Privacy Policy

1. Who operates Haven

Haven is operated by Golden Melodies Music, an independent business based in India that is independently owned and operated and runs Haven remotely. For any privacy question or request, contact us at privacy@goldenmelodiesmusic.com.

2. What this policy covers

This policy covers the Haven app and the account-based services it provides. It does not cover third-party services you may reach through Haven, such as Google or Apple sign-in or the app stores, which have their own privacy policies.

3. Information you provide

Account information

• your name and email address;
• your password, stored only as a secure hash — we never store it in plain text;
• identifiers from Google or Apple if you sign in with them; and
• whether your email address has been verified.

Profile information

Your profile name and an avatar image you upload.

Content you create

• Bible notes, bookmarks and highlights;
• hymns and lyrics you write, including drafts;
• content you submit for review, such as hymn text and audio recordings; and
• feedback and reports you send us.

Preferences

Your app settings, such as reading, notification and playback preferences.

4. Information collected automatically and technically

• your likes and favourites, and the notifications you receive;
• server and security information such as your IP address, device user agent, and request and session timestamps, which we keep in session records and server logs;
• a push notification token and related device information (such as device type or platform), if you enable push notifications;
• your device time zone and app language, which are sent with your requests to localise content and notifications; and
• first-party usage analytics, such as a random installation identifier, device platform, app version, the screens and content items you open, and when you use them. These events do not include your name, email, search text, notes or feedback content.

5. What is stored locally versus on our servers

Stored on our servers when you use an account: your account and profile information; Bible notes, bookmarks and highlights; the hymns and lyrics you write; submissions and their audio; feedback and reports; app settings; likes and favourites; notifications; device or push information; and the first-party usage analytics described in section 4. Some content is also cached on your device for offline use.

Stored only on your device: your reading and listening history (such as recently played music, the last chapter you read, and hymns you opened). This history is not uploaded to or stored on Haven's servers.

6. How we use your information

We use personal information to:

• create and secure your account and sign you in;
• sync your notes, highlights, hymns, preferences and likes across your devices;
• provide content, including hymns and music, and remember where you left off;
• send you service emails such as verification and security notices, and app notifications you have enabled;
• review and moderate submissions, feedback and reports;
• keep the Service safe, prevent abuse and enforce our Terms;
• understand which features and content are used so we can improve the Service; and
• comply with legal obligations.

Legal bases

Where data-protection law such as the GDPR applies, we rely on performance of our contract with you (providing the Service); our legitimate interests (keeping the Service safe, preventing abuse and improving it); your consent (for notifications and other optional features); and compliance with legal obligations.

7. Service providers and processors

We share personal information with service providers that help us run Haven, only as needed to provide the Service. These currently include:

• MySQL — the database we use to store account data;
• Cloudflare R2 — object storage for uploaded files such as avatars, images and audio submissions;
• Resend — email delivery;
• Expo — push notification delivery; and
• Google and Apple — authentication, if you choose to sign in with them.

The API and database run on third-party server infrastructure.

We may also disclose information where required by law, to respond to lawful requests, to protect rights and safety, or as part of a business transfer such as a merger or acquisition. We do not sell your personal information.

8. Authentication providers

You can create an account with an email address and password, or sign in with Google or Apple. If you use Google or Apple sign-in, those providers authenticate you and share limited account information with us (such as an identifier and, depending on your settings, your name and email). Their handling of your information is governed by their own privacy policies.

9. Push notifications

If you enable push notifications, we collect a push notification token for your device so we can deliver them, using Expo as our push provider. You can turn notifications off in the app or in your device settings at any time; we may then stop being able to reach that device.

10. Email delivery

We use Resend to deliver account and security emails, such as verification codes, password-reset messages and email-change notices. These emails are sent to the address associated with your account (or, for an email change, to the new address you are verifying).

11. File storage

Files you upload — such as an avatar, submission images or audio recordings — are stored in Cloudflare R2 object storage and served from public URLs so they can be displayed or played in the app. Please do not upload files containing sensitive personal information that you would not want stored this way.

12. Security practices

We protect your information with measures that include hashing passwords, storing only a hash of refresh tokens, encrypting data in transit, and limiting access to our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Retention

• Account, profile and synced content: kept while your account is active, and deleted when you delete your account.
• Verification and password-reset codes: expire after 10 minutes.
• Refresh tokens and sessions: kept until they expire or are revoked, such as when you sign out or change your password.
• Routine server, security and session logs: kept for about 30 days.
• Usage analytics: raw events are kept for about 30 days, session records for about 90 days, and installation records for about 12 months. Aggregated daily statistics are kept longer without identifiers.
• Backups: kept for about 30 days.
• Device-local history: kept on your device until you clear it or uninstall the app.

Limited information may be kept for longer where required for security, fraud prevention, operational recovery, legal compliance or similar legitimate purposes.

14. Account deletion

You can delete your account from Settings in the app. When you do, we delete your account and the associated stored data, including your profile, settings, verification records, tokens, registered devices, notifications, and user-scoped files such as avatars and uploaded attachments. You can also request deletion by emailing privacy@goldenmelodiesmusic.com.

Deleted data may remain in backups for up to about 30 days before those backups naturally expire. Content you had already published — for example an accepted hymn used in a released recording — may continue to exist where the licence in our Terms allows.

15. Your privacy rights

Depending on where you live, you may have some or all of the following rights: to access your personal information; to correct it; to delete it; to withdraw consent where processing is based on consent; to object to or restrict certain processing; and to data portability where it legally applies. You may also have the right to complain to your local data-protection authority.

To exercise any of these rights, contact us at privacy@goldenmelodiesmusic.com. We may need to verify your identity before acting. You can also update or delete much of your information directly in the app. We have not appointed a formal Data Protection Officer; privacy questions can be directed to the privacy contact above.

16. International processing and transfers

Some of our service providers are located outside India, so your information may be processed in other countries, including the United States. Where required, we take steps to ensure appropriate safeguards for these transfers.

17. Children's privacy

Haven is intended for people aged 13 and over. We do not knowingly permit children under 13 to create accounts or use account-based features, and we do not knowingly collect personal information from them. If we learn that personal information from a child under 13 has been collected in violation of this policy or applicable law, we will take reasonable steps to delete it. If you believe a child under 13 has created an account, please contact privacy@goldenmelodiesmusic.com.

18. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the 'Last updated' date and may notify you in the app. Your continued use of the Service after changes take effect means you accept the updated policy.

19. Contact us