Account security and privacy

A few habits that go a long way:

Use a strong, unique password

• At least 12 characters.
• Don't reuse a password from another service.
• A password manager is the easiest way to manage this without remembering everything.

Watch out for phishing

We will never:

• Ask for your password by email or chat.
• Ask you to send your verification code to anyone.
• Send you a link that asks for your password to "verify your account".

If you get a suspicious message claiming to be from Exohaven, forward it to the contact form (topic: Trust & safety) and we'll confirm.

Be careful with invite links

Invite links are anyone-with-the-link. If you paste one publicly, anyone who finds it can join the trip as the role specified.

• Send invites through 1:1 channels (DM, email, messaging app).
• Revoke any link that's been shared more widely than you wanted.
• For sensitive trips (work events, surprises), prefer viewer access where possible.

What we collect

We collect what's necessary to run the product and improve it:

• Account data — name, email, password hash, profile photo.
• Usage data — which features you use, how often.
• Itinerary content — the trips you build are stored so you can return to them.
• Anonymised analytics — with your consent.

See the Privacy Policy for the full picture.

Delete your account

You can request account deletion via the contact form (topic: Account / login). We'll confirm and process within seven days. We keep what we're legally required to (typically billing records) and delete the rest.

Reporting a security issue

Found a vulnerability? Please disclose responsibly via the contact form (topic: Trust & safety). We acknowledge within one business day and won't pursue researchers acting in good faith.