How to use Haven.

An overview of Haven

Haven scans the accounts and devices you connect, surfaces anything that looks sensitive, and gives you one-click ways to deal with it. The whole loop is: connect your accounts → Haven scans → you review findings → you remediate.

1. Connect your accounts

Open the Connectors page from the sidebar and add the sources you want Haven to watch. You can connect as many as you like:

• Email — Gmail, Outlook & Hotmail (outlook.com, hotmail.com, live.com, and Microsoft 365), Proton Mail, and Yahoo Mail and AOL Mail. Yahoo and AOL don’t offer a sign-in button to apps like Haven, so you connect them with an app password: create one in your Yahoo or AOL account security settings (the app links you there) and paste it in. You can revoke it from the same page at any time.
• Cloud storage — Google Drive, OneDrive, and Dropbox.
• This device — pick a folder and Haven scans the files on your own computer.
• iMessage — on Mac, Haven can scan your local Messages history.

Google and Microsoft each use a single sign-in that covers both their email and their cloud storage, so you only grant access once per account. Dropbox is its own sign-in, and Haven asks it for file names, paths and sharing settings only — never permission to read what is inside your files. You can connect more than one account of the same kind — several Gmail or Outlook mailboxes, say — and Haven keeps each one's findings labeled and filterable separately. Haven asks for the permissions it needs to read and (when you choose to act) tidy up — nothing more.

2. Haven scans

Scanning starts as soon as a source is connected. A first deep scan of a large mailbox can take a while, so Haven looks at the highest-signal items first — you'll usually have real findings to look at within the first minute or two, while the rest fills in.

Detection runs in three layers: fast pattern-matching and a local machine-learning classifier both run entirely on your device. For the small number of items that need a closer look, a short, bounded excerpt may be checked against Haven's own zero-retention service — it's never kept, and your content never goes to a third-party AI provider. You can see exactly what left the device on the Logging page.

Running scans on your terms

You don't have to wait for the background scanner. On the Connectors page, every connector — and each connected account — has its own controls:

• Scan now — check a source for anything new since the last pass. This is a quick, incremental scan.
• Rescan all — start over from a clean slate. Haven clears that account's existing findings, then re-scans the whole mailbox or drive from scratch with the current detection logic. This is the one to use after a Haven update improves detection, so older items get re-checked too. Because it clears findings first, Haven asks you to confirm.
• Stop scanning — halt a scan that's in progress; anything already found is kept.

On a Mac, the iMessage connector has its own Re-scan from the beginning, which walks your full message history again. The Overview, Findings, and Sharing audit pages also carry a Scan now / Re-scan shortcut that drops you straight onto your connectors.

Experimental detectors (iMessage)

On Mac, the iMessage connector offers two detectors for the kind of private content that's most damaging if a device is lost, stolen, or used for extortion. Both are on by default, marked Beta, and live under Experimental detectors on the connector — turn either off per connector if you don't want Haven to look for it:

• Detect intimate content — flags sexually explicit messages (text only) so you can decide what to keep. Intimate conversations sitting in cloud-backed threads are a common target in device theft and extortion.
• Detect explicit photos — checks image attachments for sexually explicit photos. Because this needs more compute than a laptop has, each image is scored by an image-safety classifier on Haven's own GPU — sent over TLS, held in memory, never written to disk or logged — then you review and clean up the matches.

In both cases, content involving minors is never flagged. These detectors only ever look at the iMessage history you've already connected, and you can switch them back off at any time.

3. Review and remediate

The Overview page is your home base: your posture score and how it's moving, a summary of findings by severity, and the status of each connected source. From there you'll spend most of your time on three pages — Findings, Sharing audit, and Remediations — each covered below.

Your posture score

The number at the top of the Overview is a single 0–100 summary of how exposed your connected accounts are right now — and, more usefully, which direction it's heading.

How it's calculated

Every finding Haven still considers open counts against the score, weighted by severity: a critical finding costs far more than a low one. That total is then measured against the size of everything Haven scanned, not taken as a raw count.

That last part matters. A fifteen-year-old mailbox with 140,000 messages will always contain more findings in absolute terms than an account opened last month. Scoring on raw counts would tell the person with the most history that they're the most careless, which isn't true and isn't useful. The score asks a fairer question: of everything you have, how much is exposed?

