Privacy Policy

The short version

• There is no advertising on Naven, no third-party analytics, and no tracking pixel. You are not the product because there is nobody to sell you to.
• Naven counts how many people read each of its public pages, and roughly where they arrived from — “a search engine”, “a link somebody shared”. It is a tally, not a trail: no cookie, no script, no address stored, and no row that represents a person. Section 8 explains exactly what is kept.
• Naven collects the minimum it needs to work: an identifier, a display name, an email address if you gave one, your messages, and when you were last here.
• Naven can read your messages in transit, because it screens them before delivery. That is a real trade and section 4 explains it rather than hiding it.
• Your messages are never sold, never shown to advertisers, and never used to train a model.
• Naven does not hold ID documents. The age check confirms control of an email address and nothing more, on purpose.
• Email us and your account and its content are deleted.

1 · What Naven collects

A hashed copy of your email address is stored so another member can start a conversation by typing an address they already know, without Naven publishing a directory anybody can browse. The stored value is a SHA-256 hash, and a lookup can reveal only your display name — never your address, and only if you switched that on.

Not collected: your birth date (only the band), your phone number, your contacts, your location, your browsing outside Naven, and any identity document.

2 · Why, for each thing

• Identifier, name, photo — so the people you talk to know who you are.
• Email address — to sign you in, to let someone who already knows it reach you, and to send the notifications and lifecycle email you can unsubscribe from.
• Age band — to decide which screening rules apply.
• Messages and files — to deliver them, and to screen them first.
• Last-active time — to show presence, and to stop re-engagement email going to somebody who has come back.
• Blocked-message count — to trigger age confirmation after three in a fortnight. It is cleared when the check is completed.
• Push subscription — to send notifications. Deleted when you turn them off, and automatically when your browser reports it as dead.
• How you first found Naven — so one developer can tell which of the things he writes actually bring anybody here. It is one word, it is never updated after sign-up, and it is never used to target anything at you.
• Marketing consent record — to prove Naven only advertises to people who asked it to. It stores when you switched it on and the exact sentence you agreed to, because a stored yes with no record of the question is not evidence of anything.

2b · Email Naven sends, and which of it you can refuse

There are three kinds, and they follow different rules on purpose.

• About your own account. A safety warning, a block or unblock, a guardian notice, an age-check code, someone asking to start a conversation, a missed call. These are not marketing and cannot be switched off while the account exists — turning off a warning about your own account would make the account less safe, not more private.
• Channels you joined. A weekly briefing of what was published in the channels you chose to follow. It is content you subscribed to rather than advertising, every source in it is linked, and every one carries an unsubscribe link that works.
• News and offers about Naven. Advertising. Off unless you switch it on in Settings — not pre-ticked, not bundled into the terms, and not implied by having made an account. Each one says it is an advertisement, carries Naven's postal address, and can be stopped in one click. Stopping takes effect immediately, not within ten business days.

Naven does not buy, rent, scrape or otherwise acquire email addresses. Every address it holds was typed in by the person who owns it, or supplied by Google when that person chose to sign in that way. Addresses are never sold or shared for anybody else's marketing.

3 · What Naven can and cannot read

Naven screens every message, picture and voice note before it sends. Screening a message and being unable to read it cannot both be true, so:

• Naven's servers can read message content in transit. Messages are encrypted in transit (HTTPS) and at rest, but Naven is not end-to-end encrypted. If that is your first requirement, use Signal.
• No human reads your messages as a matter of course. Screening is automated. A message is classified and the classification is what is acted on.
• A voice note is transcribed to screen it, and the transcript is thrown away unless you ask for it to be kept. Screening always produces one and always destroys it immediately afterwards. The single exception is a setting you control: Settings → Let people read my voice messages, which is off unless you turn it on. With it on, the transcript of a voice message you send is attached to that message so the person receiving it can read it instead of playing it. It never applies to voice notes anybody else sends you, it only affects recordings made after you turn it on, and turning it back off stops future ones without altering messages already sent. The choice is the speaker's, because the words are theirs.
• Call audio and video are not screened and not recorded. Calls pass through a real-time provider (Agora) and Naven keeps no copy.
• Screening does not create training data. Content sent to a classifier is classified and discarded.

4 · Who else handles your data

Naven is a small product standing on other companies' infrastructure. Each of these processes some of your data to do a specific job:

These are processors, not partners: none of them is given your data to use for their own purposes, and none of them pays for it. Naven has never sold data and has no plan to.

Where your data physically sits. Cloudflare runs at the network edge and Firebase in Google's data centres, which means your data may be processed outside the country you are in. That is inherent to using a global platform, and it is the honest answer rather than a claim of a single location.

