Haven — Privacy Policy
Last updated: 27 August 2026
1. Introduction
This Privacy Policy explains how Atlan Insights AB, org. no. 559425-1398, Brantingsgatan 51, 115 35 Stockholm, Sweden ("Haven", "we", "us") collects, uses, and protects your personal data when you use the Haven meditation and sleep app and related services (the "Service").
Atlan Insights AB is the data controller for the personal data described here. Atlan owns and operates Haven and decides why and how your data is processed. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data-protection law.
About the App Store publisher. Haven is currently distributed through an Apple Developer account held by Kami Ventures AB, which may appear as the developer or seller on the App Store. Kami is the publisher of record only, acting on Atlan's instruction under a written agreement. It does not decide how your data is used and it does not use your data for its own purposes. Atlan remains responsible to you. The app will move to Atlan's own Apple Developer account.
Platform note. Haven is currently available on iOS only, through the Apple App Store. It is not yet available on Android. Where this Policy mentions Google Play, that applies only from the date Haven is actually released on Android. Google Sign-In is available in the iOS app today, so Google may process sign-in data now.
By using the Service you acknowledge this Policy. Where we rely on your consent, we ask for it separately.
2. The personal data we collect
We collect only what we need to run the Service.
2.1 Data you provide
- Account data. When you sign in with Apple or Google, we receive your name and email address (or, with Sign in with Apple, a private relay email if you choose to hide yours). We store a user identifier for your account.
- Communications. If you contact support, we keep your messages and contact details.
2.2 Data created through your use of the Service
- Usage and content data. Your activity in the app — meditations played, sessions completed, your count of nights, favourites, reminder settings, and preferences.
- Subscription and purchase data. Which plan you have, trial status, renewal and cancellation status, and purchase history, received via RevenueCat and the app stores. We do not receive or store your full payment-card details — payments are processed by Apple or Google.
- Optional check-ins. If you choose to record how you slept or how you feel, we store those entries with your account so that you can see your own history, and we look at them in aggregate to understand whether Haven is working and to improve it. We do not share them with anyone, we do not use them to advertise to you, and we do not use them to make claims about what Haven does for people.
2.3 Data collected automatically
- Device and technical data. Device model, operating-system version, app version, language, time zone, and a device/installation identifier, used for delivering the Service, security, and diagnostics.
- Push-notification token. If you enable notifications, we store a push token so we can send reminders (for example, the trial-ending reminder and practice reminders).
- Log data. Basic technical logs generated when the app communicates with our backend.
Haven is a wellness product, not a medical one. Meditating, resting and winding down are ordinary healthy things to do, and using Haven says nothing in itself about anyone's health. We do not ask you for medical information, we do not diagnose anything, and we do not use your activity in the app to infer medical conditions.
Optional check-ins are simple self-reports, not medical records. You can delete them at any time, and deleting your account deletes them with it.
3. How and why we use your data, and our legal bases
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and manage your account; authenticate you | Account, device data | Performance of a contract (Art. 6(1)(b)) |
| Provide the Service — deliver content, save progress and preferences | Usage/content, account, device | Performance of a contract |
| Show you your own check-in history, if you choose to use check-ins | Optional check-in entries | Performance of a contract (Art. 6(1)(b)), at your request |
| Understand in aggregate whether Haven is working, and improve it | Optional check-in entries, usage data | Legitimate interests (Art. 6(1)(f)) |
| Manage subscriptions, trials, renewals, and refunds | Subscription/purchase data | Performance of a contract |
| Send service messages and reminders (incl. trial-ending reminder) | Account, push token, subscription data | Performance of a contract / consent for push notifications |
| Keep the Service secure, prevent fraud and abuse | Device, log data | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and error monitoring; fix bugs, improve and develop the Service | Usage, device, log, and error/exception data | Legitimate interests |
| Comply with legal, accounting, and tax obligations | Purchase, account data | Legal obligation (Art. 6(1)(c)) |
| Marketing communications, if any | Contact data | Consent (Art. 6(1)(a)) — where required |
Aggregated statistics. We may produce and publish aggregated statistics about how Haven is used — for example how many sessions are played — where those statistics are anonymised so that no one, including us, can identify any individual from them. Anonymous statistics of that kind are no longer personal data. We do not use check-in entries to make public claims about what Haven does for people.
Where we rely on legitimate interests, we have balanced those interests against your rights. Where we rely on consent, you may withdraw it at any time without affecting prior processing.
4. Push notifications
If you allow notifications, we use them to send reminders — including any reminder before a free trial ends or a subscription renews, and any wind-down or practice reminders you set. You can turn notifications off at any time in your device settings; doing so may mean you no longer receive trial or renewal reminders. Those reminders are a courtesy rather than a guarantee, and you remain responsible for cancelling in time (see the Terms, Section 4.2).
