Privacy Policy

The short version

• There is no advertising on Naven and no tracking pixel. You are not the product because there is nobody to sell you to.
• Naven's public pages — the homepage before you sign in, the comparison and guide pages, this page — use Google Analytics to count visits and sign-up clicks, with Google's advertising features switched off. It never runs inside Naven: a browser that has signed in never loads it, and it switches itself off the moment you sign in. Section 8 says exactly what Google receives.
• Naven counts how many people read each of its public pages, and roughly where they arrived from — “a search engine”, “a link somebody shared”. It is a tally, not a trail: no cookie, no script, no address stored, and no row that represents a person. Section 8 explains exactly what is kept.
• Naven collects the minimum it needs to work: an identifier, a display name, your email address, your messages, and when you were last here — and, to make Naven feel like yours, the time zone and language your browser reports, which days you opened it, and what kinds of device you use it on. Section 2 says what each is for.
• Naven can read your messages in transit, because it screens them before delivery. That is a real trade and section 4 explains it rather than hiding it.
• Your messages are never sold, never shown to advertisers, and never used to train a model.
• Naven does not hold ID documents. An age check is run by AgeVerif, a separate company, which tells Naven only that it passed, the age threshold it confirmed, its reference and its assurance level — never a photo, a document or a card number.
• If you are under 18 and a parent or guardian is linked, they can read the words of a message Naven’s screening stopped you sending, from 19 October 2026, for 30 days — never a message that was delivered, never anything anybody else wrote, and never a stopped picture or voice note (only that one was stopped). Under 13, only once the parent turns this on. Section 6.
• Every safeguard described here is automated and makes mistakes. Screening, age checks, consent checks and parent controls describe what Naven is designed to do and may do, not what it will do; they can and sometimes will fail. This page describes practice and promises nothing (terms §11).
• Email us and your account and its content are deleted.

1 · What Naven collects

A hashed copy of your email address is stored so another member can start a conversation by typing an address they already know, without Naven publishing a directory anybody can browse. The stored value is a SHA-256 hash, and a lookup can reveal only your display name — never your address, and only if you switched that on.

How you sign in, and what Naven does not have. Naven has no guest mode and does not give you a password. You sign in with an email address you already have: through Google, with a six-digit code Naven emails to you, or with a passkey on your device. Your email account stays yours — Naven never sees or stores the password to it, and signing in does not create a new email account. Naven keeps your address as your account's identifier. A sign-in code is stored only as a hash, works once, and expires after 15 minutes. Before a code or an invitation is emailed, the part of the address after the @ is looked up with Cloudflare's DNS resolver to check it can receive email at all; nothing else about the address or you is sent with that lookup.

Accounts Naven sets up for somebody. For people who cannot create an account themselves, Naven can create one and hand them an email address and a temporary password. The temporary password is kept by Naven, not by Google's Firebase, and only as a salted hash keyed with a secret that is stored separately from the database — nobody at Naven can read it back, including whoever set the account up. It only opens a screen to choose your own password; it stops working the moment you do, and it expires after 14 days either way. Once you have chosen your own password, the account becomes an ordinary Naven email account: your password is handed to Google's Firebase, which keeps it the way it keeps every other member's, and Naven's copy is erased. If the address is a navenapp.com one, it is a sign-in name rather than an inbox: nothing is ever emailed to it, and you are asked to add your own address so a forgotten password can be reset. Codes sent to prove an address or reset a password are stored only as hashes and expire in 15 minutes. Nothing about the password or the sign-in is kept in your browser.

Not collected: your birth date (only the band), your phone number, your contacts, your location (except a place you choose to share in a message), your browsing outside Naven, and any identity document. A parent's signed consent form is not an identity document, and Naven does not ask for one.