Three things the score always does

• Connecting a new account never drops it. New sources set a new starting point rather than punishing you for looking. When it happens, the chart marks the moment as baseline moved and your score holds steady — then climbs as you clear things. Software that scored you lower every time you used more of it would be teaching you not to use it.
• Remediating moves it up straight away — the moment you act, not at the next scan.
• Telling Haven something is normal for you moves it up too. If you've said a finding isn't a concern, the score agrees with you instead of arguing.

If a new account turns out to be tidier than what you already had, the score is allowed to rise on its own merit — the protection above stops it falling, not from reflecting genuine good news.

Reading the trend

• The trend chip under the score sums up the last week in plain English — "Up 4 points this week."
• The sparkline plots the last 90 days, with a dashed marker anywhere your baseline moved.
• Since last month breaks the change into what actually happened: findings resolved, new findings, the net movement, and which source improved most.

Small wins won't always shift the numeral — clearing one low-severity finding out of a hundred thousand items is a real improvement but a tiny fraction of a point. That's why the panel reports what you did alongside what the number did. A score that jumped on every click would be a progress bar, not a measurement.

Reviewing your findings

A finding is a single item Haven thinks may contain sensitive information — one email, one file, or one message. The Findings page lists them all so you can work through them.

Severity

Every finding is rated so you can triage at a glance:

• Critical and High — the things most worth handling first, like a plaintext password or an exposed account number.
• Medium and Low — worth knowing about, lower urgency.

Finding your way around the list

• Search the list, or use Add filter to narrow by severity, source, or account.
• Switch between a flat list (sorted by severity) and a by-folder view that groups findings by their folder path — handy for cloud-drive results.
• Select multiple findings with the checkboxes to act on them together.

Opening a finding

Click any row to open the detail panel. It tells you what you need to decide without ever quoting your content back at you:

• Why this matters — a plain-language explanation of the risk.
• What we found — a redacted preview, so you can confirm it's real without exposing the value to anyone looking over your shoulder.
• Details — context like sender, recipients, date, file path, or who a file is shared with, depending on the source.
• View in… — a button that opens the original item in Gmail, Outlook, Drive, OneDrive, Dropbox, Messages, or your file explorer.

From the same panel you can take an action (see Remediations) or tell Haven it got something wrong.

Teaching Haven what's normal for you

Two verdict buttons let you correct a finding and quiet similar ones in the future:

• This is a false positive — the item isn't actually sensitive. Haven stops flagging that pattern.
• This is fine — it's normal for me — the item is sensitive but expected (it's part of your normal workflow). Haven learns the context and stops nagging you about look-alikes.

Anything you've quieted this way can be reviewed and undone later under Settings → Your context.

Ask Haven Beta

Ask Haven lets you ask about your exposure in plain language — "where are my tax documents?", "what's exposed externally?", "any old passwords in my inbox?" — and get back the findings that match.

Search, not a chatbot

Ask Haven is search over your findings, not a generative assistant. Your question is interpreted on your device and run against the same index Haven built while scanning. Nothing is sent anywhere to answer it, and — like the rest of Haven — it reads your findings, never the contents of your messages.

Asking a question

• Open Ask Haven from the sidebar and type your question the way you'd say it out loud.
• Or tap one of the suggested questions to start — your most sensitive findings, what's shared externally, where particular kinds of documents live, and so on.
• Results come back as the same finding rows you see on the Findings page. Open any one for the full detail panel, or act on it with a remediation (see Remediations).

What it can answer

Ask Haven is good at narrowing your findings down by the things Haven already knows about them:

• By kind — passwords and credentials, tax documents, IDs, financial info, and the other categories Haven detects.
• By source — a particular place or account, like Gmail, Drive, or your local files.
• By exposure — what's shared publicly or with people outside your accounts.
• By rank — your most sensitive findings, or the top few worth handling first.