5 · How long it is kept

6 · Children's data

Naven is used by children and is designed for that rather than pretending otherwise.

• An account that says it belongs to someone under 13 may message, under Naven's strictest screening. If it repeatedly sends something the screen refuses, messaging is suspended until a parent or guardian approves it by clicking a link sent to their own inbox — and for a child that is the only way through.
• The approval email explains what Naven is and exactly what it screens for before asking for consent, including what is and is not screened and the fact that Naven is not end-to-end encrypted.
• A guardian can withdraw consent at any time by emailing us, and the account is disabled or deleted as they prefer.
• The only extra data collected for a child's account is the guardian's email address, used solely for that approval.
• Stricter screening rules apply to under-13 and teen accounts, including patterns associated with grooming and with a child posting their own address or phone number.
• No child is profiled, segmented or advertised to. The page counts in section 8 identify nobody at all, and nothing Naven records about any account — a child's least of all — is used to target advertising, because Naven has none to target.

Naven deliberately holds no identity documents. Age confirmation proves control of an email address — a guardian's, for a child. Verifying age with a passport scan would mean holding scans of children's passports, which is a category of data worth not having.

7 · Your rights, and how to use them

Depending on where you live you may have rights under the UK GDPR, the EU GDPR, the CCPA or similar law. Naven applies them to everyone rather than checking your postcode first:

• See what is held about you — ask, and you get it.
• Correct it — your name and photo are editable in Settings; ask for anything else.
• Delete it — ask, and your account and its content are removed.
• Export it — ask, and you get a machine-readable copy.
• Stop the email — every non-essential email has a working one-click unsubscribe, and Settings has a switch. Unsubscribing does not affect your account.
• Object — tell us and we will explain the basis or stop.

One request handles any of these: shervin@shapoury.com. Expect a reply within 30 days, usually much sooner.

One limit worth being clear about. Deleting your account cannot unsend messages you already sent to other people. Those sit in the other person's conversation, which is theirs. Naven will not reach into somebody else's inbox and rewrite a conversation they took part in.

8 · Cookies, browser storage, and what gets counted

Naven sets no advertising or tracking cookies, and loads no analytics script, tag manager or pixel from anyone. There is no consent banner because there is nothing being shared with a third party to consent to.

What is stored in your browser, and why:

• Your sign-in session, so you stay signed in.
• Your theme, sound preference and muted conversations.
• Any developer code you have redeemed — on that device only.
• One short note of how you first reached Naven — a single word such as “google” or “direct”, plus which page you landed on. It is written once, never updated, and means nothing on any other website.
• A short-lived signed cookie on the admin page, which only the operator uses.

All of it is removed by clearing site data for navenapp.com.

The page counter

Naven counts visits to its public pages on the server, as each page is sent. This is how one developer finds out whether anything he writes is read — without it, the honest answer to “is the safety page useful to anyone” is that nobody knows.

What that count contains:

• The date, the page, and where the visit came from — reduced to one word, such as “google”, “reddit”, “chatgpt” or “direct”.
• A number. Ten people reading the same page produce one row saying “10”, not ten rows.

What it deliberately does not contain:

• No IP address. It is never read for this and never stored.
• No identifier of any kind — no cookie, no fingerprint, no visitor id. There is no row that represents a person, so there is no browsing history of yours to hand over, leak, or change our minds about later.
• Nothing about signed-in members' use of Naven itself. Conversations, channels and the assistant are not counted at all.
• Nobody else's copy. The counts stay in Naven's own database and are read by one person.

If your browser sends Sec-GPC, nothing is counted for your visit at all. That signal is about selling personal data, which Naven does not do — but it is a clear statement that you would rather not be included, and honouring it costs nothing.

Crawlers — Google's, and the ones belonging to AI assistants — are counted separately under their own names, and are never mixed into the number of people.

9 · Security, and its limits

Everything is served over HTTPS. Message access is enforced by database rules rather than by the app being polite about it, so a member can only read conversations they belong to. Uploads are keyed to the uploader. Secrets live in the server's secret store and never in the code. Push payloads are encrypted for one device.

What that does not mean. Naven is a free product built by one person. It has not had an external security audit. No system is unbreachable, and anyone who tells you otherwise is selling something. If something is genuinely private and high-stakes, use an end-to-end encrypted tool — and if you find a vulnerability here, please report it to the address below and it will be taken seriously.

10 · Contact

Naven is operated by its developer, Shervin Shapoury. For a data request, a privacy question, a guardian withdrawing consent, or a security report: shervin@shapoury.com.

If this policy changes materially, members with an email address are told before it takes effect. The date at the top is always the current version.