2 · Why, for each thing

• Identifier, name, photo — so the people you talk to know who you are.
• Email address — to sign you in, to let someone who already knows it reach you, and to send the notifications and lifecycle email you can unsubscribe from.
• Forum activity — to run the Naven Forum at navenapp.com/forum, a separate page you use with your Naven account. Posts and comments are public; votes are counted but not attributed to anybody. Reading the Forum needs no account, and a reader who is not signed in is identified by nothing beyond what any page view carries. If somebody asks Naven AI to summarise a thread, the thread’s public text is sent to Groq (or OpenAI as a fallback), and the summary is stored with the thread.
• Age band — to decide which screening rules apply, and whether a parent or guardian needs to agree to the terms.
• Refused messages and their review — so a refusal can be read again and withdrawn if it was a mistake, so you are emailed a copy, and so repeated refusals can lead to the consequences the terms describe. When a refused message is reviewed, the messages just before it in the same conversation are read by the reviewing model too, so it can judge the message in context. Those surrounding messages are not stored by the review.
• The words of a stopped message, for a parent — so a linked parent or guardian of somebody under 18 can read what the screening refused to send, from the parent controls behind their PIN. Never put in an email, never shown to anybody else, and never used for anything else.
• An age check after two blocks — so an account Naven has blocked twice confirms its age before it keeps using Naven Social and the Forum, and so a linked parent is told instead (see the terms).
• Terms agreements and a parent's agreement — to know you have agreed to the version in force, and, for somebody under 18, that a parent or guardian has.
• Messages and files — to deliver them, and to screen them first. Text you are still typing is screened too, when you pause, so that sending does not have to wait for it. Drafts are never stored. A message with nothing in it that Naven's own rules or its list of risky words could object to is delivered without being shown to any screening model. A message in a language other than English is also read in English: the screening model is asked for a translation in the same request, Naven's own rules read that too, and the translation is never stored.
• Last-active time — to show presence, and to stop re-engagement email going to somebody who has come back. It is one time per account, overwritten every minute or so while Naven is open, and kept in Naven's own database on Cloudflare. The console sees only how many people are here at once, every five minutes — a number with no account attached.
• Blocked-message count — to trigger age confirmation after three in a fortnight. It is cleared when the check is completed.
• Push subscription — to send notifications. Deleted when you turn them off, and automatically when your browser reports it as dead or its push service refuses it twenty times in a row with no success for a week. It is stored with your browser's time zone name (such as “Europe/London”), so a reminder is not sent in the middle of your night, with the browser family and kind of device (such as “Chrome desktop”), the push service's last answer, and when a notification was last shown on that device — so Settings can tell you whether notifications are reaching it.
• When a reminder was sent — if you have notifications on and have been away for two days (one day, if you use Naven on a phone or tablet), Naven may send one saying how many messages are waiting, that somebody is waiting for your answer to a message request, how many people replied to you on the Forum, or what is new in your channels — never what anyone wrote. The date of each is kept so they stay at least three days apart (two on a phone or tablet) and stop after three you did not answer (four on a phone or tablet). Whether you use a phone or tablet is read from the device records below. Switch them off in Settings.
• News briefing choice — how often the news briefing email comes: daily, weekly, monthly or never. Asked when you sign up, weekly unless you choose otherwise, and changed in Settings at any time. The briefing is the top stories from the channels you follow, or from Naven's own news channels if you follow none, and it is never sent to an account under 13 without a parent's verified consent.
• Morning headlines choice — only if you turn morning headlines on in Settings: that you did, and the date the last one was sent, so the notification arrives no more than once a morning. It carries headlines from public news channels, never anything a member wrote. Turning it off deletes both.
• How you first found Naven — so the team can tell which of the things it writes actually bring anybody here. It is one word, it is never updated after sign-up, and it is never used to target anything at you.
• Marketing consent record — to prove Naven only advertises to people who asked it to. It stores when you switched it on and the exact sentence you agreed to, because a stored yes with no record of the question is not evidence of anything.
• Time zone, language and country — so account email arrives at a sensible hour where you are, and Naven's greeting uses your language and the right time of day. They are replaced every time you open Naven, so there is never a history of where you were.
• Devices — to email you when your account is used on a kind of device, or from a country, it has not been used on before, so you would notice if it was not you.
• Days you opened Naven — to show things like how many days in a row you have been here, and to write the summary of your first week. Counted only once you have told Naven your age.
• Closed suggestions — so a suggestion you closed does not come back on your other devices.
• Personalisation — the greeting, the one suggestion in the sidebar, what an empty screen says and the placeholder in the message box are picked by rules that run in your browser, from what Naven is already showing you: your conversations, unread counts, the time where you are. Nothing extra is sent anywhere to do it, and nothing is kept in your browser for it.
• Accounts under 13 follow the children's privacy notice instead. Until a parent's consent is verified, none of the time zone, language, country, device, day or closed-suggestion records above is kept — only the age band, which is what keeps every getting-started email away — and anything noted before the age was given is deleted. With consent, the device, country, time zone and language records stay, for security alerts; the days a child opened Naven are never kept. A child is never asked for a photo or a username by a suggestion, and nobody is emailed that a child joined.

