What data does Haven collect?
Short answer
Haven checks pages and links on your device and sends only security information: hostnames of sites it checks or protects, verdicts, when it paused your other extensions, and your installed extensions. It never sends your browsing history, page contents, keystrokes or passwords.
The short version
A security tool has to look at what you browse in order to warn you about it. The question that matters is what leaves your computer.
The Haven extension checks the pages and links you view on your own device. It does not send Haven your general browsing history, the contents of pages, your keystrokes or your passwords.
What is sent
The extension sends Haven security information only: the hostnames of sites it checks or protects, link and threat verdicts, when it paused your other extensions on a Protected site, threat flags, and an inventory of your installed extensions with their risk details.
While your browser is running, the extension reports once a minute that it is running. Signed out, that report carries only the install ID, Haven's version, whether Haven had your other extensions paused at that moment, and your operating system and browser family.
Email in the browser
Email protection runs in the Haven browser extension on mail you have open; Haven does not sign in to your email account or request access to it.
When you read Gmail or Outlook in the browser while signed in, Haven scores each message on your device and sends only a summary: the sender's domain, a one-way hashed sender key, the domains of the links, and counts and yes/no flags about the message. It does not send any email address, display name, subject line or message text.
Link reputation
When Haven checks a link's reputation with its reputation provider, alphaMountain, it sends only the link's hostname: no path, no query string and no user identifier.
Who processes it
Haven's service providers are Google Cloud Platform (hosting, databases, analytics, key management), Google Firebase (sign-in), alphaMountain (link reputation), Stripe (billing) and Mailgun (email). Card details are handled by Stripe and are not stored by Haven.
Haven does not sell personal information and does not share it for cross-context behavioral advertising.
At work
If your organization runs Haven, its owners and admins see security reports.
A Haven organization's owners and admins can see security reporting about members: which protected sites they visited, link checks and phishing warnings with their verdicts, when Haven paused their extensions on Protected sites, paused downloads, how many Haven installs they run, and their installed extensions with a risk assessment. They can't see members' general browsing history, page contents, keystrokes, passwords or form data.
Haven for Gmail is different
Haven for Gmail is a separate, opt-in service with its own answer. See the related question on how it handles your email.
Where to read the detail
The privacy policy sets out what each Haven product collects, and it's the document to rely on over any summary, this one included.
How Haven handles this
- The Haven extension checks the pages and links you view on your own device. It does not send Haven your general browsing history, the contents of pages, your keystrokes or your passwords.Verified by engineering October 28, 2026
- The extension sends Haven security information only: the hostnames of sites it checks or protects, link and threat verdicts, when it paused your other extensions on a Protected site, threat flags, and an inventory of your installed extensions with their risk details. Hostnames, not full web addresses. The extension inventory is sent only while you are signed in.Verified by engineering October 29, 2026
- While your browser is running, the extension reports once a minute that it is running. Signed out, that report carries only the install ID, Haven's version, whether Haven had your other extensions paused at that moment, and your operating system and browser family. Signed in, it also carries browser and system details and the extension inventory. Your email address is never in it: your sign-in identifies the account.Verified by engineering October 29, 2026
- Email protection runs in the Haven browser extension on mail you have open; Haven does not sign in to your email account or request access to it. Haven for Gmail is a separate, opt-in service that does connect to your mailbox.Verified by engineering October 29, 2026
- When you read Gmail or Outlook in the browser while signed in, Haven scores each message on your device and sends only a summary: the sender's domain, a one-way hashed sender key, the domains of the links, and counts and yes/no flags about the message. It does not send any email address, display name, subject line or message text. The hashed sender key is made with a secret that never leaves your device, so it can't be turned back into an address or matched across installs. Signed-out installs send no email summary.Verified by engineering October 28, 2026
- When Haven checks a link's reputation with its reputation provider, alphaMountain, it sends only the link's hostname: no path, no query string and no user identifier. Reputation checks are made for signed-in users only.Verified by engineering October 28, 2026
- Haven's service providers are Google Cloud Platform (hosting, databases, analytics, key management), Google Firebase (sign-in), alphaMountain (link reputation), Stripe (billing) and Mailgun (email). Card details are handled by Stripe and are not stored by Haven.Verified by engineering October 28, 2026
- Haven does not sell personal information and does not share it for cross-context behavioral advertising.Verified by engineering October 28, 2026
- A Haven organization's owners and admins can see security reporting about members: which protected sites they visited, link checks and phishing warnings with their verdicts, when Haven paused their extensions on Protected sites, paused downloads, how many Haven installs they run, and their installed extensions with a risk assessment. They can't see members' general browsing history, page contents, keystrokes, passwords or form data. The install count is a number only; admins see no identifier for any one install. The reporting is coarse telemetry, such as a site name, a category and a verdict.Verified by engineering October 29, 2026