Privacy & security (in depth)

You are trusting CareHaven with the most sensitive details of your family's life — diagnoses, medications, seizures, hard days, hopes for the future. This page explains, in plain language, exactly how those details are protected. The short version: your care log lives on your device, protected by your iPhone's own encryption and lock. If you choose to sync, only the people you specifically invite into your circle — signed into their own Apple account — can open it. Nothing is sold, tracked, or quietly collected.

If you want the gentle one-paragraph version instead, read Privacy comes first.

Your data is yours — encrypted so only you can read it

Every entry — logs, photos, transcripts, notes, voice dictation, everything — lives in your iPhone's own protected storage, secured by your device's encryption and your passcode or Face ID. The app works fully offline.

Your care log is encrypted so that only you — and the people you invite into your circle — can read it. Not us, not anyone else. What you enter is yours.

Available

No account, no sign-in, no tracking

You never make a CareHaven account. There is no email-and-password to create, no login screen, no profile on a website somewhere. You open the app and start using it.

CareHaven also does not track you. It uses no third-party advertising or analytics tools, and it does not follow you across other apps or websites. The app's privacy declaration to Apple is the simplest one possible: data not collected, tracking none.

Available

Privacy at a Glance — a live look at what's stored and shared

CareHaven gives you a live view of its privacy posture — not a static promise, but a real-time look at what's actually on the device, what's encrypted, and what's shared. It shows:

• The number of profiles and events stored locally — counted straight from the database, not estimated.
• Whether your storage is encrypted (AES-256).
• Your sync status — on or off, and which sections are shared with whom.
• AI access — when CareHaven sends a question to a smart-help service, what gets stripped out first, and the on-device-first order it prefers.
• Any active caregiver invites.

The point is that the privacy posture isn't abstract. "Nothing is sent anywhere unless you choose to" is the promise, and the live counts make it something you can verify. A regulator, a custody mediator, or a privacy-conscious family member can see exactly what's on the device in about ten seconds.

A tip: show this screen to a substitute caregiver before you hand over the phone. Seeing the privacy posture spelled out lowers the trust friction.

Available

Encrypted backups

You can save a complete backup of everything in CareHaven to a single file. That file is locked with strong encryption (AES-256-GCM) using a backup password you choose. Without that password, the file is unreadable — even to you, so keep the password somewhere safe.

You can back up by hand whenever you like, or set up an automatic schedule so a fresh backup is made for you. A backup made on your iPhone can be restored to your iPad or another device, which makes moving to a new phone straightforward.

A good habit: keep one backup in cloud storage and one somewhere else, like an external drive. Cloud-only is one bad day away from full loss; one copy in two places is much safer.

For the step-by-step, see Back up & restore your data.

Available

PIN and Face ID, with idle auto-lock

You can set a 4-digit PIN to lock the app. Once a PIN is set, the lock screen appears when you open CareHaven and after it has been in the background. This is genuinely useful when the phone might be seen by others — a clinic waiting room, a school meeting, a busy kitchen.

Alongside the idle timer, the app also re-locks itself the moment it is sent to the background or the screen loses focus, so it closes up the instant you switch away — not only after a wait.

When you have a PIN set, you can also unlock with Face ID, so getting back in is quick for you while staying closed to everyone else.

CareHaven adds an idle auto-lock on top of this. After about 5 minutes of inactivity it re-locks itself. Once a PIN is set, this idle lock is simply on — there is nothing extra to configure. You set the PIN, change it, or remove it whenever you want.

A backup password just for your backup files

Separate from the PIN, you can set a backup password that locks the backup files you create. To set it, go to Settings → Security → Backup Password → Set, enter a password you'll remember, and save it. The password is stored securely on this device, and it is required every time you create or restore a backup.

Creating a backup: go to Settings → Privacy & Data → Create Encrypted Backup, enter your backup password, and the app makes a .chbak file and offers it through your device's share sheet. From there you can save it to your cloud storage, email it to yourself, or share it however you like.

Restoring a backup: go to Settings → Privacy & Data → Restore Backup, pick your .chbak file, and enter the backup password. Everything is restored exactly as it was backed up.