2b · Email Naven sends, and which of it you can refuse

There are three kinds, and they follow different rules on purpose.

• About your own account. A safety warning, a block or unblock, a guardian notice, an age-check code, someone asking to start a conversation, a missed call, and an alert when your account is used on a kind of device or from a country it has not been used on before; a notice when every session on the account is signed out or the app lock stops accepting PINs after wrong ones; and a reminder you set, by email only if none of your devices took the notification. These are not marketing and cannot be switched off while the account exists — turning off a warning about your own account would make the account less safe, not more private.
• Getting started. A welcome; a note two days in if you have not started a conversation yet; a summary of your first week; and a note when someone you invited joins. None advertises anything. The first three are each sent once and never more than one of them in a day: the welcome once you have told Naven your age, the other two only between 8:00 and 21:00 where you are. A note about someone joining is sent once per person who joins, at most once every twelve hours, and only once that person has given their age and is 13 or over; it is never sent about an account that has since been deleted. Every one carries an unsubscribe link that turns them all off. They never go to an account under 13, to one a school or a guardian created, or to one whose age Naven does not know. Naven keeps no record of who used your link beyond the few days it takes to tell you.
• Things waiting for you. If a message request is still unanswered three days later and you have not opened Naven since, one more email says so — once per request, never again. And in the first week of a month, if you have been away for two weeks or more (but less than four months) and something is waiting — unread messages, message requests, replies to you on the Forum — one email with the counts. Never what anybody wrote, and nothing about Naven itself. The “emails about messages” switch turns these off, as does the link in each.
• Forum replies. If somebody replies to your Forum post or comment, Naven emails you, at most once a day per thread. The “emails about messages” switch turns these off too.
• The weekly news briefing. Once a week, what was published in the channels you follow — or, if you follow none, or yours were quiet, the week from Naven's main news channels (Top Stories and World), which the email says. It is news, not advertising: every source in it is linked, and every one carries an unsubscribe link that works. An account under 13 gets it only with a parent's verified consent, and only for channels it chose; news chosen for somebody else goes only to accounts known to be 13 or over.
• News and offers about Naven. Advertising. Off unless you switch it on in Settings — not pre-ticked, not bundled into the terms, and not implied by having made an account. Each one says it is an advertisement, carries Naven's postal address, and can be stopped in one click. Stopping takes effect immediately, not within ten business days.

Naven does not buy, rent, scrape or otherwise acquire email addresses. Every address it holds was typed in by the person who owns it, or supplied by Google when that person chose to sign in that way. Addresses are never sold or shared for anybody else's marketing.

When email cannot be delivered. If email to an address bounces, or the person who receives it reports it as spam, Resend (which sends Naven’s email) tells Naven. Naven then records the address, the kind of failure, Resend’s short reason and when it happened, and stops sending to it: a bounce or a spam report stops all of it, and temporary failures twice in two weeks stop everything except sign-in codes and safety notices. If it is your account’s address, the app asks you to fix it, and the address cannot be used for a sign-in code until it works again. Nothing else from the failed email is kept. The record is deleted a year after the last failure at the latest, or sooner when Naven’s operator clears it. These are automated systems and can be wrong — an address can be stopped that would have worked, or keep failing without being noticed.

