Haven Privacy Policy

Our promise, in one paragraph

Haven handles some of the most sensitive data a consumer app can hold: your raw, honest reflections during a difficult time. Our design principle is that this content — journals, AI conversations, voice memos, letters, SOS logs — belongs to you and your device. We don't sell it, we don't advertise against it, we don't use it to train AI models, and we make it easy to destroy it completely.

What stays on your device

• Journals, AI companion messages, voice memos, letters, SOS logs, and onboarding answers (text and logs are app-encrypted on your device, keyed to its secure keystore; a voice memo exists only as a temporary file in the app's private storage until you burn it, and chat photos and videos stay in that private storage area, protected by your device's own encryption).
• Anchor contact phone numbers — the SMS composer is prefilled locally; our servers never see them.
• Your archive export (markdown journals and graduation certificate) is assembled entirely on-device.

What leaves your device, and why

• AI Companion: when you send a message, it transits an in-memory proxy to our AI provider, Google Cloud (Vertex AI / Gemini), solely to generate a reply. Along with your message we send the conversation context needed for a coherent reply: your onboarding profile answers (timeline, relationship dynamic, emotional baseline, and goal), recent conversation history, condensed earlier context, and any journal text or attached photo/video content you explicitly choose to discuss. Haven's proxy handles prompts for the current request only and never persists or logs them. Google processes them under Google Cloud's data-processing terms and does not use them to train its models, but Google may temporarily cache or retain content under its own terms, for example for abuse monitoring.
• Account & billing: an anonymous account identifier and entitlement status are stored with our auth service and RevenueCat so your subscription works across devices and reinstalls.
• Diagnostics: scrubbed crash traces and event counts (PostHog / Sentry). Emotional content is never included in logs, crash reports, analytics, push payloads, or URLs.
• AI response reports: when you report a Companion reply from the conversation, we store exactly the content the reporting screen shows you before you send it — the reported response and, only if you switch it on, your single preceding message — linked to your account for review and safety improvements. Reports are kept for up to 90 days and deleted sooner when you delete your account. Nothing else from your conversation is included.
• Notifications: never contain your content (“Your daily anchor is ready”, never anything about your relationship).

Clean Slate — deletion by default

After 365 days of inactivity, your server-side data is automatically purged — a hard delete across databases, billing records, and analytics identifiers. You can also trigger “Erase Everything Now” at any time: your device data is wiped immediately and your server account records are deleted, including deletion requests sent to our purchase and analytics processors (RevenueCat, PostHog). Those processor deletions are queued and retried automatically, so completion can take a short additional period, and records we must retain for legal, accounting, or fraud-prevention purposes are kept only as long as required. The Erase Everything flow confirms on screen when your account records are removed. If you no longer have the app, you can request deletion of your server-side records by email without reinstalling it; because accounts are anonymous, we may need purchase information (such as your store order ID) to locate the records and verify the request, and we cannot retrieve or remotely erase your local journals and conversation history. Our Delete Your Account page explains both options. These flows satisfy Apple's and Google's account-deletion requirements.

Discretion by design

The app uses a neutral name and icon, blurs its snapshot in the app switcher, and offers an optional biometric app lock (Face ID, Touch ID, or fingerprint/face unlock). Nothing about Haven's branding reveals what you're working through. Between 10 PM and 3:30 AM the app also shifts to a quieter, dimmer look for late hours.

Age requirement

Haven is for adults 18 and over and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a child has used Haven, contact us below and we will delete the associated account records.

Contact

Privacy questions, data requests, or deletion requests: jack@hephaestussoft.com.
Hephaestus Soft LLC · 30 N Gould St, Ste N, Sheridan, WY 82801, USA.