Privacy Policy

Haven  ·  Last updated: 4 November 2026  ·  Effective: 30 October 2026  ·  Nederlands

Changed on 1 November 2026: sections 2, 3.3, 3.5, 6 and 7 and the new section 3.7 describe the optional adult-content category and the limit of three devices for Haven Pro Plus (in Haven for Windows from 1.1.0, in Haven for Android from the next app update) and Apps and time (Haven for Android, from the next app update). Until your Haven has them, nothing is processed for them.

Changed on 4 November 2026: sections 2 and 2.1 now also describe notifications and the pause before a route (in Haven for Windows from 1.2.0, in Haven for Android from the next app update). Until your Haven has them, nothing is processed for them.

This Privacy Policy explains how Haven ("Haven", "we", "us") handles your information. Haven is a wellbeing app that helps you stay away from online gambling and take a calmer approach to money. Our guiding principle is simple: we process as little of your data as possible, and as much as we can stays on your device.

Haven is developed and operated by Haven, based in the Netherlands. For any privacy question or request, contact us at privacy@realhavenapp.com.

1. Our privacy philosophy

The core protection in Haven — blocking gambling websites and apps — runs entirely on your device. It does not require an account, and the content you browse is never sent to us. We do not intercept or decrypt your secure (HTTPS) traffic, we do not read the content of the pages you visit off your device, and we do not sell your data or use advertising or third-party tracking SDKs.

2. Data processed only on your device (never sent to us)

The following happens locally and stays local:

  • Gambling blocking (DNS filtering). Haven runs a local VPN service that inspects DNS lookups on your device and blocks gambling-related domains. Your browsing and DNS queries are processed in memory on your device and are not transmitted to us.
  • App and page checks (Accessibility Service). If you enable it, Haven reads the name of the app currently in the foreground and, in known browsers, the visible text of the page, solely to detect gambling. This is processed in memory and never stored or sent anywhere.
  • Apps and time (optional, with Haven Pro Plus). If you block an app or give it a daily limit, the same Accessibility Service uses which app is in the foreground to close a blocked app and, for apps with a limit only, to count today's minutes. Your choices and today's minutes are stored on your phone only; they are not sent to us and not synced with your account. The count starts again at midnight and earlier days are not kept. Haven does not read what is inside these apps.
  • Financial protection layer. A calm pause before banking, payment and crypto apps. It only reads the foreground app's package name, in memory.
  • Notifications (optional, with Haven Pro Plus). If you switch this on and give Haven Notification access in Android's settings, Android hands Haven your notifications. Haven judges only those of messages apps, browsers and gambling apps on its list, and leaves the others alone. The title and text are read locally and in memory, for one decision, and are never stored or sent anywhere. Haven can remove the notification; it has no SMS permission, and the message stays in your messages app. A log on your phone keeps only the source, category, reason and time of a blocked notification, for at most 30 days.
  • Pause before a route (optional, with Haven Pro Plus). If you switch this on, the Accessibility Service reads the name and type of a destination on the screen of Google Maps, before a route starts. This is read locally. Haven uses no location and stores no place and no route, only a count.
  • The adult-content category (optional, with Haven Pro Plus). If it is on, Haven also blocks websites from a list of adult-content domains, in the same way and on your device, on your phone and on your computer. Whether this category is on is stored on your device only and is not synced with your account.
  • Your personal data in the app — your budget entries ("My Balance"), your buddy progress, breathing sessions, your PIN (stored only as a salted hash), and your local activity logs — are stored only on your device.
  • The optional HavenMeds link. If you also use HavenMeds, our medication-reminder app, and switch on sharing there, HavenMeds tells Haven on your phone that you kept to your own plan for a day, or how many days in a row you have done so. Haven uses this only to put a treat in Sam's jar and show a short line on the home screen. Haven never receives any medical information — no medicine names, doses, conditions, measurements, and nothing about a missed dose. This happens between the two apps on your device only: it is not sent to us or anyone else, and you can switch it off in HavenMeds at any time, after which Haven forgets it.

