members

Information that is public by your settings (profile fields, posts, comments) is visible to other members. Private content (journal, messages, mood data, birthday) is never shared with other members.

Legal and safety circumstances

We may disclose personal information when we reasonably believe it is necessary to comply with law, enforce our Terms, protect safety, or detect fraud.

Business transfers

If Stone Harbor is acquired, merged, or sells substantially all of its assets, your information may be transferred to the acquiring entity, subject to the protections of this policy.

Stone Harbor’s primary data infrastructure (Supabase, Vercel) is hosted in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States.

We keep your information for as long as your account is active. When you close your account:

• Your profile is marked closed and public content is removed from public view immediately.
• Your private journal entries are deleted within 30 days.
• Your direct messages are deleted within 30 days, except where the other party has retained their conversation history.
• Other personal data is deleted or anonymized within 90 days, except where retention is required by law.

Terms acceptance records are retained indefinitely as part of an immutable audit log.

• Access. Request a copy of the personal information we hold about you.
• Correction. Update most information directly from your profile settings.
• Deletion. Close your account from profile settings, or request deletion of specific pieces of content.
• Export.Request a machine-readable export of your data; we’ll provide within 30 days.
• Objection and restriction on certain processing of your data.
• Withdrawing consent at any time by updating your settings.
• Complaints. Contact us first; you may also file with a data protection authority in your jurisdiction.

California (CCPA / CPRA)

California residents have additional rights, including the right to know, the right to delete, the right to correct, the right to opt out of “sales” (we do not sell), and the right to limit the use of sensitive personal information.

Other US states

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comparable laws have similar rights to access, delete, and correct personal information.

Stone Harbor is not directed to anyone under 18 years of age, and we do not knowingly collect personal information from minors. If we learn that we have inadvertently collected information from a minor, we will delete it as soon as practicable.

• Encryption at rest (Supabase, AES-256).
• Encryption in transit (TLS 1.2+).
• Row-level security policies on every database table.
• Hashed and salted passwords.
• Limited access to production systems.
• Audit logging of administrative actions.
• Vetted third-party providers with their own security certifications.

No system is perfectly secure. If you suspect your account has been compromised, contact us immediately.

When we make material changes, we will update the “Last Updated” date, increment the privacy version, and notify members via email and via an in-app prompt requiring re-acceptance.

For privacy questions, requests, or complaints, contact the Stone Harbor team. The contact email is published on the Stone Harbor support page when available.