Haven Vault for macOS

Privacy Policy

Last updated 23 October 2026 (Haven Vault 1.1.5 for iPhone and iPad; Haven Vault 1.1 for Mac)

Who we are

Haven Vault is published by Haven Holding Company L.L.C, Dubai, United Arab Emirates. For any question about this policy, write to mj@haven.app.

What the app collects

Very little, and never your files, your face measurement or what is in your vault. There is no account to create, no sign-in, no advertising identifier and no tracking. Haven never sells or shares data. What can be sent is described below in full: the announcement request, recognition statistics (on unless you switch them off) and email alerts (off unless you switch them on, and only for subscribers).

Recognition statistics

To learn how well recognition works — how often it recognises owners, and how often its alerts turn out to be the owner rather than someone else — Haven Vault sends Haven a small record when an alert happens, when you answer “That was me” or “Someone else”, and once a day a summary of how closely your face matched when Haven recognised you. Each record contains: a random identifier created on your Mac (not linked to your name, email address or Apple account), the app version, the kind of event, where it happened (unlocking, the vault, an open file, Photos or the browser), the match score, the alert level and your answer. It never contains a picture, your face measurement, a file name or anything about your vault.

These statistics are on by default. You can switch them off at any time in Settings › “Share recognition statistics” (also under Activity › Insights); nothing more is sent after that. We keep them to improve recognition and delete them after 24 months.

Email alerts (optional, subscribers only)

If you turn on email alerts in Settings, you give Haven an email address and confirm it with a code. From then on, only for a High alert — when Haven has had a clear, full view of a face that is not yours, held for a moment, while that person tried to open your vault or was in front of something open in it — the picture it kept is sent once, encrypted in transit, to Haven's server, which emails it to that address through our email provider and does not keep it. Haven stores your email address and a record of when alerts were sent, to limit how many can be sent. Turning email alerts off deletes the address from our server. The picture shows whoever was in front of your Mac; use this feature only where you are entitled to photograph people who use your computer.

The one request the app makes to Haven

To show you announcements about the app — a new version, a change to the subscription, a known problem — Haven Vault asks enterprise.haven.app whether there is anything to show, when it starts. The request contains exactly two things: that it is Haven Vault, and which version is installed. It contains no account, no identifier for you or your Mac, nothing about your vault or your face, and no cookies.

Because the request says nothing about who is asking, we cannot send an announcement to one person and we cannot tell whether you read it. Which announcements you have read or dismissed is recorded on your Mac and nowhere else. As with any connection to any website, the request reaches our hosting provider from your network's IP address; we do not use or keep that address to identify anyone, and it is used only to limit abusive volumes of requests.

What the app stores on your Mac

Haven Vault stores the following inside its own application container on your computer. None of it is transmitted anywhere.

• A face measurement. When you enrol, the app measures your face and stores the result as a set of numbers. It is not a photograph and a photograph cannot be reconstructed from it.
• Your vault contents. Files you add are encrypted and stored inside the app's container.
• An activity record. A local log of vault opens, closes and refused access attempts, linked together by a hash chain.
• Evidence images. When access is refused, the app captures an image from the camera and stores it with the corresponding activity entry, so you can see who tried. Marking an alert “That was me” deletes its image. Images stay on your Mac unless you have turned on email alerts (above).
• Photos you import. Imported photos are encrypted into your vault like any file. If you ask Haven to remove the originals from Apple Photos, macOS asks you to allow access to Photos; Haven uses it only to delete the photos you just imported, and never reads your library.

Camera use

Haven Vault requires access to your camera in order to recognise that you are present. Camera frames are processed in memory and discarded immediately. Frames are not recorded, not buffered to disk and not sent anywhere. The only images written to disk are the evidence images described above, and those remain on your Mac.

While the vault is open, Haven keeps checking that you are still there, so the camera stays on and macOS shows its indicator light; when you turn security off, or the vault closes, the camera and the light go off.

Deleting your data

You can erase the activity record from inside the app. Erased entries are recoverable for 30 days and are then permanently removed; a permanent, non-removable entry records that an erase took place, so the record cannot be silently emptied by someone who is not you.

