Privacy Policy

Last updated: 12 November 2026

Haven is a private vault for photos, videos and files, made by KRL Apps (“we”, “us”), who is responsible for the data described here. Privacy is the point of the app, so we collect as little as we can, and anything you keep in Haven is end-to-end encrypted whenever it leaves your device.

On this page

• On your device
• Haven Cloud
• Your keys
• Backing up in the background
• Server logs
• Purchases
• Ads
• Services we use
• Why we may use data
• How long we keep data
• Requests from authorities
• Your rights
• Children
• Changes and contact

On your device

Everything you put in Haven (photos, videos, files, folders, Hidden, Recently Deleted and your settings) is stored on your device, in Haven’s private storage, encrypted by iOS or Android. It doesn’t appear in Photos, your gallery or the Files app unless you export it.

• Haven passcode and decoy passcode: kept only as a salted hash in the device’s Keychain (iOS) or Android Keystore-backed storage. Face ID, Touch ID and fingerprints are checked by the system; Haven never receives them.
• Break-in alerts: the time of each wrong passcode and the front-camera photo are kept inside Haven on your device.
• Camera and photo library: the camera is used for photos and videos you take in Haven, to scan the code that opens your backup on another device, and for break-in photos. Photo library access is used to import and, if you choose, to delete the originals after an import.
• Wi-Fi Transfer and USB Transfer work only between your device and your own computer, over your local network or a cable. Nothing goes through our servers.
• Backup files are encrypted with a password you choose and saved wherever you put them. If you turn on Remember Password, the password is kept in your iCloud Keychain or Google account (below), not with us.

The decoy vault never connects to Haven Cloud.

Haven Cloud (optional)

Haven Cloud backs up your vault and syncs it across your devices. Each file is encrypted on your device with its own random key (AES-256-GCM) before it is uploaded. File contents, names, folders, dates and thumbnails are all encrypted. The keys that open them exist only on your devices, so we cannot see or recover your files.

To run Haven Cloud we store:

• Your account, through Google Firebase Authentication: your email address, an account ID, and the ways you sign in (Sign in with Apple, Google, or a link sent to your email). If you sign in with Apple and hide your email, we get Apple’s relay address. Firebase may also keep the name and profile photo address that your Apple or Google account shares.
• Your encrypted files and thumbnails on Backblaze B2, in data centers in the United States. They are stored under random IDs, with no names.
• An encrypted index on Google Cloud (Firestore, Belgium): for each file, its encrypted details and encrypted key, its encrypted size, when it was added or changed, and whether it’s in the cloud trash. For your account: your plan, total storage used, the number of files, and a copy of your key encrypted with your recovery key, which we can’t open.

Haven Cloud’s server runs on Google Cloud Run in Belgium. Your device uploads and downloads encrypted files directly to and from Backblaze B2 with short-lived links our server signs.

Your keys, and getting them to a new device

Your vault key never reaches us in a form we can use, with one exception you choose (Recover with Haven, below). These are the ways a new device can get it:

• Keep the key in iCloud Keychain or your Google account (on by default, can be turned off). The key is saved in Apple’s or Google’s synced, end-to-end encrypted storage (iCloud Keychain on iOS, Block Store on Android), under your own Apple or Google account, so your other devices can open your backup. It is never sent to us.
• Use Another Device. The new device shows a code; a device that has the key scans it and encrypts the key to the new device. Our server only relays that encrypted message and can’t read it. It is deleted when the new device picks it up and is never usable after 10 minutes. We keep the session’s random ID, your account ID and times until our cleanup removes the record.
• Recovery key. Shown to you once when you set up Haven Cloud. We never receive it.
• Recovery code + Haven (optional, off by default). Your key is split into three parts, and any two open it. One part stays on your device (or your iCloud Keychain / Google account), one is a recovery code you keep, and one is stored on our server. Our part alone reveals nothing about your key. Turning this off deletes our part.
• Recover with Haven (optional, off by default). When you turn it on, your device encrypts your key to a key of ours that is held in a hardware security module in Google Cloud Key Management Service (Belgium) and can’t be taken out of it. Our server can unwrap your key only to finish a recovery: someone signed in to your account asks for it, it is confirmed through a link Firebase sends to your account’s email address, and then there is a 7-day wait that any of your signed-in devices can cancel. Only after those 7 days does the server unwrap the key and send it, encrypted to the requesting device. While Recover with Haven is on, we are technically able to unlock your vault key; that is the trade-off for being able to recover without any of your devices or codes. Turning it off deletes the encrypted copy and any recovery in progress.

If you lose your key and none of these is available, nobody can open your backup, including us.

Backing up in the background

Haven keeps uploading after you leave the app, as far as iOS and Android allow. It sends the same encrypted data as when the app is open, and nothing else.

• iOS: uploads continue through the system’s background transfers and scheduled background tasks. So that they can finish without the app open, a sign-in refresh token and a list of pending uploads (IDs, sizes and encrypted details, no names) are kept on the device, in its Keychain and Haven’s own storage.
• Android: backups run through the system’s WorkManager. A long backup shows a silent “Backing Up…” notification while it runs.

