Privacy Policy

1. Who we are

"Evolv Journal" (the "app," "we," "us") is a personal journaling and change-tracking app for iOS. This Privacy Policy describes how we handle information you provide to us when you use the app.

2. Information we collect

2.1 Information you provide directly

• Email address. Required to create your account. We use it to send you a one-time sign-in code and, if needed, to contact you about your account.
• Photos. Photos you choose to add to your journal entries. These are uploaded to your private storage area and are never shared with other users.
• Journal entries and notes. Text, mood/feeling selections, and other content you enter in your daily logs.
• Routine entries. Names and notes for products or items you add to your routine.

2.2 Information generated automatically

• User ID. A unique identifier generated when you create your account. Used internally to associate your data with your account.
• Timestamps. When entries were created or updated.

2.3 Subscription information (Evolv+ subscribers only)

If you subscribe to Evolv+, Apple processes your payment and passes us an anonymized transaction identifier via RevenueCat, our subscription management provider. We do not receive your name, billing address, card number, or any payment details. We store only:

• Your entitlement status (active / inactive / expiring) — so the app knows what to show you
• Your subscription tier (free / plus / lifetime)
• The expiry timestamp of your current subscription period

RevenueCat has its own privacy policy at revenuecat.com/privacy. RevenueCat acts as our data processor for subscription state. We do not share any subscription data with third parties for advertising or tracking purposes.

2.4 Analytics events (PostHog EU)

We use PostHog (EU cloud region) to collect a small set of anonymous product-interaction events — for example, "app launched", "entry saved", and "subscription screen viewed". These events include no personal content from your journal. They are linked to a randomly generated distinct ID, not to your email or real identity.

We have signed a Data Processing Agreement (DPA) with PostHog. PostHog's privacy policy is at posthog.com/privacy. Autocapture is disabled — only the explicit events listed in our engineering documentation are sent.

2.5 Crash and error diagnostics (Sentry)

To find and fix bugs, we use Sentry. When the app hits an error, Sentry receives a diagnostic report: the error type, a stack trace, basic device/OS information, and your user ID — so we can tell whether a bug affects one account or many. These reports contain no journal content, photos, notes, or email address, and network request URLs are stripped of query strings before they are recorded. Sentry's privacy policy is at sentry.io/privacy.

2.6 AI weekly review (optional, Evolv+)

Evolv+ subscribers can turn on an AI weekly review — a short written reflection on the week you logged. It is off until you opt in (Settings → "Receive AI weekly review") and you can turn it off again at any time.

When it runs, that week's photos and notes are sent to OpenAI to generate the summary text. This processing happens under OpenAI's Zero Data Retention terms: OpenAI does not store your photos or notes after generating the response, and your data is never used to train OpenAI's models. The links we send for your photos expire automatically a few minutes after the summary is created. OpenAI's privacy policy is at openai.com/policies/privacy-policy.

If you never enable the AI weekly review, none of your data is ever sent to OpenAI.

2.7 What we do not collect

• We do not collect your name, phone number, address, or any government identifiers.
• We do not collect precise location, contacts, calendar, microphone audio, or health data outside what you voluntarily enter as notes.
• We do not use advertising SDKs or data-broker integrations. The only third parties that ever receive your data are the processors listed in §2.3–§2.6, and none of them use it for advertising. There is no behavioral advertising profile of you.

3. How we use your information

• To provide the app. Show you your own entries, photos, and routines.
• To authenticate you. Send your one-time sign-in code and keep your session valid.
• To support you. Reply if you email us.
• To meet legal obligations. If required by law.

We do not use your information for advertising, do not sell it, and do not share it with third parties for their own marketing.

4. Where your data lives

Your account, journal entries, and photos are stored using Supabase — a database and storage provider that acts as our data processor. Supabase stores your data on servers operated by AWS. By using Evolv Journal you acknowledge that your data may be processed in regions where Supabase operates infrastructure.

Supabase has its own privacy policy available at supabase.com/privacy.

Besides Supabase, a small number of other processors handle specific functions, each described above: RevenueCat for subscription state (§2.3), PostHog (EU) for anonymous product analytics (§2.4), Sentry for crash diagnostics (§2.5), and — only if you opt in — OpenAI for the AI weekly review (§2.6). We do not share your data with any third party for advertising, marketing, or cross-app tracking. If our list of processors changes materially, we will update this policy and notify you.

5. How long we keep your data

We keep your data for as long as your account exists. When you delete your account, we delete your data within 30 days, including:

• All journal entries, notes, and routine entries
• All photos you've uploaded
• Your account record and email

Limited records may be retained briefly afterwards if required by law or to resolve disputes. Backups are rotated out within 90 days of deletion.

6. How to delete your account

Open the app → Settings → Delete account. You'll be asked to confirm by typing DELETE. Once you confirm, your account and all associated data are scheduled for removal. You can also email support@evolvjournal.app to request deletion if you can't access the app.

7. Your rights

Regardless of where you live, you can ask us to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data
• Export your data in a portable format

To exercise these rights, email support@evolvjournal.app. We respond within 30 days.

7.1 If you're in the EU/UK (GDPR)

Our legal basis for processing your data is your consent (when you create an account) and our legitimate interest in providing and securing the app. You have the right to withdraw consent at any time by deleting your account, to lodge a complaint with your local data protection authority, and to object to processing.

7.2 If you're in California (CCPA/CPRA)

You have the right to know what personal information we collect, to delete it, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share your personal information.

8. Security

We use industry-standard security practices, including:

• HTTPS/TLS for all data in transit
• Encryption at rest for your photos and journal data
• Row-level security on the database — your account can only access your own data
• Email-based one-time passcode authentication, with no password to leak

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the appropriate authorities as required by law.

9. Children

Evolv Journal is not directed to children under 13, and we do not knowingly collect data from children under 13. If you believe a child has provided us with information, email support@evolvjournal.app and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective" date at the top of this page tells you when the current version took effect. For material changes, we will give you advance notice in the app or by email before the change takes effect.

11. Contact

Questions, requests, or concerns? Email support@evolvjournal.app.