Deleting the app removes its container, and with it your face measurement, your vault contents, your activity record and any evidence images. Because none of this is stored anywhere else, there is nothing for us to delete on your behalf and no request for us to action.

Haven Vault for iPhone and iPad: face recognition

Haven Vault uses the front camera to recognise you, so the vault opens for you and closes when you are not there. Your Haven ID is never signed in to with your face: that uses an emailed code.

• Face measurement. When you enrol, the app measures your face and stores the result on your iPhone or iPad as a set of numbers. It is not a photograph and a photograph cannot be reconstructed from it. Recognition runs entirely on your device. The face measurement is never sent to Haven or to anyone else, including the provider of the recognition technology we license.
• Camera frames. Frames are processed in memory on your device and discarded immediately. They are not recorded and not sent anywhere.
• Evidence images. When someone other than you is in front of the camera while your vault is open, or tries to open it, the app keeps one camera image with that event, encrypted on your device, so you can see what happened. It is never uploaded. If this happens while a photo someone shared with you is open, its owner is told that a possible trust breach happened, with no picture and no identity.
• Your enrolment selfie. During enrolment the app keeps one selfie, encrypted on your device. It is used as your Haven ID profile photo (see Profile photo below) and you can replace it at any time. It is a photograph you can see and change, not your face measurement, and replacing it does not change how the app recognises you.
• Retention and deletion. The face measurement stays on your device until you enrol again (which replaces it), use “Delete Haven ID and erase this vault”, or delete the app, which removes it at once. Evidence images are deleted with their event, with the vault, or with the app.
• Never shared or sold. Face measurements, camera frames and evidence images are never sold, never shared with any third party and never used for advertising.

Haven Vault for iPhone and iPad: accounts and sharing

This section applies only to Haven Vault for iPhone and iPad, which adds an optional Haven ID so you can share with other Haven users. Haven Vault for Mac has no account and none of the below applies to it.