3 · What Naven can and cannot read

Naven screens every message, picture and voice note before it sends. Screening a message and being unable to read it cannot both be true, so:

• Naven's servers can read message content in transit. Messages are encrypted in transit (HTTPS) and at rest, but Naven is not end-to-end encrypted. If that is your first requirement, use Signal.
• No human reads your messages as a matter of course — but one can. Screening is automated: a message is classified and the classification is what is acted on. Naven’s developer nonetheless has technical access to the systems that hold messages and may access, review, preserve or remove any account or content to run and repair Naven, to investigate a report or a suspected breach of the Terms, to protect somebody’s safety, or to comply with the law. In Naven’s admin console the words of refused and reported messages are kept out of the page until the operator confirms with a passkey a second time; they are then shown for a few minutes, and each opening is recorded.
• Naven may disclose information when the law or safety requires it. Account information and content may be preserved and handed to law enforcement, a court or a regulator when Naven believes in good faith that the law requires it, or that it is necessary to prevent harm to a person or to investigate abuse.
• The people you message keep what you send. They can copy, screenshot, save and forward it, and nothing Naven does can stop that.
• A linked parent can read what the screening stopped. If you are under 18 and a parent or guardian is linked, the words of a message Naven refused to send are shown to them in the parent controls for 30 days (from 19 October 2026; under 13 only once the parent turns it on). Nothing that was delivered, and nothing anybody else wrote, is ever shown to a parent. The app tells you when this applies.
• A voice note is transcribed to screen it, and the transcript is thrown away unless you ask for it to be kept. Screening always produces one and always destroys it immediately afterwards. Cloudflare Workers AI transcribes it, or Groq when Cloudflare's transcription is unavailable. The single exception is a setting you control: Settings → Let people read my voice messages, which is off unless you turn it on. With it on, the transcript of a voice message you send is attached to that message so the person receiving it can read it instead of playing it. It never applies to voice notes anybody else sends you, it only affects recordings made after you turn it on, and turning it back off stops future ones without altering messages already sent. The choice is the speaker's, because the words are theirs.
• Naven also checks pictures and voice notes itself, on its own servers. Before a picture is stored, Naven’s own software — running on Cloudflare, where Naven runs, with no other company involved — reads it and checks it for nudity and sexual content (with an openly published classifier, NSFWJS by Infinite Red, run by Naven’s own code), for QR codes (not accepted from an account under 13), and for anything hidden after the end of the picture, which is cut off. A clear result refuses the picture; a borderline one refuses it unless the hosted vision check also looked and found nothing. Before a voice note is stored, Naven measures how loud it is: a silent recording is not sent, and one loud enough to hurt somebody wearing headphones — a scream, or a sudden blast after silence — is turned down, never up. Nothing these checks work out about a picture or a recording is kept; only the picture or note itself is stored.
• A message is screened while you are still typing it. When you pause, the text in the composer is sent to be screened in advance, so that pressing send waits for an answer that is already there rather than for the checkers to run. That means text you type and then delete can reach Naven's screening even though you never sent it. It is treated exactly like a message that was sent: classified, never stored, never shown to anybody, and never used for training. The verdict — allowed or not, and nothing else — is kept for up to ten minutes so the send can reuse it, both in the server’s own memory and in Cloudflare’s edge cache. In the edge cache it is filed under a one-way hash of the text rather than under the text, so what is stored cannot be read back as anything you wrote. Nothing is written to a database. A draft that is refused is not held against you — no warning, no record, no email; only what you actually send counts.
• Call audio and video are not screened and not recorded. A call between two adults usually connects directly between their devices, so each sees the other's IP address. Every other call — one with anybody under 18 or whose age Naven does not know, every group call of up to eight people, and a direct call that could not connect — goes through Naven's own call server, which runs on Cloudflare and shares no IP address between members. Only when Naven's call server cannot carry a call (its free daily allowance is used, a browser cannot run it, or the call fails on it) does the call move to Cloudflare's relay, which shares no IP address either, and last of all to Agora, which shares none. Naven keeps no copy of any call. On Naven's call server each device encrypts its own audio and video (AES-GCM) with a key it hands to the other devices on the call, sealed with a secret only the two devices work out (ECDH); the server passes the encrypted packets on without being given the keys, and stores none of them. Because the devices exchange those keys through Naven's server, a server that set out to swap them could read a call, so these calls are not end-to-end encrypted in the strict sense. Direct and relayed calls are encrypted by the browsers (DTLS-SRTP), and the relay passes on data it cannot decrypt. Agora calls are encrypted with a key Naven's server gives the devices and never gives Agora. Because Naven's server hands out that key, Agora calls are not end-to-end encrypted in the strict sense either. Screen sharing sends your screen only to the other person, the same way; reactions during a call pass through the call room and are not stored. When a one-to-one call you started is not answered, the person you rang is sent a “Missed call” notification and the call is added to their Calls list, unless they declined it.
• Screening does not create training data. Content sent to a classifier is classified and discarded.

