Three, and two of them only if something is true of you.

Stripe — payments

When: only if you pay by card, and only on an instance an operator has configured for card payments. An instance with no Stripe configuration does not contact Stripe at all, and the site asks the server which it is rather than rendering a button that would fail.

What they receive: your card details, your name and billing address as your bank gives them, and the email address you type into Stripe's page for a receipt. You type all of that on a page Stripe serves from Stripe's own origin.

What comes back, and this page understated it until an audit of the schema caught it: the card number never reaches this server and never will. The rest of it does. Stripe's notifications about your payment are stored here verbatim — kept exactly as they arrived so that each one can still be checked against the signature it came with, which is the only way to know a notification was really Stripe's — and a card payment's notification carries what Stripe collected from you: your email address, and depending on what it asked for, your name, your postal address and the card's brand and last four digits. That table is never swept; it grows for the life of the instance. We have no way to send anything to that address, and we hold it. Paying by voucher leaves none of this.

What we send them about you: the plan name, the amount, the interval and an internal account number, twice, so a webhook can be checked against the checkout that started it. Deliberately no username, no product description built from your account, and nothing about your conversations — Stripe knows a plan was bought and nothing about who you talk to.

Google, Mozilla and Apple — browser push

When: only for a user who has turned notifications on, per device. It is opt-in, revocable, and off until somebody asks for it.

What they receive: your device's push endpoint, your IP address, and the exact moment every message arrives for you. Which of the three it is depends on your browser, and it is not a choice we make.

The honest size of it: the payload carries no content and no sender name — that part is real, deliberate and checkable. What it cannot avoid is the delivery itself, which is a per-message activity log about you, held by a company you have no relationship with, that we cannot see into. That is the single worst trade in this product's feature list, and the answer if it matters to you is not to enable push.

The ticket: a notification can still name the sender, because the payload carries a fixed-width opaque handle — a keyed hash of two account numbers the server already holds — that only your own device can turn back into a name. It is the same length for every push, so the push provider learns nothing from the size of a payload it cannot read. The provider is told no name, and neither is the server.

The hosting provider

When: always, for hosted Haven. Their machines hold the database, the encrypted file blobs and the logs, and their network carries every connection. The call relay runs there too, which is why a relayed call does not leave the instance's own infrastructure.

What they receive: physical and infrastructure access to everything the server holds — which is ciphertext for the seven sealed items on the privacy policy and readable for the rest. A hosting provider is in the same position as anybody who takes a copy of the database, and the threat model's first table is written for exactly that adversary.

Which provider, and where: hosted Haven runs on Hetzner Online GmbH, in its Falkenstein and Nuremberg data centres in Germany. A self-hosted instance sits wherever its operator put it, which is why the transfers clause is written the way it is, and on Enterprise the location goes in the contract. What that placement means for a legal demand is on the transparency page.

What runs them. Hetzner states that its data centres run on 100% renewable electricity, hydro-sourced, and says of itself that it is not yet climate-neutral. Both of those are Hetzner's statements, repeated here because they are the only evidence there is; we have measured nothing ourselves. So this page does not call Haven green. What we can say without a certificate behind it is smaller and duller: one server, no video transcoding, no machine-learning inference, no analytics pipeline — the energy a message costs here is the energy of moving a few hundred bytes and writing them once.

Nobody else

No analytics provider, because there is no analytics anywhere in this product. No CDN. No web font host. No tag manager. No session recorder. No error or crash reporter. No customer-support platform. No CRM. No marketing automation. No email service provider — there is nothing for one to send to, since no account carries an address. No data warehouse. No advertising network. Not one of these is "anonymised" or "aggregated"; not one of them is present.