Cookie Policy

1. What Are Cookies

Cookies are small text files that are placed on your computer or mobile device when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners. This policy also covers similar technologies such as browser localStorage and URL parameters.

This Cookie Policy explains how Harbor SEO ("Harbor", "we", "our", "us") — a trading name of Kraft Agency Limited — uses cookies and similar technologies when you visit our website and use our Service.

Section 4 lists every cookie and storage key we set. Section 2 explains how to accept, refuse or change your choices.

2. Your Choices and Consent

The first time you visit our website you will see a cookie banner. It lets you accept or reject cookies by category:

• Strictly necessary — always on. These cookies are required to sign you in, keep your session secure and remember your cookie choices. They cannot be switched off.
• Analytics — off until you turn them on. Product and website analytics, including session replay.
• Marketing — off until you turn them on. Advertising conversion measurement and affiliate attribution.

If you are in the EU/EEA, the UK or Switzerland, no analytics or marketing cookies are loaded until you opt in. Rejecting them is as easy as accepting them, and the Service works normally either way. Where you are outside those regions, analytics and marketing may load by default in line with local law; you can still turn them off at any time using the controls below.

Your choices are recorded in the harbor_cookie_consent cookie and kept for six months, after which we ask again. To change or withdraw your consent at any time, use the "Cookie settings" link in the footer of our website. Withdrawing consent stops further collection through those cookies; it does not affect data collected before you withdrew.

We use a short-lived hb_region cookie to work out which country's consent rules to apply to your visit. It stores a coarse country or region signal only and is not used for analytics, advertising or profiling.

3. Categories of Cookies We Use

3.1 Strictly Necessary

These cookies are required for the Service to function and cannot be disabled. They are set in response to actions you take, such as signing in or choosing your cookie preferences.

Legal basis: necessary to provide the service you requested, so no consent is required.

Duration: from session-only up to 1 year, as listed in section 4.

3.2 Analytics

These cookies help us understand how people find and use Harbor so we can fix problems and improve the product. They include session replay: our product analytics provider, PostHog, records page interactions such as clicks, scrolling and navigation. Form inputs are masked in these recordings, so the text you type into fields is not captured.

Legal basis: your consent.

Duration: up to 1 year (PostHog) and up to 2 years (Google Analytics).

3.3 Marketing

These cookies let us measure which campaigns, ads and partners bring people to Harbor. We use them for attribution and conversion measurement. We do not run retargeting advertising and we do not sell your data to advertisers.

Legal basis: your consent.

Duration: up to 90 days.

4. Cookies and Storage We Use

This is the full list of cookies and browser storage keys Harbor sets:

You can inspect the cookies and storage set on your device at any time using your browser's developer tools.

5. Other Tracking Technologies

5.1 Local Storage

Browser storage mechanisms (localStorage, sessionStorage) let us keep data on your device. We use them to:

• Cache application data so the dashboard loads faster
• Maintain application state between page loads
• Hold PostHog analytics identifiers and session replay state, where you have consented to analytics
• Hold the harbor_utm_* attribution values, where you have consented to marketing

5.2 URL Parameters

Campaign links can carry parameters that tell us where a visit came from — utm_source, utm_medium and utm_campaign for our own attribution, and gclid for Google Ads conversion measurement. These are read from the URL and, where you have consented to marketing, stored in the cookies listed in section 4.

5.3 Software Development Kits (SDKs)

Code packages that run in your browser to provide functionality. We use SDKs for:

• Authentication services (Clerk)
• Backend and real-time data (Convex)
• Product analytics and session replay (PostHog), loaded only after consent
• Analytics and conversion measurement (Google), loaded only after consent

6. Third-Party Cookies

Some cookies listed in section 4 are set by third parties on our behalf. We do not control how those companies operate their own services, so we link their privacy policies below.

7. How to Manage Cookies

You have several options for managing cookies and tracking technologies:

7.1 Harbor Cookie Settings

The quickest route is the "Cookie settings" link in the footer of every page. It reopens the consent banner so you can turn the analytics and marketing categories on or off. Changes take effect immediately and are stored for six months in the harbor_cookie_consent cookie.

7.2 Browser Settings

Most web browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Accept only first-party cookies
• Delete cookies after each session
• Receive notification when cookies are set
• Clear existing cookies

7.3 Opt-Out Tools

You can opt-out of certain tracking using these tools:

• Digital Advertising Alliance Opt-Out
• Network Advertising Initiative Opt-Out
• Your Online Choices (EU)

7.4 Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to be tracked. There is still no uniform standard for how DNT signals should be interpreted, and Harbor does not currently respond to them. Our cookie banner gives you the same control: in the EU/EEA, the UK and Switzerland nothing beyond strictly necessary cookies loads unless you opt in.

7.5 United States Visitors and Global Privacy Control

If you are visiting from outside the EU/EEA, the UK and Switzerland — including from the United States — analytics and marketing cookies load by default, in line with local law. You are still in control:

• The banner on your first visit still offers "Reject all", which turns analytics and marketing cookies off
• The "Cookie settings" link in the footer lets you change that choice at any time, as often as you like
• Refusing changes nothing about how the Service works for you

Unlike Do Not Track, we honour the Global Privacy Control (GPC) signal. If your browser or extension sends GPC, we treat it as a valid opt-out of the "sale" or "sharing" of personal information under US state privacy laws, and marketing cookies are switched off automatically without you having to use the banner.

Your US state privacy rights, and what we do and do not do with advertising cookies, are set out in section 13 of our Privacy Policy.

7.6 Mobile Device Settings

Mobile devices may have settings to limit ad tracking:

• iOS: Settings → Privacy → Tracking → Disable "Allow Apps to Request to Track"
• Android: Settings → Google → Ads → Opt out of Ads Personalization

8. Impact of Refusing or Deleting Cookies

Refusing analytics and marketing cookies does not limit the Service in any way — every feature works the same. What changes is that we see less about how the product is used and cannot tell which campaigns work.

If you block or delete strictly necessary cookies through your browser, however:

• You will not be able to sign in or stay signed in
• Your cookie choices will not be remembered, so the banner will appear again on every visit
• Some parts of the dashboard may not load correctly

Strictly necessary cookies cannot be switched off in our banner because the Service cannot function without them.

9. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, law, our business operations, or other reasons.

When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you through our Service or via email
• Request renewed consent if required by law

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.

10. Contact Us and Complaints

If you have questions about this Cookie Policy or our use of cookies and tracking technologies, please contact us:

Harbor is operated by Kraft Agency Limited, established in Ireland. If you are not satisfied with our response, you can complain to the Irish Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland — www.dataprotection.ie.

If you are elsewhere in the EU or EEA, you may also complain to your own national data protection authority. UK users may contact the Information Commissioner's Office (ICO).

11. Additional Resources

For more information about cookies and how to manage them:

• Data Protection Commission (Ireland)
• UK Information Commissioner's Office - Cookies
• All About Cookies