4 · Who else handles your data

Naven is a small product standing on other companies' infrastructure. Each company below does a specific job, and each has its own privacy policy and terms, which govern what it does with what it receives. Naven does not control these companies and is not responsible for their practices; their policies are linked so you can read them. The complete list, including services that receive nothing about you, is on Companies and services Naven uses.

None of them pays Naven for your data, and Naven does not sell data. Where a company acts as Naven's processor, it handles your data to do its job for Naven; where you choose a company's own service (Sign in with Google, AgeVerif), that company's terms also apply between you and it. If Naven itself is transferred — to a company formed to run it, or to whoever takes over operating it — the information Naven holds goes with it and stays under this policy until the policy is changed in the way it describes.

Where your data physically sits. It is stored in the United States: Firebase's database in Google's US multi-region, and Naven's own database in Cloudflare's North American region. Cloudflare serves requests from its network edge, so a request may pass through a data centre in another country on its way.

Where Google cannot be reached. Some countries — Iran and China among them — cannot reach Google's servers directly. There, your browser reaches Firebase through Naven's own server on Cloudflare instead, which passes sign-in and message traffic on to Google as it arrives. It is not stored or logged on the way, your IP address is not passed on to Google, and it is the same server that already runs the rest of Naven.

5 · How long it is kept

6 · Children's data

Naven is used by children and is designed for that rather than pretending otherwise.