What it won't do

Because Haven keeps a record that a finding exists — not a copy of what it says — Ask Haven is honest about its limits instead of guessing:

• It can't tell you what a message says. Haven doesn't store your message text, so it points you to the original to read it yourself.
• It can't filter by who sent or received something — there's no contact graph behind your findings. Filter by kind or source instead.
• Posture questions — how you're doing overall, or how your exposure is trending — are answered by your posture score on the Overview, not here.

The sharing audit

The Sharing audit page focuses on one specific risk: files in Google Drive, OneDrive, and Dropbox that are shared more widely than you probably remember.

What it flags

• Files set to anyone with the link or otherwise reachable on the public web.
• Files shared domain-wide across an organization.
• Files shared directly with people outside your own accounts or organization.
• Stale external collaborators — outside people who still have access long after they needed it. Drive and OneDrive only: Dropbox does not report when a share was last used, and Haven would rather say nothing than guess at how stale a grant is.

Haven knows the difference between sharing inside your own organization and sharing with outsiders, so routine collaboration with colleagues on the same work domain doesn't clutter the audit — the focus stays on files reaching people beyond your accounts. Personal mailboxes like Gmail or iCloud are always treated as external, since two people on the same provider aren't the same organization.

Two ways to look at it

The audit has a toggle in the top corner, because there are really two different questions here.

• By file — the default. Each entry shows the file, the folder it lives in, and exactly who can reach it: a named list of people, or "Public via link." It uses the same list, search, and filter controls as the Findings page, so you can sort by exposure and work through the riskiest files first.
• By recipient — the same sharing, organised by who. One row per person or link, with how many of your files they can reach and the worst severity among them. Open a row to see the files.

A file list is the right shape for handling one thing at a time. It's the wrong shape for "wait — how much does this one person still have?", which is the question that actually comes up when a contract ends, a job changes, or a relationship does. That's what the recipient view is for.

Links and domain-wide grants get their own rows at the top, ahead of individual people — an open link is usually the widest exposure you have, so it shouldn't be buried alphabetically among your collaborators. Above the list, a simple map connects recipients on the left to the files they can reach on the right. If you have a lot of recipients, Haven shows the most-exposed and tells you plainly how many more there are.

Fixing it

Open any entry to inspect it, jump to the file's sharing settings with View in Drive / OneDrive / Dropbox, or fix it on the spot with Revoke link — which removes the over-broad sharing permission. You can also select several files and revoke them in one go.

From the recipient view there's one more: Revoke everything shared with this person, which removes that one person's access across every file they can reach. It removes only them — other collaborators on the same files keep their access. If a revoke fails on one file the others still go through and Haven tells you which didn't. As with any sharing revoke, undo restores the finding but not the share itself — see Remediations.

Taking action — and undoing it

A remediation is any action you take on a finding. Haven's promise is simple: every action is reversible for 30 days, so you never have to be afraid to click.

What you can do

The available action depends on where the finding lives:

• Archive — for Gmail and Outlook, moves the message out of your active inbox while keeping a copy in your archive.
• Move to trash — for Gmail and Outlook, sends the message to Trash. It's never hard-deleted, and it stays recoverable for 30 days — both from Haven and from your mail provider's own Trash.
• Add a sensitive label — for Gmail and Outlook, tags the message so it's easy to find later, without moving or hiding it.
• Revoke link — for Drive, OneDrive, and Dropbox, removes the public or external sharing permission.
• Mark as resolved (also shown as Mark as handled) — records that you've dealt with a finding yourself and hides it from your dashboard, without Haven changing anything on the account. Use this for things that get fixed elsewhere too — an exposed API key or password you need to rotate — once you've made the change.

When a finding is a login or password sitting in an email, Haven also offers to save it to a password manager — 1Password, Bitwarden, or LastPass — and then archive the original, so the credential ends up somewhere safe instead of in your inbox.

When you've selected several findings, the same actions are available in bulk from the toolbar.

The Remediations page

Every action you take is logged on the Remediations page (in the sidebar), with a timestamp, the connector, and whether it succeeded. Right after you act, a banner with an Undo button appears; for the next 30 days you can reverse any remediation from this log and Haven will restore the finding.

Trace Beta

A Trace gathers everything tied to one chapter of your life — a person, a project, a period, a topic — across the accounts you've connected, so you can review it as one cluster and secure it in one pass.

