Encrypted on your device
Every photo, event, message and list item is encrypted with AES-256-GCM on your phone before it's sent. Our servers store the sealed result, never the means to open it.
Haven · Invite-only preview
Private by design. Yours by default.
A private space to preserve what matters.
Haven brings your photos, calendar, messages and shared lists into one place, and seals every one of them on your own phone before it goes anywhere. Our servers keep only sealed data they can't read. Everything you add belongs to you, and you can remove it whenever you like.
- Refuge
- Belonging
- Protection
- Freedom
What you see
Calendar · Sat 10:00
Soccer game at Riverside Park
Photos · 24 photos
Lake weekend
Messages
Running ten minutes late, save me a seat!
What our server keeps
sealed · 1 KB
q7Zk0dV3mPx2Lr9cWb8tNfY4hJs6GaE1uKoT5iRw
sealed · 4 MB
Xe2Hn8QpLm4Vb7Rt1Cz9Wd3Ks6Fy0Ja5Ug8Nh2Yo
sealed · 512 B
Pb6Tw1Mk9Dq3Zr7Fs2Lx8Hc4Vn0Ge5Ju1Ya6Ri3Qo
Encryption
Sealed on your phone, before it goes anywhere
We've gone to great lengths so the only places your things can be read are your own devices and the devices of the people you choose to share them with. Here's what that takes.
A new key for every photo
Each photo gets its own random 256-bit key. Sharing it shares that key, sealed for the people you chose, so the photo is never opened or uploaded again. Hidden location data is removed before anything is sealed.
Keys that can't be copied
Your device's keys are made inside the browser's own cryptography and marked so they can never be exported. They work on that device and nowhere else. Our servers never hold them.
Unlocked by your passkey
The key that opens Haven on your phone is worked out from your passkey each time you unlock, and never stored. Haven locks when you close it and after five idle minutes, so a lost phone holds nothing anyone can read.
Signing in isn't enough
A new phone or computer gets your keys only when one of your own devices approves it, or with a recovery key that only you hold. Someone who gets into your sign-in account still gets nothing they can read.
Signed by whoever wrote it
Everything is signed by the device that wrote it. Our servers can't forge it, alter it, or quietly make it disappear from your phone.
Less to learn from outside
Sizes are padded, IDs are random, and your calendar's dates never reach us in readable form. Your phone does the searching and sorting itself.
New keys when someone leaves
When someone leaves a shared space, it gets a fresh key. Nothing written after they go can be read by them.
Notifications that say nothing
Alerts arrive saying only "Something new in Haven". The details are filled in on your phone, so they never pass through anyone else's servers in readable form.
In plain sight
What our server can see, and what it can't
We keep a written list of every single thing Haven's servers can see. Adding anything to it needs a stated reason and a review. Here's the short version.
Can see
- That you're a member, who invited you, and the people you've connected with
- Which shared spaces exist and who's in each one
- When something changes, and roughly how big it is
- Which devices you've approved (their names stay sealed)
Never sees
- Your photos, albums or captions
- Your events: their titles, times, places or who's coming
- Your messages
- Your lists, notes and to-dos
- Your keys, at any point
Ownership
Everything you add is yours. Take it back anytime.
From a single photo to a whole calendar, whatever you add to Haven belongs to you. Sharing something lets others see it. It never hands it over.
Shared, never handed over
When you share a photo, an event or a list item, it stays yours. Only you can change it, and only you can delete it.
Delete it everywhere
Delete something and it's gone from our servers and from the phones of everyone you shared it with. All that remains is a small signed note, with no content, saying it was deleted.
Remove everything at once
Erase everything you've ever added in one go, and it's removed from the whole platform: our servers and every phone you shared with. What other people wrote stays theirs.
You decide where it's kept
For each app, choose whether our servers keep an encrypted backup. Turn it off and your things live only on your own phones; the server's copy is removed once every one of your devices has it.
Our servers' own encrypted backups roll off within 30 days, so a removal is complete everywhere within that time. No app can undo a screenshot someone else took.
Inside Haven
The everyday apps, kept private
Haven replaces a handful of apps that each wanted a piece of you. Each person turns on only the ones they want.
Photos
Take, keep and share photos and albums, sealed on your phone and backed up only if you want.
Messages
One-to-one and group conversations, with an optional time limit after which messages are gone from every device.
Calendar
Your calendar and the ones shared with you. New events start private; you choose who else sees each one.
Lists
Shopping, pantry and to-dos you can share. Tick something off and everyone sees it's handled.
Things to do
Find events near you and add them to your calendar. Searches go to the listings service; what you save stays sealed.
People
Invite the people you're close to, show how you're related if you like, and share only what you choose with each of them.
Our Space By invitation
A private corner for partners to plan date nights and play games together, for those who choose it.
Works from your phone, even with no signal
Your phone keeps its own sealed copy of everything, so Haven opens instantly and works offline. Changes sync quietly in the background when you're connected. Add it to your home screen and it feels like any other app.
Where we are
Small on purpose, built carefully
Haven is an invite-only preview. Everyone here was invited by someone they know. There are no ads, and nothing about you is for sale.
- No homemade cryptography. Only standard, published building blocks (X25519, Ed25519, AES-256-GCM, HKDF) running on your browser's own Web Crypto.
- Every decision written down. Each choice about your data is recorded with its reasons before it's built.
- Independent review. Before Haven is trusted with what matters most, its encryption design goes to an independent cryptographer.