5. Who we share your data with
We do not sell your personal data. We share it only with service providers ("processors") who process it on our behalf under data-processing agreements, and with the app stores. Our main providers are:
| Provider | Purpose | Notes |
|---|---|---|
| Supabase | Authentication, database, and backend hosting | Stores your account, usage, and preference data. Hosted in the EU (European region). |
| Apple (Sign in with Apple, App Store) | Authentication and payment processing | Governed by Apple's privacy policy. |
| Google (Google Sign-In, Google Play) | Authentication and, once Haven is on Android, payment processing | Governed by Google's privacy policy. Google Play processing does not happen yet — Haven is not available on Android. |
| RevenueCat | Subscription management and purchase status | Receives a user identifier and purchase events. |
| Expo (Expo Application Services) | Delivery of push notifications | Handles push tokens/messages. |
| Cloudflare (R2) | Storage and delivery of audio/media content | Hosted in the EU (European region). |
| Resend | Sending our transactional emails, including trial and renewal reminders | Receives your email address and the content of the message. Processed in the EU (Ireland). |
| Vercel | Hosting of our website/web services | |
| PostHog | Product analytics and error monitoring — understanding how the app is used and diagnosing crashes | Receives usage/event data, device and app identifiers, your user identifier, and technical error details. Hosted in the EU (Frankfurt); PostHog Inc. is US-based. |
| Kami Ventures AB | Holds the Apple Developer account through which Haven is distributed | Publisher of record only, acting on Atlan's instruction. Through App Store Connect it can see Apple's sales, payout and app-analytics reporting, and App Store reviews. It does not receive your account data, your activity in the app, or your contact details from us, and it may not use anything it sees for its own purposes. Sweden. |
How our content is made. Haven's sessions are created using artificial intelligence: OpenAI writes the scripts from generic themes we set, and ElevenLabs produces the spoken narration using synthetic voices. Scripts are written ahead of time on a schedule. Narration audio is either produced ahead of time or generated when you press play, depending on which voice you have chosen.
No personal data is sent to OpenAI or ElevenLabs. The script generation runs from generic themes, not from anything about you. When narration is generated at play time, we send the script text and the voice setting, not your identity, your account, or your activity. On that basis neither provider is a processor of your personal data. We keep this under review, and if that ever changes we will update this Policy and the Sub-processors page.
We may also disclose data where required by law, to enforce our Terms, or in connection with a corporate transaction (e.g. merger or acquisition), in which case we will notify you where required.
6. International data transfers
Your core account, usage, and content data is stored on infrastructure located in the EU/EEA (Supabase and Cloudflare R2, both in a European region). Email sent through Resend is also processed in the EU/EEA (Ireland), and product-analytics and error-monitoring data processed through PostHog is hosted in the EU/EEA (Frankfurt) — although PostHog Inc. is a US-based company, so we rely on Standard Contractual Clauses for it. Some other providers we use — for example RevenueCat, Expo, Vercel, Apple, and Google — may process certain data outside the EU/EEA, including in the United States. Where that happens, we rely on appropriate safeguards under the GDPR — such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can request more information using the contact details below.
7. How long we keep your data
We keep personal data only as long as necessary for the purposes above:
- Account and usage data — for as long as your account is active. When you delete your account, this data is deleted within 30 days, unless we must keep specific items longer to meet a legal obligation.
- Purchase and transaction records — retained as required by Swedish accounting and tax law (generally 7 years).
- Support communications — up to 24 months.
- Logs — up to 90 days.
(Retention periods are our current policy; adjust with your data-protection adviser if your practices differ.)
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict or object to certain processing, including processing based on legitimate interests and any direct marketing;
- data portability — receive your data in a portable format;
- withdraw consent at any time where processing is based on consent.
To exercise any right, contact us at support@gethaven.io. We will respond within one month. You can also delete your account and all associated data directly in the app under Profile → Delete Account.
Right to complain. If you believe we have mishandled your data, you may lodge a complaint with the Swedish data-protection authority, Integritetsskyddsmyndigheten (IMY) — Box 8114, 104 20 Stockholm, www.imy.se — or with the authority in your EU country of residence. We would appreciate the chance to address your concern first.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data without appropriate consent, contact us and we will delete it.
10. Security
We use technical and organisational measures to protect your data, including encryption in transit, access controls, and secure credential storage on your device (Apple Keychain / Android Keystore via secure device storage). No system is completely secure, but we work to protect your information and will notify you and the authorities of a data breach where the law requires.
11. Cookies and our website
The Haven mobile app does not use cookies. Our public website uses only strictly necessary cookies to function; it does not set advertising or analytics cookies. Our internal, staff-only administration area — which you do not access as a user of the Service — uses product-analytics cookies from PostHog. Full details are in our Cookie Policy. If we ever introduce non-essential cookies on the public website, we will ask for your consent first.
12. Changes to this Policy
We may update this Policy. If we make material changes, we will notify you by reasonable means (in-app notice or email) before they take effect. The "Last updated" date above shows the latest revision.
13. Contact
Atlan Insights AB — Data Controller, owner and operator of Haven Brantingsgatan 51, 115 35 Stockholm, Sweden Organisation number: 559425-1398 Privacy enquiries: support@gethaven.io General support: support@gethaven.io
App Store publisher of record: Kami Ventures AB, org. no. 559224-2886, Brantingsgatan 51, 115 35 Stockholm, Sweden. Not a controller of your data. Send all privacy requests to Atlan at the address above.
This Policy should be read together with Haven's Terms of Use.