Describe the chapter

The description field is the search. Write it the way you'd say it — "the John Allison tax work in 2021–2022" — and Haven extracts the searchable parts on your device: names, organizations, email addresses, quoted phrases, and any years you mention (which set the time window unless you've picked dates yourself). Those become native searches on each provider — your sentence itself never leaves your machine in Fast search. The optional terms field narrows things further with exact names, addresses, or phrases.

Fast and Deep

Fast is exact matching: your planned search runs against each provider's own search engine (Gmail, Outlook, Google Drive, OneDrive, and iMessage on a Mac), returning up to 200 items per account with a line explaining what matched.

Deep starts with the same exact pass, then goes where string matching can't: Haven looks at who appears in your results, gathers other mail exchanged with those people in the same window, and has its private model judge — message by message — whether each one belongs to the chapter you described, even when it never uses your words. Items it adds are marked Related, with the model's one-sentence reason shown right on the item. Deep checks up to 100 candidates per run, using redacted excerpts on GPU infrastructure Haven operates end to end, and typically takes a few minutes longer. Gmail and Outlook today.

Ask about the results

Once a Trace finishes, you can ask questions of what it found — "what was my tax bill for 2022?" — right on the results. Haven picks the most relevant items (at most 12), re-reads them transiently, and has its private model check each one for the answer, then writes a short reply cited to the specific messages it came from. Nothing is stored: your mailbox stays the only copy, and if the answer isn't in the items checked, Haven says exactly that — including when it looks like the answer lives in an attachment it can't read yet.

Acting on a Trace

Select any set of results and Archive or Move to Trash in one pass (Gmail today). Every action lands on the Remediations page with the same 30-day undo as any other remediation. Past Traces are saved (the found items' details, never message bodies) so you can reopen, re-ask, re-run, or delete them.

Hand it on as a document

Export document turns a finished Trace into a Word file someone else can read without Haven: a statement of what was searched and what wasn't, a summary, a dated chronology, and every item as a numbered exhibit, followed by a section describing how the document was produced. A template — general, renting, work, freelance, an insurance claim, or family arrangements — sets the framing; the general one adds no framing at all.

Three options change what goes in. Full message text re-reads each exhibit from the provider so it quotes whole messages rather than the stored opening. Attachments downloads the files the messages carried (Gmail today). Black out sensitive numbers replaces things like card and Social Security numbers with a visible [REDACTED] marker throughout, including subject lines.

Haven saves the record as a folder named after the document — by default with the date and time in the name, and never on top of an earlier export: if a folder of that name already exists, Haven adds -2, -3 and so on. The folder holds the .docx, a signed .manifest.json, an attachments folder if you included files, and a short note explaining the manifest. Send the folder as one thing. The manifest holds a fingerprint of the document and of every exhibit and file, signed on your computer, so whoever receives it can confirm nothing has been altered — in their browser at havenprotect.app/verify, or with the small Python script published there. Opening the document in Word and saving it changes its fingerprint, so keep a clean copy of what you send. You can also save the folder straight to your own Google Drive or OneDrive — see Saving to Drive or OneDrive.

What leaves your device

Fast search sends only the planned search queries to your own providers — each one visible verbatim in Logging. Deep search and Ask additionally send short, redacted excerpts of candidate messages to Haven's own inference infrastructure for judgment — the same bounded, logged, never-retained path the scanner's second-opinion tier uses. Every provider call and every model check appears in Logging, so what a Trace did is exactly what you can audit.

Settle Beta

Settle is for the weeks after someone dies. It reads one mailbox and works out what the person was paying for, which accounts and policies existed, and who to call — then puts it in one signed Estate Record you can hand to an attorney, an accountant, or the rest of the family. Where Trace answers a question you ask, Settle asks the same nine questions every time.

Connect the mailbox, read-only

Settle asks the mail provider for read access and nothing else. A mailbox connected this way is marked read-only for Settle: Haven never scans it for findings, never includes it in your posture score, and never acts on it — no archiving, no deleting. It sits apart from your own protected accounts, and you can hand it back at any time by disconnecting it. If you later decide you do want it protected, there is a button on the account to opt it in. Gmail and Outlook mailboxes today.