A good habit: back up weekly, or before any major app update, and keep the file in cloud storage so it's reachable from any device. The backup password is never stored anywhere CareHaven can reach it, so keep it somewhere safe — without it, the file can't be opened.

Available

Smart help is private by design — and stays private by default

CareHaven's smart help is private by design: it runs on your device, and obvious identifying details — like the name of the person you care for — are stripped out on a best-effort basis before any request leaves your device. It's not perfect (it can't catch every name), but it meaningfully lowers what's exposed. This is true for every account, no subscription required.

If you have a Plus or Pro subscription, you can choose to turn on Online help in Settings -> AI Help. Before anything happens, a consent screen explains exactly what Online help does. Only if you agree does the app ever send a question to a cloud service — and even then, only general questions that have nothing tied to a specific person. Your person's name and other obvious identifiers are stripped from any question, on a best-effort basis, before it leaves your device.

The app shows a small source badge on every answer so you know whether it came from your device or from Online help. You can turn Online help off at any time in Settings -> AI Help.

There is a single master switch for all of this. The AI Knowledge Features toggle in Settings turns every AI-powered feature on or off at once. When you turn it off, no questions leave your device, period.

Voice dictation works the same way — under your control. Tap the microphone badge on any text field to speak instead of type. The audio is transcribed by your phone's own speech service, and only the resulting text is placed into the field. If you'd rather it never send any audio at all, turning the feature off fully prevents that.

A handful of other controls in Settings round this out, each one yours to set:

• Refill Notifications — an opt-in popup that warns you when a tracked medication drops below its refill threshold. It fires while the app is open, or catches you up the next time you launch. It needs notification permission to work.
• Anonymous Usage Analytics — off unless you turn it on. If you opt in, CareHaven shares anonymous feature-usage data — which features get used, never your content — to help improve the app.
• Demo Data — a toggle that fills the app with sample data so you can explore it safely. Your real data is preserved while demo is on and restored the moment you turn it off.
• Export All Data — download a complete copy of everything in CareHaven as a single file you keep.
• Clear All Data — permanently delete everything in the app. This cannot be undone. See Resetting CareHaven completely for exactly what that clears and how sharing is handled first.

Available

Resetting CareHaven completely

Settings → Privacy & Data → Clear All Data starts over from scratch — every profile, every logged entry, every photo and scanned document, your PIN, and all your app settings. It's meant for handing a device to someone else or starting fresh, not for everyday use.

Two things are worth knowing before you tap it:

• You're asked to back up first. The confirmation screens offer a detour to save a .chbak backup before anything is touched — take it. Once the reset actually runs, there is no built-in way to get the data back; a backup made beforehand is the only way in.
• Sharing is turned off before anything is erased. If you've shared a profile with a co-caregiver, CareHaven first tries to revoke every one of those shares over the network, so nobody keeps access to a profile you thought you'd erased. If that can't be confirmed — no connection, a slow network, iCloud signed out — CareHaven tells you plainly that sharing couldn't be turned off and does not erase anything on the device yet. From there you can try again, or choose to wipe it anyway; if you do, finish removing the old sharing access later from iPhone Settings → your Apple ID → iCloud → Manage Storage → CareHaven.

What a completed reset does not touch: a .chbak backup file you already saved (it lives outside the app, wherever you put it), and any Camera, Photos, Health, or Notifications permission you granted CareHaven — those stay granted in iOS until you turn them off yourself.

Available

Handoff and Care Card links, hardened

When you share a handoff or an emergency Care Card as a link — by text, AirDrop, or a printed QR code — the piece that actually unlocks it travels in a part of the link a web server never sees and never logs. So even if that link is ever opened through the web fallback page instead of straight into the app, nothing in any server's history could later be used to read it. Nearby device-to-device sharing (an NFC tap, AirDrop, an in-person handoff) never touches a server in the first place. Available

Optional sync, protected by your Apple account

Sync is off until you choose to turn it on. When you do, it can do two things, both optional.

First, it keeps your own devices in step — your iPhone and iPad showing the same care records.

