Privacy Policy

1. Who we are

Evaari ("Evaari", "we", "us") runs the Evaari apps for iPhone, iPad and Android and the website evaari.com (the "Services"), and is responsible for the personal information described here (the "controller"). This policy works together with our Terms of Use.

Contact: [email protected], subject "Privacy Request". Our postal address is available on request at the same address.

2. What we collect

Your account. You can start as a guest and later link a sign-in method.

• Sign in with Apple: an Apple user ID, the e-mail address Apple shares with us (it can be a private relay address; our e-mails, such as sign-in codes, still reach you through it) and, the first time, your first name if you allow it.
• Google: a Google user ID, your e-mail address and your first name.
• E-mail: your e-mail address. We send you a one-time code to sign in. In the current app we store the code only in a scrambled (hashed) form; some sign-in records from the earlier version of Evaari are still stored in their original form (section 16). Accounts from an earlier version of Evaari may still have a password, which we keep only as a salted hash.
• Technical: an install ID, your platform and app version, and security records of sign-ins.

What you tell us in the app. The name you want Evaari to use and how he should address you, your age range (optional: "Prefer not to say" is fine), your language and time zone, your onboarding answers (goals, what gets in the way, your rhythm, reminder times and your Wheel of Life ratings), how you heard about Evaari (optional) and your settings.

Your steps and progress. Habits and steps (including habits you want to break), check-ins and timers, daily quests (which ones you were offered, swapped and finished), streaks and streak freezes, light, Evaari's forms, stars, cups, leagues, achievements, rewards and finds, mood check-ins with their tags and notes, journal notes, Wheel of Life updates and your plans.

Talks with Evaari. The messages you write, your voice messages and their transcripts, photos you send in a talk, Evaari's replies, short summaries of talks, your letters from Evaari and, only if you turn memory on, the short notes Evaari remembers (section 4).

Photos you show Evaari (Moments). Moments ("Show Evaari", the photo album and stories for friends) is arriving in Evaari's updates; this part applies once it is in your app (section 6). When you show Evaari a photo, we collect:

• the photo. Before it leaves your phone, the app makes a new, smaller copy (at most 1,600 pixels on the long side) without the location tag or other hidden details (such as EXIF data). Our server then makes two light versions and keeps only those, never the original;
• an optional caption (up to 80 characters), the date, and the step or quest the photo belongs to;
• Evaari's words and sticker for it, and the result of the automatic check (section 4): a category such as "ok", whether a person or a lot of text is in the picture, and when it was checked. Only if memory is on, we also keep up to five plain words about what is in the picture (for example "tea" or "park"); they are never shown to anyone;
• if you show photos to friends: who can see your stories (all friends or the ones you choose), the stickers friends send you and the ones you send, which friends' stories you have already opened (only to mark the new ones for you), whose stories you hide, and your photo settings;
• reports about photos and what came of them (section 6).

Friends and games. Your display name, @username and Evaari's look, friend requests and friendships, invite links and QR codes you create or use, reactions, waves, duo streaks, quests for two, marathons, games and their moves, inbox items, blocks and reports.

Purchases. Your plan (Free or Plus), trial and renewal status, the store, the product, transaction IDs and dates and, once Lumi are available, your Lumi balance and the history of what you bought and spent. Apple or Google handle the payment, so we never see your card details.

Notifications. A push token for each of your devices, the permission status, your notification settings and quiet hours, the reminder times you choose, the hours when you usually open the app (so Evaari's notes come at a good moment), and a record of which notifications were sent and opened.

Device and usage data. Device type and model, operating system, app version, language and region settings, time zone, IP address (in our server logs), app events (for example "step checked" or "screen opened"), test groups when we try out a change, crash reports and performance data. If you join through an invite link, we receive the invite code and, on Android, the Google Play install referrer.

Support. What you send us through "Write to us" or by e-mail, together with your app version and device type.

What you must provide and what is optional. To use Evaari, the app needs basic technical data (such as an install ID, your device type and app version); to keep your progress across devices, it also needs a sign-in method. Everything else is up to you: your name, age range, answers, moods, journal, talks, photos, voice and friends. Without some of it a feature may not work, for example there are no talks with Evaari and no Show Evaari without your agreement to the AI service, and no friends features without a display name.

What we don't collect. We don't ask for your contacts, precise location or health-app data. We don't run ads, don't use advertising identifiers for advertising, and don't track you across other companies' apps or websites. We don't use face recognition. The camera is used only to scan a friend's QR code (on your phone) or to take a photo that you decide to send to Evaari, in a talk or with Show Evaari. When you pick a photo from your gallery, the app reads only the photo you pick. The microphone is used only while you record a voice message.

3. Why we use it

Sensitive information. Talks, moods, journal notes, photos and some habits can reveal information about your health or other sensitive topics. We use it only to provide the Services to you and to keep you safe and, where the law requires it, only with your explicit consent: your agreement to the AI service and the separate memory switches. We never use it for advertising.

We don't make decisions about you by automated means that have legal or similarly significant effects. Things like Evaari's step suggestions, the daily quests or the timing of notifications are automated, but you are always free to ignore them. The automatic check of a photo decides only whether that photo is kept and whether it can be shown to friends; it never decides anything else about you, and you can write to us if you think it got a photo wrong.