The nine categories

A sweep looks for the same nine things, and you can switch any of them off before you start:

• Recurring charges — subscriptions, memberships, anything that renews.
• Financial institutions — banks, brokerages, retirement accounts, lenders.
• Insurance — life, home, auto, health, long-term care.
• Utilities and services — power, gas, water, internet, phone.
• Property and vehicles — tax notices, registrations, HOA, leases.
• Professional contacts — the accountant, attorney, adviser, doctor.
• Obligations — loans, mortgages, payment plans.
• Government — IRS, Social Security, Medicare, DMV, VA.
• Digital accounts — anything that sends a sign-in code or a password reset.

An optional date window narrows the sweep; by default it reads the whole mailbox.

Running a sweep

A sweep takes minutes on a large mailbox, so it runs in the background: it appears as one line on the Settle page with its progress, the sidebar shows how far along it is from any page in the app, and it opens when it’s done. You can stop it, and a stopped sweep keeps what it found and says so. One sweep runs at a time.

Because a sweep can outlast your patience, you can tick Email me when this sweep is done before you start. When it finishes — or stops, or fails — Haven asks its server to send one short email to the address on your Haven account. The request says only that a sweep ended; nothing about the mailbox, the institutions or the record goes with it.

Settle reads subject lines, senders and short previews to decide what counts, then reads the full text only of the few messages the record will quote. Two steps use Haven’s own private model. To work out what kind of institution each sender is, it is shown the sender’s name and address, how many messages it sent, up to five subject lines and the closing lines of up to two of its messages. To write the record’s summaries, it is shown the finished register and nothing from any message. What it is shown is scrubbed first, never stored, never sent to an outside AI provider, and listed call by call in Logging — and the Estate Record states the same on its first page.

The register

The result is one line per institution, grouped by category: how many messages, when the first and last arrived, whether they arrive on a schedule, and any account, policy or member number exactly as the mail wrote it — usually partial, like “account ending in 4471”. Open a line to see what the mail shows and the messages the record quotes, with a link to the original in the provider’s own interface. A search box finds an institution, a number or a contact across the whole register.

Where Haven’s model filed an institution somewhere other than the keyword sweep did, the line says so in one sentence — “Moved here from Digital accounts by Haven’s model: the sender is a life insurer” — so a filing is never a silent judgement.

One institution, one line. Many institutions write from more than one address: X bills through Stripe and writes from x.com, an energy company sends sign-in mail through its login provider. When the model names those senders as the same institution, they become one line, led by the institution’s own domain, with a note underneath — “Also includes 1 message from Claude Team (claude.com), which Haven’s model identified as Anthropic” — so you can see what was combined and undo it. A government sender keeps its own name: a Treasury programme is not listed under the company that administers it.

Payment processors. Receipts sent through Stripe, Square, Paddle and similar services are filed under the business that charged you, not the processor — eight vendors billed through Stripe are eight lines, each with its own contact, never the processor’s help page.

Changing the register

Open a line and you can correct it. Your changes stay on this computer, a re-run of the sweep keeps them, and on a combined line they apply to every sender in it.

• Recategorize — file it under a different category.
• Rename — list it as you would write it on a call list (“City of Longmont” rather than “Longmont Customer Service”). Clearing the name puts the mail’s own back.
• Not an account — take it out of the register. It moves to Set aside, with the senders Haven’s model read as advertising; Put it back restores it. The record names everything set aside, and how many messages each accounted for, so nothing the sweep saw goes missing.

The Estate Record

Save Estate Record writes the same kind of folder a Trace export does — the Word document, its signed manifest, attachments if you asked for them, and a note explaining the manifest — checkable at havenprotect.app/verify. Inside: what was swept and what was not, a plain-language summary, the register, the people and professional contacts, a chronology, and the messages themselves as numbered exhibits. Where an institution wrote hundreds of times, the record reproduces the first, the last, the ones between that show a charge, a statement or a sign-in — not its advertising — and anything a register row cites; the counts and dates still cover every message found. The same full-text, attachment and redaction options apply.