• Under 13: a parent's verifiable consent, as COPPA requires. The parent is emailed a notice, confirms they are an adult with AgeVerif (a separate company, which tells Naven only that the check passed, its reference and its assurance level), signs a one-page consent form and uploads a photo of it. Naven's software checks the photo — a vision model running on Cloudflare reads it, and fixed rules accept it only if it is Naven's form or its statement, carries the child's reference, is signed and dated, and names the parent who sent it — and nobody at Naven reviews it by hand unless something goes wrong. What the software read and the AgeVerif reference are kept with the form as the record of consent. Until then the account cannot send, post, upload, call or use Naven AI, and if consent does not arrive within 30 days the account and everything about it is deleted. Naven AI needs the parent's separate permission. The full notice is the Children's Privacy Notice, which applies to these accounts alongside this policy.
• 13 to 17: a parent or guardian agrees to the terms. Either on the member's own device, where the parent types their own name and email address, or from a link Naven emails to the address the member gives. The page explains what Naven is and what the terms say before asking for anything, and only pressing “I agree” is recorded, along with the parent's name, email address, relationship, and whether an AgeVerif adult check was used. Opening the emailed link records only the time it was first opened, so the member can see “your parent opened it”; nothing about the parent's device is kept. The parent is emailed a copy, and the member is emailed when a parent agrees from the link. The member can use Naven normally for seven days from when a parent is first asked for; after that, sending, posting, uploading and calling wait until a parent has agreed, and reading never does. The agreement carries over when the terms change; the parent is told what changed and can withdraw it. See the terms.
• An account under 13 that repeatedly sends something the screen refuses is also suspended until a parent or guardian approves it from a link sent to their own inbox.
• A parent or guardian can pause the account or delete it at any time from the parent controls, or withdraw consent by emailing us. The parent controls are the page reached from the emailed link, and Family inside Naven for a parent signed in to their own account with the verified address the child named — the same controls behind the same PIN. Family shows who a child talks to, when, how long they use Naven, which safety categories were stopped and, from 19 October 2026, the words of a message the screening stopped the child sending, kept 30 days — on by default for 13 to 17, and for a child under 13 only once the parent turns it on. Never a message that was delivered, never anything anybody else wrote, never a stopped picture or voice note (only that one was stopped), and never a contact's email address. The child is told in the app.
• An account under 18 that Naven has blocked twice is not asked for an age check if a parent or guardian is linked; the parent is told instead. One without a parent links a parent to carry on. An account under 18 is not asked to take an AgeVerif check for this.
• Location sharing is switched off for accounts under 13.
• The only extra data collected for a child's account is the parent or guardian's email address, the record of their agreement and, under 13, the signed consent form — used for that agreement and for the guardian controls the parent chooses to use.
• Stricter screening rules apply to under-13 and teen accounts, including patterns associated with grooming and with a child posting their own address or phone number.
• No child is profiled, segmented or advertised to. The page counts in section 8 identify nobody at all, and nothing Naven records about any account — a child's least of all — is used to target advertising, because Naven has none to target.
• Google Analytics never runs inside Naven, so nothing any signed-in account does — a child's included — reaches it. It measures only the public pages a visitor reads before signing in, with Google's advertising features off.
• The time zone, device and day records in section 1 apply to every account, a child's included, and are used only for the purposes in section 2. The getting-started emails in section 2b never go to an account under 13; a new-device alert does, because it is about the account's safety.

Naven deliberately holds no identity documents. A parent's consent for a child under 13 is a signed form, which is one of the methods the COPPA Rule lists; it is not an ID and Naven does not ask for one. Verifying age with a passport scan would mean holding scans of children's passports, which is a category of data worth not having.

7 · Your rights, and how to use them

Depending on where you live you may have rights under the UK GDPR, the EU GDPR, the CCPA or similar law. Naven applies them to everyone rather than checking your postcode first:

• See what is held about you — ask, and you get it.
• Correct it — your name and photo are editable in Settings; ask for anything else.
• Delete it — Settings → Delete account, or the delete-account page if you cannot sign in. A parent can delete a child's account from the parent controls. Sign-in and Naven's records go at once; messages you sent and uploads within the hour.
• Export it — ask, and you get a machine-readable copy.
• Stop the email — every non-essential email has a working one-click unsubscribe, and Settings has a switch. Unsubscribing does not affect your account.
• Stop missed-message emails — when a message has waited twenty minutes and nothing else told you about it, Naven may email you who it is from. Never what it says, at most three a day, and never while you are using Naven. The email has its own link to turn these off, and so does Settings.
• Object — tell us, and Naven will explain the basis for the use, and stop it where the law where you live requires.
• Report something — every conversation's menu has Report, which a person reads.

Do Not Track and Global Privacy Control. Naven does not track anybody across other websites and does not sell or share personal information, so it has no tracking to switch off in response to these signals. It treats a Global Privacy Control signal as a request not to sell or share — which is already how Naven works for everybody.

One request handles any of these: privacy@navenapp.com. Naven aims to reply within 30 days, or within the time the law where you live sets if that is shorter.

One limit worth being clear about. Deleting your account cannot unsend messages you already sent to other people. Those sit in the other person's conversation, which is theirs. Naven will not reach into somebody else's inbox and rewrite a conversation they took part in.

