Every number, and where it comes from.

The Free tier's 90 days deletes our copy, not yours

After 90 days the server deletes its copy of a message. It is a cost limit — storage is the expensive part of hosting this — and not a privacy feature in disguise. It uses the same mechanism as disappearing messages and carries the same limit every such feature has anywhere: it cannot reach a device that already synced the plaintext. If a phone downloaded the message, the message is on that phone.

Seat minimums are billed as minimums

Team and Business bill from 3 seats and Enterprise from 50, so a two-person team on Team pays for three: $71.91 a month, not $47.94. That's what "minimum 3 seats" means, and quietly charging for fewer would make the quoted price wrong right up until an invoice said otherwise.

Paying by card puts your real name on this account. A voucher does not.

This is the deanonymiser people miss. Every claim on this site is about what the server can read; none of it survives a card statement that ties a legal identity, a billing address and a bank to a Haven username. If your adversary can reach a payment processor — and a well-resourced one can — then the strongest thing we could hand them is not the ciphertext, it is the invoice. Pay by card and this account is named.

The voucher path is the answer to that, and it is built. A voucher is a 24-character prepaid code that buys a set number of months on a set plan. An operator mints it; you buy it from them however you and they agree — cash, a bank transfer, Monero, through a reseller who never tells us who you are; and you redeem it in the app against an account that was never asked for an email address. Redeeming one creates no payment-processor record of any kind: no customer row, no network call to anybody, and nothing that would tell Stripe this account exists.

How you get one today, stated plainly rather than dressed up: this website cannot sell you a voucher. There is no self-serve voucher shop and this page is not going to imply there is. You ask us for one, we agree how you are paying and how the code should reach you, an operator mints it, and it is sent the way you asked. The code's plaintext is shown to that operator exactly once and only a one-way hash is stored, so nobody — including us — can recover it afterwards. Quote its first four characters if you ever need us to find it; never send anybody the whole thing.

The exact size of the anonymity, because a claim with no limits stated is worth nothing. One column records that this account redeemed this code — the server has to know whether a code has been spent — and it is disclosed on your own data panel rather than hidden. So the unlinkability is between Haven and the buyer, and it only holds if the code changed hands somewhere we cannot see. Buy a voucher from us by card, in your own name, and we can join the two ends ourselves. Bitcoin has the caveat it always has: a public ledger is not anonymity, and a chain-analysis firm is exactly the sort of adversary this page is about. Cash by post and Monero do not have that problem. Mullvad has run this set for years, and it is where the design came from.

We cannot email you about your bill, and that can cost you the account

Haven holds no email address for any account, because there is no column to hold one — users.email was dropped from the schema. That is the property the rest of this site is proud of, and this is its bill. There is no receipt from us, no renewal reminder, no card-expiring warning, no dunning email and no notice before a plan lapses. There is also no password reset, and never could be.

Stripe may send a receipt to the address you typed into Stripe's page. That is Stripe's record and Stripe's message, and it is the only email connected to this service that anybody sends. We do hold that address. Stripe's notifications are stored on this server verbatim, so that each one can still be checked against the signature it arrived with, and a card payment's notification contains what you gave Stripe on its page. We have no way to send to it. A voucher-paid plan leaves no such record at all — which is the difference the voucher path buys.

So the account page in the app is the only place any of this appears. If a card expires, nothing reaches you: the subscription goes past due and free limits start applying to new activity until it is settled — nothing is deleted, and the refunds page says exactly what does and does not happen then. Check the account page, or pay yearly, or use a voucher whose length you chose on purpose. A customer who assumes an email is coming will not get one.

Storage is for encrypted attachments

The quota covers the encrypted file blobs we hold. It exists because without a per-account limit one account can fill a disk and take the database — and everyone else on that instance — down with it. The tradeoff is real: an upload that would cross the limit is refused rather than silently accepted.

A retention policy is a deletion tool, not a surveillance one

On Business and Enterprise, the person who owns the subscription can set how long the server keeps its copy of messages, choosing from a fixed menu of windows rather than typing a number — the difference between 30 days and 3 is somebody's quarter of a year. It cannot be used to read anything: the server holds ciphertext and no admin here has ever been able to decrypt it. The only thing it does is delete sooner.

Two limits worth knowing before you buy it. It removes our copy, on the same mechanism as disappearing messages and with the same caveat — it cannot reach a device that already synced the plaintext. And it only takes effect in conversations where every participant is under a window of their own, with the longest of those windows winning: one person on a plan that keeps history forever, and that conversation is left alone. Deleting history somebody else was promised is not a trade we make.