The summary is an opening paragraph and one line per category, written by Haven’s model from the register alone. Before it goes in, Haven checks it: every number and date must appear in the register, it may not call any account open, closed, active or lapsed, it may not tell the reader what to do or where to start, and it must name institutions as the register does. A summary that fails is left out, the record says so among its known gaps, and a plain templated paragraph stands in its place. The summary is written on the first save and reused after that, so saving again gives the same document — unless the register has changed underneath it.

Saving can take a few minutes. With the full text included, Haven re-reads each quoted message from the provider one at a time — hundreds, on a large mailbox — and that text is never kept once Haven closes, so it is read again after a restart. While it works, the panel says what it is doing: writing the summaries, reading the quoted messages (214 of 986), saving attachments, then assembling and signing the document.

Each save gets its own folder, named with the date and time — haven-estate-record-pat-lee-2026-09-13-1854 — so saving again never replaces an earlier record. If a folder of that name is already there, Haven adds -2, -3 and so on rather than writing into it.

You can also save straight to your own Google Drive or OneDrive instead of this computer — see Saving to Drive or OneDrive under Prepare, which works the same way for every record.

What Settle can and cannot tell you

A mailbox is a good record of anything that emails, and no record of anything that doesn’t. Paper statements, accounts under another address, and anything that only ever phoned will not appear. The document says so on its own first page: it lists what was searched, what was not — spam, deleted mail, attachment contents, categories you switched off — and where a sweep hit a limit. A record that quietly left those out would be worse than no record.

Prepare Beta

Prepare is Settle for your own affairs, while you can still correct them. It sweeps your own mailboxes for the same nine categories, lets you confirm each institution and say what it is for and who to call, and saves a signed Personal Record you can hand to a spouse, an executor or an attorney. It lists where things are — never a password or a full account number.

Pick your mailboxes

Prepare reads the accounts you already protect with Haven; mailboxes connected read-only for Settle are not offered. Tick every address you use — the current one, a work one, the old one that still gets a utility bill. None is ticked until you choose. An institution that writes to more than one of them appears once, with each mailbox it wrote to.

The same nine categories as Settle are on by default, and the date window starts empty on the left and on today on the right; left on today, the sweep reads everything up to now.

The sweep

A Prepare sweep runs exactly as a Settle sweep does — in the background, one at a time, with its progress on the sidebar and an optional email when it is done — and uses Haven’s private model in the same two bounded ways, each call listed in Logging. It only reads: a Prepare sweep adds no findings and does not change your posture score.

Confirming the register

The register looks like Settle’s, with a line at the top that counts where you are — “58 institutions found, 12 confirmed, 9 without a purpose”. Every row starts as a Draft. Open one and you can:

• Confirm — you’ve looked and it is right. The row is marked Confirmed with the date, and its category is kept as yours through a re-run.
• What it’s for — one line in your own words, such as “Joint checking, the mortgage comes out of here”.
• Who to call — starts with the contact the mail showed; replace it with the branch, the agent or the person.
• Recategorize, Rename, Not an account — the same corrections as in Settle.

+ Add creates a row for something the mail can’t show — a pension from a job that ended before email, a safe deposit box, a policy that only arrives by post. You choose its category; the record marks it as added by you, and you can remove it again.

What you type — notes, confirmations and rows you add — stays on this computer. It is never sent to Haven or to any model, and it leaves your computer only inside a record you choose to save to your own storage.

Running it again

Start a new record next year and Prepare carries forward everything you did in the last finished one: confirmations, notes, contacts, recategorizations and hand-added rows. Only the parts drafted from the mail are worked out again. The new record gains a What changed since section: institutions that are new, ones that have gone quiet, and ones the mail no longer shows.

The Personal Record

Save Personal Record writes the same signed folder as Settle and Trace, checkable at havenprotect.app/verify. It opens with a one-page note for whoever finds it — who made it and when, that it holds no passwords, what Confirmed and Draft mean, and to contact the institutions directly — then the scope, including how many rows are confirmed and how many have no note, what changed since the last record, the register with its purpose, contact and status columns, and the messages as numbered exhibits. Full message text is off by default: a Personal Record is a map, not evidence.

