Privacy Policy

This policy explains what Havor (“Havor”, “we”, “us”, “our”) collects, why, and the choices you have. Havor is a place where AI builders launch, discover, and discuss products. By using Havor you agree to this policy together with our Terms of Service.

Who we are

Havor is an independent service operated from Singapore. Until Havor is incorporated as a company it is run by its founder; when we incorporate, the operator of Havor will become the Singapore-registered entity and we will update this page. As the organisation that decides how and why your personal data is handled, we are the data controller under Singapore’s Personal Data Protection Act (PDPA) and, where it applies, laws such as the EU/UK GDPR. Our privacy contact can be reached at hello@havor.io.

Information we collect

• Account information you give us: your email, name, username, and anything you add to your profile (bio, avatar, links, interests, and whether you show yourself as open to work).
• Content you create: products and their details, screenshots and logos you upload, comments, discussions, upvotes (“backs”), and who you follow. Most of this is public by design.
• Messages: the direct messages and crew group chats you send on Havor, and who you sent them to. These are private — we don’t publish them, and we don’t send them for automated AI scanning — but they are stored on our servers so we can deliver them, and we may access them where it is necessary to investigate a report or abuse, or where the law requires.
• Waitlist information: if you join the waitlist, your email, any link to your work you choose to share, and referral details. If you refer someone, we collect the email you provide to invite them — only invite people who are happy to hear from us.
• Information collected automatically: basic usage and device data, IP address, and server logs generated when you visit, plus cookies needed to keep you signed in, secure your session, and count product views without double-counting the same visit. We do not use third-party advertising trackers.

How we use your information

• To run Havor: create your account, sign you in, and display your products and activity.
• To keep the community safe: automated and human moderation, spam and abuse prevention, and leaderboard integrity.
• To communicate with you: transactional messages (sign-in, moderation outcomes) and, if you opt in, product updates and digests you can unsubscribe from at any time.
• To improve Havor, troubleshoot problems, and keep the service secure.

Where the GDPR applies, we rely on these legal bases: performing our contract with you (running your account), our legitimate interests (keeping Havor safe, secure, and working, and understanding how it is used), your consent (optional emails, which you can withdraw at any time), and compliance with legal obligations.

How we share information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with service providers who help us operate Havor, under agreements that limit their use of it:

• Supabase — database, authentication, and file storage.
• Vercel — hosting and content delivery (processes IP addresses and server logs).
• Resend — transactional and opt-in email delivery.
• Anthropic — automated content moderation (see below).
• TypeSafe AI — reads public content to test a second moderation check, sort a ship's comments for its builders, match help requests to builders, suggest who got past a problem you are stuck on, and suggest possible cofounders to builders who are both open to one (see below).
• Google Safe Browsing — checks the links you submit against known malware and phishing.
• GitHub — when you link a repository, we read its public data to help draft your listing and to verify a ship.
• Error monitoring (such as Sentry) — if enabled, receives technical error reports that may include your IP address to help us diagnose problems.

We may also disclose information if required by law, regulation, or valid legal process, or to protect the safety, rights, or property of Havor, our users, or the public. If Havor is later incorporated, restructured, or transferred, your information may move with the service, subject to this policy.

Your public content (products, comments, discussions, profile, and public stats) is visible to anyone, including people who are not signed in and search engines.

Automated moderation and AI

To keep Havor safe, content you post may be sent to Anthropicto be scanned automatically for spam, abuse, and policy violations. This content is used only to perform the moderation check and is not used to train Anthropic’s models. Automated checks can flag content, but decisions that meaningfully affect you — such as removing content or suspending an account — involve human review. If you believe a moderation outcome was wrong, you can contact us to obtain human intervention, express your point of view, and contest the decision.

