Privacy policy

1. Who we are

Haven is operated by Clint Brady ("Haven", "we", "us"). This policy explains how we collect, use, store and disclose personal information when you use havenwealth.au, the Haven app, Havi and our emails. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Contact our privacy officer: info@havenwealth.au.

2. The information we collect

• Account details: your name, email address, password (stored by our authentication provider in hashed form), sign-in and security records.
• Household and financial records you enter or import: accounts, balances, transactions, budgets, income and pay details, expenses, assets, liabilities, property, mortgages and offsets, investments, superannuation, goals and scenarios.
• Family information you choose to enter, such as household members and childcare details used for childcare subsidy estimates. Only enter information about other people if you have their permission or are responsible for them.
• Subscription details: plan, billing status, and customer and subscription references from Stripe. We do not see or store your full card number.
• Waitlist details: name if provided, email, where you joined, consent date, confirmation and invitation status.
• Support messages and anything you send us.
• Technical information: device and browser type, IP address, pages viewed, and error and audit logs. Our website analytics are cookieless and do not identify you.

We do not ask for your bank login details. Please do not enter your tax file number, passwords, full card numbers or identity documents into Haven.

3. How we collect it

Directly from you when you sign up, use Haven, import files, contact us or join the waitlist; from household members you share a household with; from Stripe about your payments; and automatically when you use our website and app.

You can browse the website and demo without giving us your name. You need an account to use Haven itself.

4. Why we use it

• To provide Haven: budgets, reconciliation, calculations, scenarios, exports and collaboration.
• To manage your account, trial, subscription, referral credits and billing.
• To provide Havi, only where your household owner has consented (see section 6).
• To send account messages, invitations and reminders.
• To send launch and product updates you asked for. Every marketing email has an unsubscribe link.
• To provide support, keep Haven secure, prevent misuse and repeat trials, and fix problems.
• To meet our legal obligations.

We do not sell your personal information and we do not use your financial records for advertising.

5. Household sharing and private accounts

Shared records are visible to authorised members of your household. Accounts marked private, and their transactions, are visible only to their owner in Haven. The household owner controls membership. Our support team can see account and subscription details, but can only see shared financial records if the household owner grants time-limited permission, which excludes private accounts. Our hosting providers have technical access to stored data to run the service; private visibility is an access control within the app, not separate encryption.

6. Havi and AI

Havi is optional and off by default. Your financial records are sent to our AI provider, OpenAI, only after the household owner gives explicit consent and a user asks Havi a question or turns on scheduled Havi check-ins. We send only the information needed to answer the request. Under OpenAI's API terms, data sent to its API is not used to train its models, and it may be kept for up to 30 days for abuse monitoring before deletion.

Havi produces general information only. It does not make decisions about you, approve or refuse anything, or change your records without your action. Its answers can be wrong; check anything important. The household owner can withdraw AI consent at any time in Settings, which stops new information being sent.

7. Who we disclose information to

We use trusted service providers to run Haven. They may only use your information to provide their service to us. - Cloudflare (hosting, storage and security; global network, including Australia and the United States) - Supabase (sign-in and authentication; Singapore) - Stripe (payments; Australia and the United States) - Brevo (email; European Union) and/or Resend (email; United States) - OpenAI (Havi, only with consent; United States) We may also disclose information if required by law, to protect someone's safety, or to professional advisers bound by confidentiality. If Haven's business is sold or restructured, information may transfer to the new operator, who must handle it under this policy.

8. Overseas disclosure

Some providers above store or process information outside Australia, mainly in Singapore, the United States and the European Union. We choose providers with strong security and contractual privacy commitments, but overseas laws may differ from Australian law.

9. Storage, security and retention

Information is encrypted in transit. Access is checked on our servers by household membership, permissions and subscription. Administration requires multi-factor verification and administrative actions are logged. No system is completely secure.

We keep your records while your account exists. When trial or paid access ends, your records stay available to read and export. If you delete a household or account, we delete live records within 30 days. Backup copies held by providers are overwritten under their retention schedules. We keep a minimal hashed record to prevent repeat trials, and billing records for as long as tax law requires (generally five years).

10. Data breaches

If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

11. Access, correction and deletion

You can view, correct and export most of your information in Haven. To ask for a copy of your information, a correction or deletion, email info@havenwealth.au. We will respond within 30 days. We may need to verify your identity. If we refuse a request, we will explain why.

12. Cookies

Haven uses strictly necessary cookies to keep you signed in and, during beta, to remember beta admission for seven days. Optional device notifications need your permission. We do not use advertising cookies. Our analytics do not use cookies.

13. Children

Haven is for people 18 and over. Household owners may enter information about their children, such as childcare details, to use our estimates.

14. Complaints

If you have a privacy concern, email info@havenwealth.au with details. We will acknowledge it within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can contact the OAIC at oaic.gov.au or 1300 363 992.

15. Changes

We will post updates here with a new effective date, and email account holders about significant changes before they apply.

Cookie and storage details

Supabase sign-in cookies and the remembered-device preference keep your session working. The beta admission cookie lasts seven days. Haven also stores appearance and interface preferences on your device and temporary setup progress in session storage. Optional passcode locking uses a secure, short-lived unlock cookie. Optional device notifications use a browser service worker and push subscription. Public website analytics, if configured, use Cloudflare Web Analytics without cookies. Analytics are excluded from the signed-in workspace.

Version history

2026-10-19: policy and terms updated for Haven’s beta, with current contact details and clear AI, subscription and data controls. Earlier notices are retained in the source history.