Server logs

When your device talks to Haven Cloud, Google Cloud records basic information about each request (IP address, time, the address requested, the response and its timing) for security and troubleshooting. Request contents are not logged, so keys, encrypted data, recovery codes and transfer messages never appear in logs. We also count requests per account to limit abuse.

To check that requests come from the genuine Haven app on a real device, Haven uses Firebase App Check, which asks Apple (App Attest or DeviceCheck) or Google (Play Integrity) to vouch for the app. These checks confirm the app and device are genuine; they don’t identify you or reveal anything you keep in Haven.

Firebase sends the sign-in emails and, for Recover with Haven, the confirmation emails. We don’t run our own mail service and don’t send marketing email.

Purchases

Payments are handled by Apple (App Store) or Google (Google Play); we never see your payment details. We use RevenueCat to know which plan your account has, across your devices and stores. RevenueCat receives your purchase and subscription history for Haven from Apple or Google, your Haven account ID (or a random ID, if you buy before signing in), and basic device and app information its software sends, such as the store country, app version and IP address. See RevenueCat’s privacy policy.

Ads (free version)

The free version shows ads from Google AdMob. Haven asks Google for non-personalized ads only: ads are not chosen based on your past behavior, and Haven doesn’t ask iOS for permission to track you. Google still processes some device information (such as IP address, device type, and on Android the advertising ID) to show ads, limit how often you see them, measure them and prevent fraud, and may use cookies or similar identifiers for that, as described in how Google uses information from apps that use its services. On Android you can reset or delete the advertising ID in your phone’s settings. Haven Pro and Remove Ads turn the ads off.

Crash reports

When Haven crashes or hits an unexpected error, the app sends a crash report to Sentry, so we can find and fix the bug. A report contains where in Haven’s code the error happened, the app version, and technical details such as the phone model, operating system version and free memory. It doesn’t contain your files, file or folder names, account, email, IP address or device name: Haven removes paths and names from error messages before sending, Sentry removes them again on arrival, and Haven doesn’t record what you did before the error. Reports are stored by Sentry in the European Union. See Sentry’s privacy policy.

What we don’t do

• No analytics, no tracking SDKs, no advertising profiles.
• We never sell your data or share it for advertising.
• We don’t look at your files, and Haven Cloud is built so that we can’t.

Services we use

Where data goes outside the European Economic Area, it is covered by these providers’ data processing terms, including the EU Standard Contractual Clauses or the EU–US Data Privacy Framework where it applies. Your files stay end-to-end encrypted wherever they are stored.

Why we may use data (legal bases)

• To provide Haven Cloud and your purchases (performance of our contract with you): your account, encrypted files and index, plan status.
• To keep the service secure and working (our legitimate interest): server logs, rate limits, the cloud trash, crash reports.
• To show ads in the free version (our legitimate interest in offering a free version, and your consent where the law requires it).
• To meet legal obligations, such as keeping purchase records.

How long we keep data

• Cloud files you delete go to the cloud trash for 30 days, then are deleted for good.
• Deleting your account (Settings → Haven Cloud → Delete Account) deletes your cloud files, your index, your plan record and your account right away. Files on your device are not affected.
• When a plan ends, your files stay in Haven Cloud for 30 days and can still be downloaded; after that they are deleted from Haven Cloud (your account stays, and files on your devices are not touched).
• When you store more than your plan allows, you have 30 days to free up space or choose a bigger plan; after that, files are deleted from Haven Cloud until the account fits its plan (the cloud trash first, then the most recently uploaded files). Files on your devices are not touched.
• Server logs are kept for 30 days.
• Crash reports are deleted by Sentry after 90 days at most.
• Unfinished uploads are cancelled and removed after 24 hours; transfer sessions are removed shortly after they expire; a recovery request ends when it’s cancelled or completed, or 7 days after it became ready.
• Purchase records are kept by Apple, Google and RevenueCat as the law requires.

Requests from authorities

We answer only requests that are valid under the law that applies to us. What we could provide is what we hold: your email address, account ID, sign-in methods, plan, the number of files, their encrypted sizes and timestamps, and the encrypted data itself, which we can’t decrypt. If you have turned on Recover with Haven, an encrypted copy of your key exists as described above.

Your rights

You can see your cloud storage and delete files, or your whole account, in the app at any time. Under the GDPR and similar laws you can also ask us for a copy of the data we hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable form. Write to us at the address below. You can also complain to your local data protection authority, or to Lithuania’s State Data Protection Inspectorate (vdai.lrv.lt).

Children

Haven is not meant for children under 13, or under the age set by law in your country for using such services without a parent’s consent, and we don’t knowingly collect their data.

Changes and contact

If this policy changes, we’ll update this page and the date above, and tell you in the app about important changes.

Questions or requests: privacy@havenvault.app (KRL Apps).