1What stays sealed
Haven seals what you add on your own device, before it goes anywhere, with keys only your devices hold. Our server stores the sealed copy and can't open it. Nor can Haven's admins, who hold no keys. Sealed things include:
- your photos, with their albums, titles and dates;
- your events: their titles, times, places, notes and who's coming;
- your messages and what they link to;
- your lists, notes and to-dos;
- your profile picture and details, the names of your devices, and the names of your spaces;
- what you say, choose and play in Our Space.
Photos lose their hidden camera and location data before they're sealed, so it doesn't reach the people you share them with either.
2What our server keeps, and why
Some things can't be sealed, because the server has to act on them: decide who may open what, deliver changes, and send notices. This is all of it. The person who runs Haven can see it too, which is why we keep it this short.
- Your account. The Microsoft account you sign in with (its ID, not its password), and when you signed in.
- The member directory. Your display name, who invited you and the email address the invitation went to, your role, and the relationships you've confirmed with other members (partner, parent, child, sibling or friend).
- The User Agreement you accepted. Which version you agreed to, and when. Only the latest is kept, and only you can see it in Haven.
- Female or male, only if you give it. Some apps use it for their stories. It's shown only to you and to the members of an Our Space you're in.
- Your devices. Each approved device's ID and public keys, its passkey's public key, and when it was last used. Never a private key.
- Spaces. Which shared spaces exist and who is in each.
- When things change. Which space a change was in, which device made it, when, and its size rounded up so it says little. For messages, how many and when, and each conversation's Keep messages setting, so expired messages can be deleted.
- Reminders that fire while Haven is closed. The time only, never what the reminder is about.
- Notifications. The address your browser gave us for sending them.
- Our Space. Which Our Space you're in, whether you've chosen to meet new people, and your token balance and collection, so they can't be faked. It never learns what happened in a game.
- TV screens you pair. The pairing details, deleted when the pairing ends, within 12 hours.
- Logs. IP addresses, browser types and request times, and records of account events such as sign-ins and device approvals. Logs never contain your content. Section 7 says how long each is kept.
3What passes through without being kept
If you subscribe a calendar to an outside feed, our server fetches the feed for your device and passes it straight on. It sees the feed's address only while fetching, and doesn't read, store or log the feed. The address is kept sealed with your calendar.
Haven doesn't send anything to an AI service, an events listing or a map service. If that ever changes, this policy will say so first, and Haven will tell you what's sent when you use it.
4On your devices
Your phone's copy of your data is the main one. Haven keeps it sealed in your browser's storage, under keys that can't be copied out of the device and that open only with your passkey. Haven locks itself when you close it and after five minutes without use.
5Who else is involved
We don't sell, rent or trade anything about you. We don't show ads or use analytics or tracking services. Only these companies are involved:
- Microsoft runs sign-in, so it sees when you sign in. It sends your invitation email, so it has the address it went to. It hosts Haven in Microsoft Azure, where it holds the sealed data and what section 2 lists. It also sends the security email you get if your account is ever recovered on a new device: fixed wording, with open and click tracking turned off.
- Your browser's push service (Apple, Google, Microsoft or Mozilla, depending on your browser) delivers notifications. It sees only that a notice was sent. The notice says something like "Something new in Haven", and your device fills in the rest.
If the law requires us to hand over information, we can give only what we hold: the sealed data, which we can't open, and what section 2 lists.
7How long things are kept
| What | Kept |
|---|---|
| What you add | Until you delete it |
| Messages in a conversation with a Keep messages period | That period, from 7 days to a year |
| Server backups of anything you deleted | Up to 30 days |
| Request logs, with IP addresses | 30 days |
| Performance traces, which hold no content | 14 days |
| Security and audit logs | 1 year |
| Notification addresses | Until you turn notifications off, or 90 days unused |
| TV pairings | Until the pairing ends, within 12 hours |
Erasing everything you wrote is complete once the longest of these windows has passed, at most 30 days. Two things stay: security and audit logs, which are kept for their year and contain no content, and your entry in the member directory, which stays until your membership is removed.
8Your choices and rights
- Delete anything you added, at any time, or erase everything you wrote at once. To leave Haven altogether, ask the person who runs Haven to remove your membership.
- Choose backup for each app. With it off, our server lets go of its copy once all your devices have it.
- Choose how long messages are kept in a conversation.
- Turn notifications off, and remove a device you no longer use.
- See and correct what the member directory holds about you, through the person who runs Haven. They can also give you a copy of everything section 2 lists about you.
Depending on where you live, the law may give you further rights over your personal data. Ask as section 13 says, and we'll honour them.
9Keeping it safe
Sealing on your device is the main protection: data we can't read can't leak from us readable. Haven uses only standard, published cryptography, written down with its reasons before it's built. It hasn't yet been reviewed by an independent cryptographer; that review comes before Haven holds what matters most. Members are alerted to account recoveries, new device approvals and any emergency admin access. Our front page explains the rest.
10Where your data is
Haven's server and its backups are in Microsoft Azure in the eastern United States. Security emails are sent from the United States. Your own copy stays on your devices, wherever you are.
11Age
Haven is for people 18 and older. If we learn that someone younger has joined, we'll remove their account.
12Changes to this policy
A change to this policy comes as a new version of the User Agreement. Haven tells you about it, and asks you to accept it, before it takes effect, and the new version is posted here with a new effective date. We won't start collecting something new without saying so here first.
13Questions
Questions about privacy, and requests about your data, go to the person who runs Haven, through Haven itself. Haven is invite-only, so you already know who that is.