WiseHaven privacy policy
Last updated 2026-09-22.
The short version
WiseHaven blocks and covers explicit images. The work of deciding what an image is happens on your own phone, and the picture never leaves it. What we keep on our servers is the small amount we need to run the service: who your account is, who is on your plan, what devices are on it, the policy you set, and a short list of events such as protection being switched off. We do not keep your browsing history, the pages you open, your messages, or your photos.
Who we are
WiseHaven is a product of Mammoth Web Solutions LLC. Write to us at privacy@wisehaven.co about anything in this document.
What stays on your device
These things are worked out on the phone or in the browser and are not sent to us:
- Pictures on the pages you open. Every image is scored by a model that runs on the device. The picture itself, and the score, stay there.
- The decision cache. A decision is remembered by a fingerprint of the image so the same picture is not scored twice. The fingerprint stays on the device.
- The blur. When an image is covered, the cover is drawn on that person's own screen. It is not a copy sent anywhere.
- The list of apps installed on the phone. The app reads it to show you the Native apps screen and to notice a second VPN app, because Android runs one VPN at a time. The list is never uploaded. The only app names that reach us are the ones you yourself add to a policy.
- The address you type and the pages you load. The browser's address field reads the tab it is showing. Nothing about the page is stored or sent.
- Bookmarks in the WiseHaven Browser. They are kept on that device and do not sync between devices.
What we store
Your account. Your name, your email address, whether that address has been confirmed, and the dates the account was made and last changed. Your password is stored only as a hash, never as text you could read.
Your sign-in sessions. While you are signed in we hold a session record for seven days, or one day if you asked us not to remember the browser. It carries the session, your account id, the times, the address your browser connected from, and the browser's own description of itself. We also count requests for one minute at a time to stop abuse.
Password resets. A reset link holds a token that stops working after one hour.
Your plan. The plan type, whether you pay monthly or annually, the renewal date, how many people and seats it covers, the state it is in, the trial end date if you are in one, and the identifiers your payment provider gives us.
The people on your plan. A display name, which of the three relationships the profile is, an optional date of birth, whether the profile was converted from a child profile, a work email address on a business plan, and the seat state.
An organization, on a business or school plan. Its name, which preset it uses, the code people join with, and the number of seats.
The devices. A name you give it, the model, whether protection is on, when it was last heard from, when protection went off if it is off, the app version, a hashed token that lets that device talk to us, and a push token so we can send an alert. If a browser add-on is paired we also keep its token, its version, and when it was paired and last heard from.
The policy and its history. Every version of the settings you choose, so a device can be told what changed and you can see who changed what.
Requests. When someone asks for a site or an app to be allowed, we keep the request: what kind it is, its state, when it was made, who made it, which device, the app or site it names, and the change proposed.
Events. A short record of things worth telling someone about: protection disabled, a tamper attempt, a bypass attempt, a restricted install, a device offline too long, and the three billing ones. Each record holds the kind of event, when it happened, which device and person it belongs to, how long it lasted, whether protection was still on, the outcome, who it was sent to, and the delay that was applied.
A phone number, if you give one. The Keeper release process can use a phone number to check that two people are two people. The number is stored encrypted, and separately as a one-way fingerprint used only for that check.
Support actions. When our support team acts on a release case, we record the account, the action, the case, and the time.
What we never store
- What anyone reads. An event record is refused by the server if it carries a web address, a page title, an image, or page content. This is enforced in code, not only in policy.
- Browsing history, message content, or photo libraries.
- Screenshots, other than a feature that does not exist in the app you can install today. If that changes, this document changes first.
- Location, usage history, contacts, calls, or messages. The app does not ask for those permissions.
- Your data for training. We never use anything from a person's device to train or test our models. We use public and licensed datasets only.
- Error reports with anything in them. Crash reports are stripped of web addresses, images, page content, email addresses, tokens, and the policy before they leave the device or the server.
Who can see what
- A guardian sees the child profiles on their family plan: the policy, the devices, the requests, and the events.
- A Keeper sees the same for the adult who chose them, and only that.
- An administrator on a business or school plan sees the Members of that organization.
- Our support team can act on a Keeper release case, and every action is recorded with the time.
- Nobody sees pages, pictures, or messages, because we do not have them.
How long we keep it
| What | How long |
|---|---|
| Events | 90 days from the event, then deleted |
| Support cases and the phone fingerprint used for them | 90 days |
| A sign-in session | 7 days, or 1 day if you asked us not to remember |
| A password reset token | 1 hour |
| Rate-limit counters | 1 minute |
| Your account, plan, members, devices, and policy | until you delete the account |
The companies that handle data for us
We keep this list short on purpose.
- Render runs our servers and our database.
- Cloudflare serves our web pages, sits in front of our servers, and stores the files our apps download.
- Resend sends the emails we send you.
- Sentry receives error reports, stripped as described above.
- Firebase Cloud Messaging carries push alerts to Android devices.
- RevenueCat handles subscriptions bought through an app store.
- Stripe handles business and web billing.
Children
A child profile is set up by a guardian and has no login of its own. What we hold for it is a display name and, if the guardian enters one, a date of birth. There is a separate notice for guardians with the detail.
Your rights
Write to privacy@wisehaven.co and we will:
- tell you what we hold about you,
- correct anything wrong,
- delete your account and what belongs to it,
- give you a copy of what you gave us.
If you are on a plan someone else pays for, we will tell you what that person can see, which is listed above.
Changes
If we change what we collect, we will change this document, and where consent is required we will ask for it before the change takes effect.
Contact
Mammoth Web Solutions LLC