8 · Cookies, browser storage, and what gets counted

Naven sets no advertising cookies and loads no advertising pixel from anyone. Inside Naven — once you are signed in — no analytics script runs at all; the only thing the app reports is when something fails, as a count (see “When something fails” below). The one third-party measurement is Google Analytics on the public pages, described below.

What is stored in your browser, and why:

• Your sign-in session, so you stay signed in.
• Your theme, sound preference and muted conversations.
• Three addresses, one sign-in. The homepage and public pages are at navenapp.com; Naven Social, the app you use signed in, is at social.navenapp.com; Naven Family, where a parent or guardian looks after a child's account, is at family.navenapp.com and opens only for an account a child has linked as their parent. Your browser keeps a separate sign-in for each. When you sign in on navenapp.com, Naven moves that sign-in to Naven Social or Naven Family with a single-use code: it is valid for two minutes, works once, travels in the part of the address your browser never sends to a server, and is stored on Naven's servers only as a one-way hash, deleted within a day. Naven Family keeps nothing about you in the browser beyond that sign-in. Signing out of Naven Social or Naven Family signs you out of navenapp.com too. The homepage also counts, for this tab only, how many times it has moved you in the last minute, so a fault can never send a tab back and forth between the sites.
• Offline copies, so Naven works without a connection. The conversations and messages the app has loaded, the pictures and voice notes you have opened (up to the last 300), the channel list and each channel's latest posts as they last loaded, and the app's own files. They are filed under your account, nothing is fetched just to be stored, and they are deleted when you sign out. On a device marked “This is a shared computer” none of this is kept, and anything already there is deleted.
• Drafts, folders, hidden and archived conversations, nicknames and messages waiting for a connection are held in the page's memory while it is open and kept with your account on Naven's server — not in the browser.
• Any developer code you have redeemed — on that device only.
• If Google turned out to be unreachable from your network, a note of when — so sign-in goes through Naven's server for the next week without failing first.
• One short note of how you first reached Naven — a single word such as “google” or “direct” (or, if you arrived through a Naven partner's link, that partner's code), plus which page you landed on. It is written once, never updated, and means nothing on any other website.
• A short-lived signed cookie on the admin page, which only the operator uses.
• On the public pages outside Europe, Google Analytics' _ga cookie — see below.

All of it is removed by clearing site data for navenapp.com, or by Settings → Privacy and security → Sign out and clear this device, which asks your browser to delete it (the Clear-Site-Data header). With “This is a shared computer” switched on, the sign-in is kept only until the browser closes.

The page counter

Naven counts visits to its public pages on the server, as each page is sent. This is how the team finds out whether anything it writes is read — without it, the honest answer to “is the safety page useful to anyone” is that nobody knows.

What that count contains:

• The date, the page, and where the visit came from — reduced to one word, such as “google”, “reddit”, “chatgpt” or “direct”.
• A number. Ten people reading the same page produce one row saying “10”, not ten rows.
• A running total of pages sent in each five minutes and each hour, split only into people and search or AI crawlers — no page, no source, nothing else. The five-minute totals are kept two days and the hourly ones a year.

What it deliberately does not contain:

• No IP address. It is never read for this and never stored.
• No identifier of any kind — no cookie, no fingerprint, no visitor id. There is no row that represents a person, so there is no browsing history of yours to hand over, leak, or change our minds about later.
• Nothing about signed-in members' use of Naven itself. Conversations, channels and the assistant are not counted at all.
• Nobody else's copy. The counts stay in Naven's own database and are read only by the Naven team.

If your browser sends Sec-GPC, nothing is counted for your visit at all. That signal is about selling personal data, which Naven does not do — but it is a clear statement that you would rather not be included, and honouring it costs nothing.

Crawlers — Google's, and the ones belonging to AI assistants — are counted separately under their own names, and are never mixed into the number of people.