2.1 Haven on your computer (Windows)

Haven for Windows works on your computer itself. What it blocks, the pages you visit, the programs you use and the list of programs installed on your computer never leave your computer, with one exception: if you sign in, your own blocked websites and words and the sites Haven learned sync with your account, as listed below.

  • Name lookups. Haven answers your computer's name lookups itself and blocks risky places before a page can load. Haven does not read encrypted traffic and installs no certificate.
  • The browser extension reads the page you are looking at — its visible text and structure — and hands it to Haven on the same computer, which decides. The extension talks only to Haven on your computer, never to a server.
  • New sites. When your computer opens a website that Haven does not know yet, Haven may fetch that site's front page itself — without cookies, without any account and without anything about you — and judge it on your computer. The page is read in memory only; it is never stored or sent anywhere. The site sees an ordinary visit from your internet connection, like your own visit.
  • The activity list of what Haven blocked is stored on your computer, encrypted, readable only on that computer.
  • Programs. Haven checks which programs start, and can list the programs installed on your computer when you ask it to. That list stays on your computer.
  • Browser settings. To keep browsers from going around Haven, Haven switches off their own encrypted name lookups through the browsers' documented settings. Your browser may then say it is "managed by your organisation". Nothing else is changed, and Haven removes these settings when protection is switched off or Haven is removed.
  • Updates to the blocklist are downloaded from Haven's server and checked against Haven's signature before use. Downloading them sends nothing about you.
  • Your account (optional). If you sign in, the same account as on your phone is used: Pro, your streak, your trusted contact and — only the settings listed below — your settings. Your sign-in is stored encrypted for your Windows user.
  • Settings that sync with your account: language, appearance, your own blocked websites and words, sites Haven learned, the money sites you guard, the waiting period (only ever made longer), and — with Pro — your budget notes. Never synced: switching protection off, your PIN code, the activity list, page text, your installed programs.
  • Trusted contact. If you set one up, Haven's server emails them when protection on your computer is weakened or someone tries to — only what happened and when, never a site, a program, a reason or anything you typed.
  • Notifications (optional, with Haven Pro Plus). To end notifications from blocked sites, Haven reads one browser setting, which sites may send notifications, only while the switch is on, and keeps only the sites it would block. To remove offers, Haven reads the text of browser notifications locally and in memory; it is never stored or sent. Notifications of other programs are not opened. A log on your computer keeps only the source, category, reason and time.
  • Downloading Haven. The Windows installer is downloaded from GitHub (GitHub, Inc.), which handles that download under its own privacy statement. Haven receives nothing about it.
  • No analytics, no crash reports that send data, no advertising.

3. Data we process on our servers (only if you choose to use those features)

3.1 Account (optional)

You can use Haven's protection without an account. If you create one, we process:

  • your email address;
  • your password, stored only as a salted, irreversible hash — your password is never stored or transmitted in plain text;
  • if you sign in with Google, the identity information Google returns (name, email, account id).

Accounts and their data are handled by our processor Supabase. We use this to let you sign in, and to keep your progress and subscription status in sync across sessions and devices.

3.2 Progress and entitlements

When you have an account, your progression (such as streaks, points, level and cosmetic items) and your subscription status are stored server-side so they can't be lost or tampered with.

3.3 Subscriptions

Purchases of Haven Pro Plus are processed by Google Play and by our subscription provider RevenueCat. We receive your purchase and entitlement status (for example, whether your subscription is active) and a purchase identifier. We never receive your card or bank details — those are handled by Google Play. One subscription covers up to three devices; see section 3.7.

3.4 Email messages

If you create an account we may send you a one-time welcome email (transactional). Marketing email is separate and opt-in only: we only send it if you tick the dedicated consent box, and you can withdraw that consent at any time. Email is delivered through our provider Resend.

3.5 Blocklist updates

Haven periodically downloads a cryptographically signed blocklist so it can keep blocking new gambling sites without an app update. These are ordinary network requests; your IP address is visible to the server for the duration of the request, as with any download, and is not used to build a profile of you. The same download also carries the list for the optional adult-content category. Every installation receives it, whether that category is on or off, so the download says nothing about your choice.