We are also testing TypeSafe AIas a second automated check. It may receive public content you post (your listings, comments, discussion posts, help requests and public profile), never your direct messages. Its answers are recorded so we can judge its accuracy, and they do not affect any moderation decision. We also use it for three things builders see: sorting the comments on a ship into groups (questions, bug reports, requests) for that ship's own builders, picking which builders to tell about a help request from their public profiles and ships, and, when you post that you are stuck on the weekly bench, finding an earlier bench line about the same problem from someone who has since moved on. Only builders whose “Asks for help” setting is on are suggested. If your status is “Open to a cofounder”, it also reads your public profile and ships beside other builders with the same status, to suggest a few whose work fits yours. You are only shown to each other while you both keep that status, and changing it stops the suggestions. TypeSafe does not use this content to train its models.

Cookies

We use a small number of first-party cookies, and we do not use cookies for cross-site advertising or third-party analytics:

• Essential cookies keep you signed in and protect your session (including our sign-in and admin step-up cookies). Blocking them may prevent you from signing in.
• A functional cookie(named hv_vid) lets us count unique product views without counting the same visit twice. It holds a random identifier only, is set on your own device, is not shared with anyone else, and is never used to track you across other sites. If you are signed in we don’t set it — we count your views by your account instead.

Because these cookies are limited to running Havor and measuring activity on our own site — not tracking you across other sites — we do not show a consent banner for them. We honour recognised browser opt-out signals such as Global Privacy Control (GPC) where required.

International transfers

Havor is operated from Singapore, and some of our service providers are located in other countries, including the United States. When we transfer personal data overseas we take steps to ensure it receives a standard of protection comparable to that under the PDPA — for example, through contractual safeguards (and, for transfers subject to the GDPR, the EU/UK Standard Contractual Clauses). If you use Havor from outside Singapore, your information may be processed in countries with different data-protection laws than your own.

Your choices and rights

Wherever in the world you use Havor, you have the following core choices — we offer them to everyone, not only where a particular law requires it:

• View and edit most of your information from your profile and Settings.
• Request access to, and correction of, the personal data we hold about you, and withdraw consent for uses that rely on it.
• Export a copy of your data, and unsubscribe from optional emails, at any time from Settings.
• Delete your account at any time. When you do, we anonymize your public contributions in place (so discussions others took part in stay coherent) and remove your personal account data.

Depending on where you live, your local law may give you further rights, which we honour where they apply:

• Singapore (PDPA)— the access, correction, and consent-withdrawal rights above, and the right to complain to the Personal Data Protection Commission (PDPC).
• EU / UK (GDPR)— rights to access, rectify, erase, restrict, port, and object to the processing of your data, and to complain to your supervisory authority.
• California (CCPA / CPRA)— rights to know, delete, and correct your information, and to opt out of its sale or sharing — which we do not do.
• Other regions— where laws such as the UK GDPR, Brazil’s LGPD, Canada’s PIPEDA, or Australia’s Privacy Act apply to you, we honour the rights they give you.

To exercise any of these rights, contact us at hello@havor.io. We may need to verify your identity first. Where the law sets a deadline, we respond within it — for example, within one month under the GDPR (extendable for complex requests) and within 45 days under the CCPA/CPRA (extendable once, with notice).

Data retention

We keep each category of personal data only for as long as necessary for the purposes described in this policy. How long that is depends on whether your account is active, our need to provide and secure Havor, and any legal, tax, or dispute-resolution obligations that require us to keep it longer. After you delete your account, we remove your personal account data promptly; residual copies may persist in encrypted backups for up to 90 days before being overwritten, and anonymized content may remain.

Security

We take reasonable technical and organisational measures to protect your information. These include encryption in transit (HTTPS/TLS) and encryption at rest with our infrastructure providers, row-level access controls in our database so each account can reach only its own data, least-privilege access for the people who operate Havor, and step-up two-factor authentication for administrative access. No method of transmission or storage is completely secure, so keep your account credentials safe and let us know right away if you suspect unauthorized access. If a data breach affecting your personal data occurs, we will notify you and the relevant authorities (including Singapore’s PDPC) where the law requires.

Children

Havor is not directed to children under 13, and you must be at least 13 to use it. Where the GDPR applies and a higher age of digital consent is set (up to 16), that age applies instead. If we learn we have collected data from a child below the applicable age, we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date above and, where appropriate, notify you.

Contact

Questions about privacy, or want to reach our privacy contact? Email hello@havor.io.