Saving to Drive or OneDrive

Every record — a Trace document, an Estate Record or a Personal Record — can be saved to This computer, where you pick a folder, or to one of your own Google Drive or OneDrive accounts. A cloud save uploads the whole folder — the document, its signed manifest, the note and any attachments — into Haven Records/<record name>, so the copy there can still be checked. Nothing is left on this computer once it is up; if the upload fails, the record stays on this computer and Haven tells you where.

Any account you already protect with full access is offered. If none of yours can save, Connect Google Drive or Connect OneDrive will connect one just for saving: it is never scanned or searched, Haven only adds records to its “Haven Records” folder, and it shows in Sources as saving records only. Each upload appears in Logging with the file’s name and size — never its contents — and goes to your own storage, not to Haven.

Subscriptions Beta

Subscriptions lists every subscription, membership and free trial your own mail shows — what it costs, when it renews, and where to cancel it. It is part of membership. Unlike Trace, Settle and Prepare it doesn’t produce a signed record: it is a list you check, act on, and check again. See the Subscriptions page for the overview.

Starting a check

Open Subscriptions in the sidebar, under Workspace. Tick the mailboxes to read — your own accounts only; mailboxes connected read-only for Settle are not offered. Every one is ticked the first time, because a subscription billed to an old address still renews; after that, the ones your last check read. From is optional: left empty, a check reads the last five years, and it can’t go further back than that. A yearly renewal needs at least a year of mail to show its rhythm.

Click Find my subscriptions. The check runs in the background like a Settle sweep — one sweep at a time across Settle, Prepare and Subscriptions, with its progress on the sidebar — and the list opens when it’s done. It only reads: nothing is archived, deleted or cancelled, and it adds no findings.

The list

The list shows bills that repeat: subscriptions and memberships, and utility, insurance and loan payments when their mail comes monthly or yearly. It is grouped by what needs doing first:

• Trials ending — a free trial with an end date still ahead, or a dateless trial notice from the last 30 days.
• Renewing soon — a renewal date in the next 60 days, or a yearly charge whose anniversary falls in that window.
• Active — billing you recently, with no renewal date in the mail. A yearly one shows “Yearly — next expected around…”, worked out from the date of the last one.
• Charged once (folded) — one email and nothing to say it repeats. Probably a purchase.
• May have ended (folded) — the mail says it was cancelled or expired, or it has gone quiet: a monthly charge with no email for two months, a yearly one past about thirteen months, or anything silent for six months and longer than its own usual gap. Check before you assume it’s gone.

Each row shows the amount and the renewal wording exactly as the mail printed them, in quotes, with “in 12 days” added only when the mail states a date plainly. A date like 10/11/2026 could be October or November, so it is shown as written and not counted down. A phrase from an email more than a month old says which email it came from. The arrow on a row lists the emails behind it, each with a link to open it in your mail.

Cancelling

Haven never signs in to a service and never cancels anything. Each row gives you two ways to do it yourself:

• Manage opens the cancel, billing or manage-plan link from the sender’s own mail. It is only offered when the link is on their own domain; unsubscribe and email-preference links are never used (they stop the emails, not the charge), click-tracking links are skipped, and a link carrying a one-time sign-in token is refused rather than kept. The link is stored without its query string. With no such link, Their site opens the sender’s home page.
• Draft cancellation opens an editable email asking them to cancel and confirm the date of the final charge. It names the service, the partial account number the mail showed, and the address the account is under. Copy it, or Open in your mail app — addressed to them when their mail gave an address to write to. Haven doesn’t send it. Some services only cancel online, so Manage is usually quicker when there is one.

Keeping, clearing and printing checks

Check again starts a new check. By default the lists you have now are kept: the newest opens, and earlier ones are under Earlier checks at the bottom, to open or clear. Tick Replace the lists I have now when this check finishes to clear them once the new check succeeds — if it’s stopped or fails, nothing is cleared. Clear this check, beside the date, deletes the check on screen; Haven asks first.

Print or save as PDF opens your computer’s print dialog, where you can pick a printer or save a PDF. The printout is the list alone, every group open, with each manage link written out and the date it was printed.