Second, it lets you share specific profiles with another trusted caregiver so you can both keep the log current. You pick exactly which sections to share; the rest stays private to you. Sync is optional and off by default. Turn it on and your care log syncs — encrypted the whole way — reachable only by the people you specifically invite, each signed into their own account. Today that sync rides on Apple's iCloud (CloudKit), encrypted by Apple in transit and at rest. Not us, not anyone else — CareHaven cannot read your synced data. You can revoke a co-caregiver's access at any time.

From Build 78 you can also check that against iCloud itself. Who has access (Main Menu → Team → Shared with → Who has access) reads who can open a profile from iCloud rather than only from what this iPhone has stored — so it can show you access this phone holds no local record of, which happens for ordinary reasons like a reinstall or a new iPhone. It is written to explain rather than to accuse: when it can't line an entry up with anything on this phone it says so in plain words and leaves the decision to you. Anything on that list can be removed from there, one person at a time, with the person named in the confirmation. Revoking someone leaves their name in place marked Revoked with the date, as a record of what happened. Available

For the full picture, see Sharing care with others (sync) and Who has access. If you are clearing the whole app rather than one person's access, see Resetting CareHaven completely — sharing is turned off first, and nothing on the device is erased until that is confirmed, unless you read what it tells you and choose to wipe it anyway.

Available

Some sensitive plans stay out of your phone's system search

Your iPhone's own search can find many things inside CareHaven, which is handy. But the most sensitive items — like your Letter of Intent, your crisis plans, and the Health & Communication Passport — are deliberately kept out of the system-wide search. They open only inside the app, behind the app lock. So even if someone picks up your phone and searches, those plans do not surface.

Available

Sending feedback (when it arrives)

A built-in way to send feedback directly from the app is finished and on its way, but it is intentionally turned off in the current beta, so you will not see it yet. When it does arrive, it will be fully opt-in: you write the message, it gets a best-effort scrub on your device first (names, emails, and phone numbers it can recognize are removed — worth a quick glance before you send), and only your app version and a rough device description (like "iPhone, iOS 26") ride along — no care data, and never a silent send.

In the meantime, your feedback matters and is easy to share. You can send it through TestFlight, or email shawn@carehaven.org directly. See Giving feedback.

Coming soon

Read-only reference updates

CareHaven can top up its built-in reference databases — things like state resources, help topics, crisis resources, and tips — between App Store releases, without sending anything about you. The app checks a small public manifest and downloads only reference JSON files that actually changed. Downloaded reference files are cached on your device, and if the request fails the app falls back to the last cached copy or the bundle that shipped inside the app.

Once in a while we also publish extra guidance — a new tip sheet or resource — between app updates. When there's something new, a Supplemental updates row appears in Settings → About & Help. This content is supplemental only: the app is fully functional without it. It's read-only and the same for everyone, nothing about you is ever sent, and once it's loaded it's cached so it works offline.

Anything you find here is general information, not advice about a specific person — always follow your own clinician for the person you care for.

This system is read-only and one-directional: helpful content comes down, nothing about your family goes up. It never uploads care data, profiles, logs, medications, appointments, shared care records, or identifiers.

Medication lookup and food/nutrition lookup still use their own live-or-cached lookup behavior, because those searches depend on the specific medicine or food you ask about.

Available

A quick recap

• Your care log stays on your device, protected by your iPhone's own encryption and lock. If you sync, only the people you specifically invite — signed into their own Apple account — can open it. Not us, not anyone else.
• No account, no sign-in, no tracking, no data collection.
• Backups are locked with strong encryption and a password only you hold.
• A PIN, Face ID, and an idle auto-lock keep the app closed to others.
• Smart help is private by design for every account: it runs on your device and makes a best-effort pass to strip obvious identifying details — like the name of the person you care for — before anything leaves your phone. Online help (Plus/Pro) is opt-in and requires consent.
• Sync is optional and off by default. Turn it on and your care log syncs — encrypted the whole way. Today that runs through Apple's iCloud (CloudKit), encrypted by Apple in transit and at rest, reachable only by the people you specifically invite.
• Reference updates download public app content only; your care records are never uploaded as part of that process.

For what is still being built across the app, see Known limitations & what's coming.