• Haven ID. An @name and an account identifier you choose. No name, email or phone number is required to create one.
• Recovery email (optional). If you add one, it is used only to send a one-time code to recover your @name on a new device. It is not used for marketing and is not shown to other users.
• Profile photo. By default the selfie you take when you enrol; you can replace it at any time. It is shown to other signed-in Haven users (for example when they look up your @name or you share with them), and outside Haven only if you choose to make it public. It is deleted with your Haven ID.
• Profile Photos (only if you add them). Up to a small number of photos you choose to add to your profile. They are public: anyone who finds your @name can see them. We store a separate, resized copy without location or camera details; your original stays on your device. Removing one deletes our copy within about an hour. Nothing is public unless you choose to add it.
• Device public keys. Each phone you use with a Haven ID creates its own keys inside the phone's Secure Enclave. Only the public halves are sent to us, so other people's phones can encrypt for yours. The private keys never leave your phone.
• Shared items. Photos and files you share are encrypted on your device before they leave it. Haven's servers store the encrypted item and, separately, a copy of the encryption key wrapped for each recipient — we cannot read what you share. In the current version, the name of a shared item or album is stored readable alongside it; an upcoming version encrypts names too. When timed sharing is available, we record when each recipient first opens an item so its time limit works; we do not record how often or how long anyone looks.
• Likes and comments. Likes and comments on a shared photo are stored on our servers so they reach the right people. Unlike the photo itself, comment text is not end-to-end encrypted: it is stored readable. Each conversation is private between the owner and the one person it was shared with; if the owner shares the same photo with someone else, that person has a separate conversation and cannot see the first. The owner can remove any comment on their item; the writer can delete their own. Comments and likes are deleted when the item stops being shared, or when the person who wrote them deletes their Haven ID.
• Save permissions and save requests. When you let someone keep a copy (“Keep a Copy”), we store that permission with the share. If someone asks to save one of your photos, we store the request (who asked, for which item, and your answer) until you answer or the share ends. A copy someone has saved with your permission is theirs; taking the share back cannot remove it.
• Usage statistics (iPhone and iPad only; you can switch them off). To improve the app and understand how sharing spreads, the app sends us short usage events: which feature was used (for example "items added to the vault", "a share was sent", "an invite link was opened"), counts, the type of item (photo, video or file), short error codes, the app version and iOS version, and a random install identifier that resets if you reinstall. We link these to your Haven ID so we can see, for example, whether someone who received a share went on to share with others. They never include your photos, files, the names of files or albums, captions, a picture of you, your face measurement or a match score, error messages, your location, or advertising identifiers, and we do not store IP addresses with them. They do record how face checks went (for example that the vault opened or someone else was detected, how long recognition took, and how many faces were in view), and the app checks itself every few days and reports short status codes (for example whether its security keys and notifications are set up). They are not sold, not shared with advertisers and not used to track you across other apps or websites. They are deleted with your Haven ID, and otherwise after 13 months. Turn them off under your profile photo → “Share usage statistics”. When an invite link is opened on our website, we record only that that invite was opened — no cookies, and nothing about the browser.
• Messages. You can message people you are friends with on Haven, about a photo you shared with each other or in a general conversation. Messages are encrypted on your phone before they leave it, separately for each of the recipient's phones and your own; we store them only in encrypted form and cannot read them. To deliver them we do store, readable: who sent each message to whom, when, which shared photo it belongs to (if any), whether it was a view-once message and whether it has been opened. A view-once message cannot be opened again once it has been opened, and is never stored readable on the recipient's phone. When you remove a message, or delete your Haven ID, it disappears from both apps at once; the encrypted copy stays on our servers for 30 days so that abuse can still be reported, and is then deleted. Message notifications never contain what was written.
• Reports. If you report a profile or an item, the report (what was reported, who reported it and, for a reported comment, its text) reaches our moderation team and is kept for as long as needed to act on it and to prevent repeat abuse. Reporting a message works differently, because we cannot read messages: your phone sends us the reported message's text and the key that unlocks it, so a reviewer can check it against the encrypted copy we hold and confirm who sent it. When a message is reported, the encrypted messages exchanged between the two of you in the seven days before it, and the day after, are kept for up to 180 days for the review and any appeal; we only read those if the reporting person or the law requires it, and the person reported is not told who reported them.
• Free Premium days and sharing credits. To give you Premium for your first three days, the 30 days you can earn by inviting someone new, and the free sharing credits in the Free plan, we store: when your Haven ID was activated, when your free Premium days end, which invitation earned them, and a record of credits given and used (when, how many, and for which share). These records are deleted with your Haven ID.

Deleting your Haven ID removes your @name, profile photo, Profile Photos, vault contents, sharing history, messages, comments and likes from the app at once, and the copies on our servers are deleted within about an hour; see Terms for how account deletion and reporting work.

Children

Haven Vault is not directed at children under 13. Haven Vault for Mac collects no data from anyone. Haven Vault for iPhone and iPad collects only what is described above, and we do not knowingly collect it from children under 13. If we learn that a Haven ID belongs to a child under 13, we delete it and its data. Contact us at mj@haven.app if you believe this has happened.

Subscriptions

The Haven Vault subscription is sold and managed entirely by Apple through the App Store. We do not receive your name, email address, Apple ID or payment details. On Mac, the app asks Apple, on your Mac, whether this Apple ID holds a subscription, and nothing about it is sent to Haven. On iPhone and iPad, where your Haven ID's plan decides how much you can share, the app sends us your subscription's original transaction number (an identifier Apple issues for the subscription, which does not identify you or your Apple ID) linked to your Haven ID, so our servers can tell that the account is subscribed. It is deleted with your Haven ID. Sharing-credit packs are also bought through Apple: to add the credits, our server receives Apple's signed record of the purchase (its transaction and product identifiers and date) and stores it with your Haven ID, so each purchase is credited once. When you watch a Haven video to earn credits, we record which video and when, so it pays once. Apple's handling of the transaction is governed by Apple's privacy policy. The subscription terms are at desktop.haven.app/terms.

Changes to this policy

If this policy changes, the revised version will be published on this page with a new date above. If a future version of the app ever collects anything, that change will be stated here plainly and before it ships.

Contact

Haven Holding Company L.L.C · Dubai, United Arab Emirates · mj@haven.app