Everything Haven does,
explained simply.

Each circle is a cryptographic group. Every post, comment, reaction, message and media file is sealed to the exact set of members with a fresh content key, wrapped individually for each member using a hybrid post-quantum key exchange (X25519 + ML-KEM-768) and signed (Ed25519 + ML-DSA-65).

Membership is enforced by the math, not by a server's permission check — there is no server. Posts are signed by the author's identity key, so members can always attribute and, if needed, remove a bad actor. Per-circle privacy (Spotlight exclusion + Face ID lock) is built in.

The feed is built by a deterministic reducer over the stream of sealed events each member receives (posts, edits, unsends, reactions, comments). Edits and unsends are themselves signed events, so history stays tamper-evident. Media is content-addressed with BLAKE3 and chunked into 512 KB sealed pieces, so the same photo is never stored or sent twice.

Capture uses AVFoundation (AVCaptureSession): tap for photo, hold to record, flip, flash. Captured files live only in the app's sandbox and are sealed end-to-end before they ever leave the device. There are ten filters — nine Apple-style variants plus the Kodak Gold film look — applied on-device.

Privacy hygiene is built in: GPS/EXIF location and identifying maker tags are stripped by default on capture, the camera pipeline calls no third-party SDK, logs nothing, and temp files are deleted once the post is sealed. Apple's on-device SensitiveContentAnalysis can blur sensitive media with tap-to-reveal, with zero data collection.

A DM is modeled as a tiny circle (a deterministic dm: group); a group DM is the same construct with more members — so both reuse the exact same sealing, signing and delivery path as group posts, one battle-tested code path, not a special case. Every message carries its author's signed identity, a timestamp, and a delivery receipt. Scheduled messages are sealed up front and released at the send time; secret messages render in a screenshot-protected view (a secure field on iOS, FLAG_SECURE on Android).

Calls use WebRTC for real-time audio/video and screen share, negotiated peer-to-peer over Haven's encrypted transport. On Apple platforms the system call UI is CallKit; on Android it's Telecom/ConnectionService. When two peers can't connect directly (hard NAT), a stateless connection relay forwards the encrypted stream — it never decrypts a frame.

The post carries a tiny TrackRef (catalog id, title, artist, artwork URL, duration) — never the audio data — sealed inside the same encrypted event as the rest of the post. Each viewer plays it through their own MusicKit subscription; without one they get a 30-second preview or a tap-to-open link. Haven never sees your Apple ID or listening history.

An AudioCoordinator owns both the music player and the video player and ramps volumes over ~300–500ms for the crossfade; only one post's audio plays at a time. The feed pill, animation, crossfade, and live Apple Music playback are all shipped (the MusicKit entitlement is granted on the App ID).

Reactions and comments are sealed, signed events addressed to the same circle as the post they attach to, then folded into the feed by the same reducer. They flow peer-to-peer over whichever path is available (nearby, direct, or relay).

On Apple devices this is MultipeerConnectivity (Bluetooth + local Wi-Fi); on Android it's the Nearby Connections API. A mesh relay hop lets one internet-connected phone forward a sealed message onward for a friend who's only reachable over the local mesh — still ciphertext only, end to end.

Per-circle privacy combines biometric gating (Face ID / Touch ID) with Spotlight exclusion so locked circles don't surface in system search. The master seed that unlocks your identity is itself Secure-Enclave-wrapped on-device, so even a raw Keychain dump yields nothing without your biometrics.

A multi-identity switcher, move-to-device via a transfer code / QR (haven-seed:…), iCloud-Keychain backup/restore of identity history (the active seed stays device-only), and multi-token push so every linked device gets notifications. A user's own devices self-sync their circles, posts and profile so they converge to the same state — the sync path is strictly additive, so a freshly-restored or empty device can never tombstone content that already exists elsewhere.

The target design gives each device its own key, signed into an account device-list by your long-term identity key — so adding or revoking a device (e.g. a lost phone) is instant and never changes who you are to your contacts. No private key is ever copied between devices.

One Rust core (p2pcore) handles identity, hybrid post-quantum crypto, circles, and the social engine, shared by every platform. The transport ladder picks the best path automatically: nearby (Bluetooth/Wi-Fi) → direct (iroh QUIC with NAT hole-punching) → relay (only if nothing local works). Above the transport, everything is opaque encrypted bytes.

Discovery uses signed records on the decentralized mainline DHT (the one BitTorrent uses) keyed by your public key — so a link to you is permanent with zero backend. The result is a one-time-price app with no monthly operator cost, ever.