Google Analytics, on the public pages

The page counter says how many people read a page. It cannot say whether reading it led anyone to sign up, so Naven's public pages also use Google Analytics. Where it runs, and where it does not:

• Runs on the homepage before you sign in, and pages such as /vs, /for, /communities, the terms, the safety page and this one.
• Never runs inside Naven. A browser that has ever been signed in to Naven does not load it, and it switches itself off the moment somebody signs in — before the app opens anything. Conversations, channels, the assistant and Settings are never measured.
• What Google receives: which page (with anything identifying removed — an invite link to /add/sam is sent as /add/, and query strings are never sent), the site you arrived from reduced to its domain, your browser and device type, a rough location Google derives from your connection, and whether you pressed a sign-up button. Google Analytics does not log or store IP addresses.
• Advertising features are off: no Google signals, no ad personalisation, and advertising storage denied everywhere.
• In the EEA, the UK and Switzerland no analytics cookie is set; Google receives cookieless visits it cannot link to each other. Elsewhere Google sets a first-party cookie (_ga) holding a random id, so repeat visits count as one visitor.
• Global Privacy Control or Do Not Track in your browser, and it does not load at all.

Google processes this under its own privacy policy. Naven cannot see who you are in it — Analytics reports are aggregates — and nothing from it is joined to a Naven account.

When something fails

When Naven shows you an error, or something fails without showing one, your browser tells Naven's server what failed so it can be fixed without anybody having to write in. What is sent: the kind of failure, where it happened (a screen or a server address such as /api/upload), the error's text, and your browser family and device type (“Safari phone”). Before anything is kept, anything that looks like an email address, an account or conversation id, a link or a long number is removed. It is stored as a count per day — the same failure seen by ten people is one row saying 10 — with no account, no IP address and nothing anybody wrote, and deleted after 90 days. The Worker records its own failures the same way.

Calls report which way they connected in the same anonymous form: what the server planned (direct, Naven's call server, relayed or Agora), what the call actually used, and why it moved if it did, as a count per day with no account, no conversation and no IP address, deleted after 90 days. Naven's call server also keeps one running total per day of how many packets and bytes it passed on, with nothing about who or which call. It is how Naven keeps calls inside the free allowances that pay for them.

9 · Security: none is promised

You have no expectation of security on Naven. Nothing on this page is a promise that your information is, or will stay, secure. It may be lost, exposed, or accessed by people who should not have it, and Naven is not responsible when that happens — see sections 2 and 12 of the Terms.

What is in place today, described rather than promised: everything is served over HTTPS. Pages and API requests that arrive over plain HTTP are redirected to HTTPS, or refused if they carry data. Browsers are told to keep using HTTPS for a year (HSTS). Requests made with the outdated TLS 1.0 or 1.1 are refused. When your account is used on a new kind of device or from a new country, its email address is told. Access to messages is meant to be enforced by database rules rather than by the app, so that a member can read only conversations they belong to. Uploads are keyed to the uploader. Secrets live in the server's secret store rather than in the code. Push payloads are encrypted for one device. Location and camera details are removed from pictures when they are uploaded. Pages tell browsers not to let other sites frame them, and report content they blocked. Settings has an app lock (a PIN checked by the server, which stops accepting guesses for 15 minutes after five wrong ones), a list of devices, a way to sign out of every device at once, and a warning before opening links that imitate a known site or hide where they go. Any of these can have flaws.

What that does not mean. Naven is a free, independent product. It has not had an external security audit. No system is unbreachable, and anyone who tells you otherwise is selling something. If something is genuinely private and high-stakes, use an end-to-end encrypted tool — and if you find a vulnerability here, please report it to the address below and it will be taken seriously.

10 · Contact

For a data request, a privacy question, or a guardian withdrawing consent: privacy@navenapp.com. For a security report: security@navenapp.com. The operator’s legal name is in the Children’s Privacy Notice. Postal address: given on request by email. Telephone: given on request by email.

For schools and organizations: student data privacy, the data processing agreement, and how Naven meets each rule on the compliance page.

If this policy changes materially, members with an email address are told before it takes effect. The date at the top is always the current version.