What leaves your computer

A check reads subject lines, senders and short previews on your computer, then the full text of a few messages per sender to find the renewal date and the manage link. To tell a subscription from a one-off purchase, Haven’s own private model is asked about each sender that would be listed: it is shown the sender’s name and address, how many messages it sent and how regularly, up to five subject lines and the closing lines of up to two of its messages — scrubbed first, never stored. It answers subscription, trial, one-off, not a bill, or can’t tell, with the service’s name; one-offs and senders that don’t bill you leave the list. It is never asked whether a subscription is still active — that comes from the dates. Every request to your mail provider and every model call is listed in Logging. The list itself stays on this computer.

Membership & single records

Haven is free to install, and your first five findings are always free. Beyond that there are two ways to pay: membership at $99 a year, or a single record for $59. See Pricing for the overview.

Free

Every install, for as long as you keep it: your first five findings, and the account-takeover checks — forwarding rules and mail filters that could be sending your mail somewhere else. No card is needed.

Membership

Every finding, full-history scans and ongoing monitoring, Subscriptions, and unlimited Trace, Settle and Prepare records, for up to 5 connected accounts. Members are never limited on records: run a Trace for each dispute, and re-run your Personal Record every year at no extra cost. Membership is billed once a year; manage it in the app under Settings → Account.

A single record

One feature — Trace, Settle or Prepare, chosen at checkout — for 90 days from purchase, and one signed record from it.

• Run it as often as you need. Within the 90 days you can run the sweep or search, re-run it, and correct it as much as you like. None of that uses your record.
• The record counts when you first save it. Saving the signed document the first time is what uses your one record.
• Saving it again is free. Re-exporting that same record, say to a new folder, doesn’t count again.
• Same account limit as membership: up to 5 connected accounts.

If the pass is refunded before a record is saved, it closes. A single record needs Haven 0.3.206 or later; if yours is older, update first under Settings → Check for updates. Membership works on any version.

Connected accounts

Membership and single records both cover 5 connected accounts at a time.

• Every source counts — Gmail, Outlook, Google Drive, OneDrive, Dropbox, iCloud, Yahoo/AOL, Proton, and any other account you connect.
• One Google or Microsoft sign-in counts once, across both its mail and its drive.
• Local folders and iMessage don’t count.
• A Settle mailbox counts while it is connected. Remove it when the record is saved and the slot is free again.
• Removing any account frees its slot for another.

If you try to connect a sixth account, Haven says Membership covers 5 accounts and offers a link to contact us. Need more than 5? Contact us. If your install already had more than 5 accounts connected when the limit arrived, they all stay connected and keep working; you just can’t add another until you are below 5.

Settings

The Settings page is where you tune how Haven looks, when it notifies you, and what it has learned about you.

Appearance

Switch between light and dark themes. (The same toggle lives in the top corner of every screen.)

Tray & notifications

• Keep Haven running in the background when you close the window, so scanning continues.
• Start Haven when you sign in to your computer.
• Quiet hours — set a window where Haven won't notify you, and when to resume.
• Notifications — turn desktop notifications for new findings on or off, and choose the severity that's worth interrupting you (for example, Critical only, or Critical and High).

Privacy & inference

Shows how Haven handles the small number of items that need the deeper check — which model is in use and the zero-retention posture (excerpts are checked and discarded, never stored, and never sent to a third-party AI provider). Pairs with the Logging page, where you can audit every call that left your device.

Detection model

Shows the on-device classifier Haven is currently using — its version and when it activated. Haven improves this model over time; after an update, running Rescan all on a connector (see Getting started) re-checks older items with the newer detection.

Auto-updates

See your installed version, whether an update is available, and update on your schedule with Check for updates and Restart to update. New versions roll out gradually, so the page also tells you whether this install is eligible yet.

About you & Your context

These two panels are Haven's transparency window — everything in them is computed on your device and stays there.

• About you — a read-only look at what Haven has inferred to make its findings smarter: a likely role, broad life-stage signals, your locale, and which kinds of sensitive content it has seen most. Nothing here leaves your computer.
• Your context — the things you've told Haven. The content types you've marked as "normal for me," and the patterns you've quieted, each with a button to restore it if you change your mind.

Send feedback

A quick way to tell us what's working and what isn't, right from the app.