Skip to content

Privacy Policy

This page explains what harborgovcon.com collects, why it collects it, how long it keeps it, and how to have it deleted. It describes the site as it runs today.

Last updated: October 21, 2026

Who is responsible

HARBOR Initiative LLC, a Texas limited liability company, operates harborgovcon.com and is responsible for the personal information collected through it. Write to privacy@harborgovcon.com for any request under this policy.

What the site does, and what it does not

The site publishes writing about federal productization, offers one free diagnostic (HARBOR Signal), describes fixed-scope engagements, links to the books, and links to HARBOR Port, a separate service at port.harborgovcon.com.

There are no user accounts on this site, no passwords, no dashboard and no saved workspace. No payment is taken here. The books are sold by Amazon, and the engagements are scoped in writing before any invoice. If a paid product is ever opened on this site, this policy will name the payment processor and the data it receives before that product goes live.

Information you give us

  • Contact form. Your name, work email, message, and any optional detail you choose to add: organization, role, whether you work in federal or commercial markets, and an approximate revenue band. We use it to answer you and to prepare for the conversation.
  • Newsletter. Your email address, and the page whose form you used, so we can tell which pages earn subscribers. Every message carries an unsubscribe link.
  • HARBOR Signal. The firm name you enter, a UEI if you supply one, a work email for the report, and your answers to the thirty questions. The federal contract data shown back to you is public: it comes from USASpending and SAM.gov, not from you.
  • Free chapter and launch notifications. Your email address, and which form you used.

Information collected automatically

  • Technical fields on form submissions.When you submit a form, we record your IP address, your browser's user-agent string and, for the contact form, the referring page. These exist for abuse detection. They are erased after 30 days. The submission itself is kept; only those three fields are cleared.
  • Rate-limit counters. To stop automated abuse we store a counter keyed by a hashed form of your IP address, not the address itself. The hash is pseudonymous rather than anonymous: it is keyed with a secret, so it cannot be reversed by guessing, but a party holding the key could test a candidate address against it. Counters are deleted after 24 hours.
  • Analytics. We use Umami, which we self-host at track.harborgovcon.com. It sets no cookies and records pages viewed and links clicked, with no personal identifiers.
  • Diagnostic funnel events. The Signal records which of its own steps were reached, so we can see where it loses people. These are counts of occurrences, not of visitors: no session id, email address, firm name, UEI, IP address or user-agent string is stored with them. One person who reloads and starts again is counted twice rather than recognised.

How we use it

  • To answer you. Arrange a call or a review, and prepare for it.
  • To send what you asked for. The diagnostic report, the free chapter, a launch notification, or the newsletter you opted into.
  • To run the site. Detect abuse, keep the forms working, and understand which pages help.

We do not sell personal information, we do not share it with advertisers, and we do not use it to train a model.

Where it is stored, and who processes it

Data is held in Supabase, a PostgreSQL provider, and the database is hosted in the United States. Data is encrypted in transit and at rest. The processors are:

Cookies and local storage

The site sets no advertising or tracking cookies. The one thing stored in your browser is your light or dark theme preference, in local storage, and clearing it costs you nothing. The analytics tool sets no cookies either.

How long we keep it

  • Form submissions and diagnostic answers: while the inquiry is live, and no longer than 24 months after our last contact, unless the law requires a longer period.
  • Technical fields on submissions (IP address, user agent, referrer): erased after 30 days.
  • Rate-limit counters: deleted after 24 hours.
  • Newsletter addresses: kept until you unsubscribe, then suppressed so you are not mailed again.

Your rights

  • Access: ask for a copy of what we hold about you.
  • Correction: ask us to fix anything wrong or incomplete.
  • Deletion: ask us to delete it. We do, within 30 days, apart from records the law makes us keep.
  • Portability: ask for your data in a machine-readable format.
  • Opt-out: unsubscribe from any email with the link at its foot, or ask us to.

Send any of these to privacy@harborgovcon.com. We answer within 30 days.

Children, security and changes

The site is not directed to children under 13, and we do not knowingly collect their personal information.

If a confirmed security incident affects your personal information, we will tell you without unreasonable delay, consistent with Texas and federal breach-notification law.

We update this policy when the site changes. The date at the top is the date of the last change, and a material change is announced on this page before it takes effect.