Privacy Policy

Who is responsible

The publisher is DevConcept Venture Lab Bartosz Polak, ul. Romualda Mielczarskiego 121, unit 416, 25-611 Kielce, Poland. For privacy questions, email kontakt@bartoszpolak.pl.

Information you keep in the app

You may record moods, journal entries, reflections, personal tasks, notes, a safety plan, chosen contacts, and preferences. The app stores personal content on your device using local encryption. It does not require a The Haven account, and we do not receive this content through our own server. We cannot read, recover, or delete content that remains only on your device.

Android: local storage, permissions, and purchases

The Android app (package eu.emotis.haven) does not require a The Haven account and does not send your mood records, journal, notes, questionnaire answers, tasks, or safety plan to a publisher-operated server. Personal collections are encrypted locally using AES-GCM with keys protected by Android Keystore. The app excludes its files from Android cloud backup and device-to-device transfer. It does not offer iCloud, Apple Health, Health Connect, or synchronisation with the Apple app. Removing the app or losing its local key can make local records unrecoverable; we cannot restore them.

Optional notifications and biometric access use Android system services. The app does not request microphone, location, or address-book access. Contacts you choose to enter in your safety plan remain part of the locally stored content. We do not use advertising SDKs or analytics to track your use of the self-help tools. Google Play Billing includes technical billing diagnostics sent to Google, such as billing results and errors and technical app/device information, to operate and improve billing. These diagnostics do not include your mood entries, journal or safety plan; Google processes its service information under its own privacy terms.

Google Play processes Android subscriptions and any eligible free trial under Google's terms and privacy policy. The app receives purchase status and purchase tokens through Google Play Billing to verify access, restore purchases, and acknowledge transactions. These are processed on the device and through Google Play; we do not operate a purchase-verification backend. Google may provide the publisher with transaction, sales, and financial reports. We do not receive your payment card details or your private app entries through a purchase.

You may select records to export or share through Android. An export creates a readable file in the app's private cache; files older than 24 hours are cleaned when the export cache is next maintained. Once you save or send a copy to another app or recipient, that copy is controlled by you and the recipient. Deleting an original record does not delete copies you already shared. You can read, export, and delete your own records, and access public help and your safety plan, without an active subscription.

Optional Apple services and permissions — Apple app only

If you choose to use an optional feature, the app may request access to selected Apple Health information, a contact you select, microphone and speech recognition for dictation, or notifications. Health information is shown as personal context and is not used for a diagnosis. Dictation creates an editable text draft; the app does not save the audio. You choose whether to save the text. You can change permissions in your device settings.

If a version of the app offers iCloud sync and you enable it, selected encrypted records may be stored in the private iCloud database associated with your Apple Account to sync your devices. Apple provides that service under its own terms. We do not operate a shared database of your journal or safety plan.

Sharing, export, and purchases

You decide when to export or share information using the app and the system share sheet, and you choose the recipient. A draft message to a trusted contact is sent only if you choose to send it. We do not use your app content for advertising or marketing profiles. Apple processes App Store purchases and provides us with the related sales and financial reports under its own privacy terms; a purchase does not give us access to your private entries.

Support messages and this website

When you contact us, we use the details you provide to answer and resolve your request. Please avoid sending journal entries, health information, or safety-plan details unless they are needed for your question. Support correspondence is kept for as long as needed to handle the request and any applicable legal obligations or claims. You can ask us about or request deletion of correspondence we hold.

These The Haven pages do not set cookies or load analytics or advertising scripts. Our web server records technical request information, including a shortened IP address, requested page, time, and browser information, to deliver and protect the pages. Access logs rotate daily and are retained for about two weeks.

Why we process information and who receives it

We process support correspondence to answer requests and protect our legitimate interests in operating support (GDPR Article 6(1)(f)), and where necessary to meet legal obligations (Article 6(1)(c)). Technical website logs are processed for security and reliable delivery on the basis of those legitimate interests. Our hosting and email providers may process those technical or correspondence details on our behalf. We do not sell personal information.

Keeping, deleting, and controlling your information

Local app content remains on your device until you remove it through the app or delete the app, subject to device backups you control through Apple for the Apple app. Android app files are excluded from automatic backup and device transfer as described above. If you enable iCloud sync, manage its copy separately through the app settings and your Apple Account. Contact us if you need help understanding those controls. The publisher cannot remotely retrieve or erase information held only on your device or in your private iCloud database.

For information we do hold, such as your support email, you may request access, correction, deletion, restriction, or object to processing, as applicable. You may also contact the Polish data protection authority (UODO) or your local supervisory authority. Write to kontakt@bartoszpolak.pl to exercise your rights.

Changes to this policy

We will update this page if the app or our data practices change. The effective date above identifies the current version.