3.6 Trusted contact (optional)

If you set up a trusted contact, our server emails that person automatically when your protection is weakened or someone tries to weaken it. This only starts after you have ticked an explicit agreement in the app, listing what is shared, and after the contact has confirmed by a link in an invitation email. For this we process: the contact's name (optional) and email address; the name you chose to be known by; the moment and version of your agreement; events, each consisting only of a type and a time (for example "a request to switch protection off, 29 October, 14:12"); a random identifier for each installation of Haven with its last check-in time and whether protection was on, so a phone that goes silent for 24 hours or a new installation can be reported; and a record of every email sent or attempted.

Events never contain websites, apps, search terms, reasons you typed, your location or financial figures. Every email contains an unsubscribe link; if the contact unsubscribes, no further email is sent and you are told in the app. You can remove or replace the contact at any time; they receive one last email saying so before the change takes effect. Emails are delivered through Resend.

3.7 Your devices for Haven Pro Plus (only if you are signed in)

Haven Pro Plus works on up to three devices per account. To apply that limit, and to show you a list of your devices so you can unlink one, we keep a device list for your account. For each device that has been signed in to your account it holds:

  • a random installation identifier that Haven creates itself (the same one used for the trusted contact) — not a hardware identifier or a phone number, and new after a reinstall;
  • the kind of device: phone, tablet or computer;
  • a device name of at most 60 characters, so you can tell your devices apart: on a phone the name set in Android (or else its make and model), on a computer the Windows computer name;
  • when the device was linked, and when it was last seen (each time Haven starts or you sign in);
  • when a device was unlinked, and when your account last unlinked one, to apply the 7-day wait before a new device can be linked.

The list never contains your location, what a device blocked or what you visited. Signing out does not unlink a device; you can unlink one from any of your signed-in devices. We process this list to provide the subscription you bought (performance of a contract). It is processed by Supabase. How long it is kept is in section 7.

4. What we never do

  • We do not sell or rent your personal data.
  • We do not show ads or embed third-party advertising or analytics trackers.
  • We do not intercept, decrypt or inspect your encrypted traffic.
  • We do not send the content of the websites or apps you use off your device.

5. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing your account and subscription), consent (marketing email; the optional Accessibility features you enable), and our legitimate interest in keeping the service secure and functional. Because a message to your trusted contact can reveal that you use a gambling blocker, which may say something about your health, we process trusted-contact data only on your explicit consent (GDPR Articles 6(1)(a) and 9(2)(a)), which you can withdraw at any time by removing the contact. The contact's own address is processed on their consent, given by confirming the invitation and withdrawn by unsubscribing.

6. Processors and third parties

We share data only with the providers needed to run the features above:

  • Google Play (app distribution and billing) — policy
  • RevenueCat (subscription management) — policy
  • Supabase (accounts, progression, the device list) — policy
  • Resend (transactional and opt-in email) — policy

7. Data retention

On-device data stays until you delete it or uninstall the app. Account and progression data are kept while your account exists; if you ask us to delete your account, we remove your server-side personal data. Subscription records may be retained where required for accounting and legal obligations. Trusted-contact events are deleted after 90 days and the record of sent emails after one year; the contact's details are kept while they are your contact and, after that, only as part of that record. All of it is deleted with your account. The device list (section 3.7) is kept while your account exists. An unlinked device stays on it with the time it was unlinked, so that linking the same device again does not count as a new one. The whole list is deleted with your account.

8. Your rights

Depending on where you live, you have the right to access, correct, delete, export, or restrict the processing of your personal data, and to withdraw consent. To exercise any of these, email privacy@realhavenapp.com. To delete your account and its server-side data, contact us at that address and we will process the deletion.

9. Children

Haven is intended for adults and is not directed to children under the age required to gamble in your country. We do not knowingly collect data from children.

10. Security

We use encryption in transit, hashed passwords and PINs, and signed blocklist updates. No method is perfectly secure, but we design for minimal data and strong defaults.

11. International transfers

Our processors may store or process data outside your country, including outside the EU. Where that happens we rely on the appropriate safeguards offered by those providers.

12. Changes to this policy

We may update this policy. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated in the app.

13. Contact

Haven · Netherlands · privacy@realhavenapp.com