How Haven works,
in human terms.
Haven is open about exactly how it's built. Below is a friendly overview of the big ideas, each linking out to the full technical document in the repository. Read as deep as you like.
One shared core, every platform.
At Haven's heart is a single piece of trusted code — a Rust core that handles your identity, the encryption, your circles, and the social engine (posts, stories, messages, reactions). Every app, on every platform, runs the same core, so the security never depends on which device you're holding. The user interface on top is native to each platform (SwiftUI on Apple, Jetpack Compose on Android, a lightweight web view on Windows/Linux), but the trust layer is one and the same everywhere.
When you share something, Haven automatically picks the best route to your friend: nearby first (Bluetooth/Wi-Fi, even with no internet), then a direct peer-to-peer connection, and only a relay if nothing else reaches them. Above that transport, everything is just opaque encrypted bytes.
🛡️ Threat model ↗
Who Haven protects, against whom, and the honest non-goals. Includes the real story on IP addresses, post-quantum encryption, abuse resistance, and lost-device protection.
🛰️ Relays & deployment ↗
The two relay roles (switchboard and mailbox), the zero-operator-cost storage model, the IP-privacy guarantees, and the one-command deployment tool.
🔌 Relay over Haven Net ↗
How a volunteer's storage runs with no public host at all — the encrypted tunnel that lets a relay live on a phone or laptop behind a normal home router.
🗄️ Bring your own storage ↗
iCloud, S3, Google Drive, Dropbox or a NAS — with no secrets we host. How PKCE lets the app sign you in without ever holding a client secret.
🎞️ Media & music ↗
The in-app camera, film filters, Apple Music on posts (references only, never audio), and the music ↔ video crossfade — each with its security audit.
🔗 Multi-device ↗
One identity, many authorized devices, each with its own key that never leaves it. Linking, receiving everywhere, and instant revocation of a lost device.
🔔 Notifications ↗
Why reliable push needs some server, and how Haven keeps it zero-knowledge: a blind relay that forwards an encrypted blob your device decrypts on its own.
🔗 The link & QR system ↗
Why your public key is your permanent address, how a reach-me link works with no backend, and why every connection is approved, never automatic.
💸 Operating costs ↗
Why Haven is a one-time price with no subscription and no monthly operator cost, ever — and the honest trade-offs that make that possible.
🤖 Android parity ↗
How each feature reaches Android by sharing the same Rust core — what's full-parity, what's redesigned (and healthier for it), and what's parked.
🗺️ Roadmap ↗
What's done, what's in progress, and what's next — milestone by milestone, including the features still being wired up.
🐧 Linux ↗
First-class desktop app and relay daemon across Ubuntu, Debian, Raspbian, Arch and SteamOS — packages, services, and a Pi relay path.
A few words, demystified.
- End-to-end encrypted — locked on your device and only unlockable by the people you're sharing with. No one in the middle has a key.
- Peer-to-peer — your devices talk directly to each other instead of through a company's servers.
- Post-quantum — extra-future-proof encryption that even a future quantum computer can't crack, defending against "save it now, decrypt it later" attacks.
- Relay — an optional always-on helper that holds your circle's encrypted messages for offline friends and forwards calls. It can never read your content.
- Circle — one of your private groups. Everything in a circle is sealed to exactly the people in it.
- Seed / key — the secret that proves you're you and unlocks your content. It lives only on your devices, wrapped by the hardware Secure Enclave.