4. How Evaari's AI uses your data

• What is sent. Only after you allow AI replies, when you use an AI feature (a talk, Show Evaari, words for today and other daily lines, step suggestions, "make it easier", the weekly review or insights), we send what is needed to OpenAI: your message or photo, the recent part of the talk, and context such as the name you chose, your answers, your language and form of address, whether you are a teen or an adult, today's steps, recent moods and relevant notes and summaries. Voice messages are sent as audio to OpenAI's speech service to turn them into text. Before a note goes into memory, we remove things like phone numbers, e-mail addresses, street addresses and card or ID numbers.
• Photos you show Evaari. A smaller copy of the photo (768 pixels, made in our server's memory and never stored) goes to OpenAI together with your language, the time of day, Evaari's form, whether the photo is for a habit, a quest or just a photo of the day, and the step's name (only for a quest or a habit you show to friends; for a habit you keep to yourself, only its area of life, for example Body). In one request the AI checks the photo, writes Evaari's words and picks his sticker; Evaari looks at each version of a photo at most twice. The check notes only whether a person is in the picture, never who it is. A caption is checked too, and before a photo with a caption reaches friends, the caption and the picture are checked together.
• Your consent first. The app asks you once: in a separate window the first time you open a talk with Evaari or, if you show Evaari a photo first, with the tick box "Let Evaari's AI look at my photos" in the "Before the first photo" sheet. It is one agreement, saved with your account: whichever way you give it, it covers talks and photos on all your devices. The talk window says what is sent and to whom; the photo sheet links to "How photos are kept", which does the same. Signing in, entering your e-mail or finishing the onboarding never gives this consent. Until you allow it, and after you turn it off, nothing you share (your talks, name, answers, moods, steps, messages or photos) goes to the AI service: talks are paused, Show Evaari doesn't take photos, and the rest of Evaari keeps working with ready-made texts written by our team. The one exception is the short automated safety check of what you choose to show to friends (such as a display name), described below: it protects other people and never creates replies.
• Not for training. We use OpenAI's API with storage switched off. Under OpenAI's API terms, this data, your photos included, is not used to train their models. OpenAI may keep API data for up to 30 days to detect abuse and then deletes it, unless it has to keep it longer to meet a legal obligation or to protect its services or other people from harm. Instead of your user ID, we send a scrambled identifier.
• Models. Talks, Evaari's look at your photos and all other text features (summaries, suggestions and safety checks) use OpenAI's gpt-6-luna model. Voice messages go to OpenAI's speech-to-text model, and an OpenAI embedding model helps Evaari find relevant notes. If we add another AI provider, we will update this policy first.
• Safety checks. The same AI request also checks your latest message or photo for signs of risk, together with a word list in 12 languages that runs on our server. A name, step or caption you choose to show to friends gets a short automated safety check too. Without your consent to the AI service, your private texts and photos are checked only by that word list on our server. A photo the check can't assess is never shown to anyone but you (section 6).
• Evaari's voice. Evaari replies in text and never reads his replies aloud. The only word he says is his own name, from short recordings that come with the app, so no text of yours or his is sent anywhere to make audio. Other voices in the app, such as the letter and the sisters, are pre-recorded too and use no personal data.
• Memory, only with your consent. If you turn memory on, Evaari keeps short notes (up to 200 characters each) about what matters to you, so later talks feel continuous. Health-related notes need a separate yes and are off by default. Evaari never stores notes about religion, sexual orientation, politics, money details or legal trouble, about diagnoses, medicines or weight, or anything from a moment of crisis. Notes about a passing topic fade after 14 days. On Free, Evaari uses notes from the last 14 days plus key facts about you; on Plus, all your notes. Memory is off for people under 16, and so are the plain words about a photo (section 2).
• Your controls. In Me → Settings → What Evaari remembers you can see each note, delete it, choose "Forget everything", switch memory and health-related memory on or off, delete all talks and download your data.

5. Friends: what others see

• By default, friends see your display name and @username, Evaari's form and look, your streak, cups and league, and whether you checked in today. You can hide each of these in Me → Settings → Friends & privacy. Habit names, step counts and spheres stay hidden unless you choose to show them.
• Never shown to anyone: your talks, moods, memories, journal notes and Wheel of Life, and the photos you keep to yourself.
• People in your weekly league group see your display name, Evaari's form and your weekly light.
• Anyone who opens a personal invite link you created sees your display name (from age 16), Evaari's form and for how many days you have been growing Evaari. Share cards show your name only if you turn that on.
• There are no private messages: only preset reactions, waves, stickers and game moves. If you show a photo to friends, they also see its caption (section 6).
• Reports and blocks. If you report someone, we keep the reason, an optional note (up to 300 characters, visible only to our moderators) and a snapshot of the reported profile. The other person isn't told who reported them, or that you blocked them. Reports about photos are described in section 6.
• Age. For ages 13 to 15, friends work in a limited mode: only by link or QR code, no search by @username, no name on share cards and quiet from 20:00. For people under 13, friends features are off and their friends data is deleted. If we don't know your age, we may ask for your birth year before you add friends; only the age range leaves your phone.

6. Moments: your photos and stories

Moments is arriving in Evaari's updates. This section applies once Show Evaari, the photo album or stories appear in your app.

• Private by default. Every photo you show Evaari goes into your photo album, where only you see it. Nothing is shared unless you switch on "Show to friends".
• The check comes first. Evaari's AI looks at every photo before anyone else can see it (section 4). A photo the check stops is not kept: nothing of it is stored. A photo that is fine for you but not for others, such as a screen, a document or a picture that is mostly text, stays in your album just between you and Evaari and can't be shown to friends. If the check can't answer, the photo waits in your album, seen only by you; if it still has no answer after about 35 minutes, the photo is deleted. When a photo is stopped because of signs of self-harm, the app shows help lines for your country.
• Stories for friends. You can show a photo taken today to your friends. It is shown as a story for 24 hours from the first time you show it, then it stays only in your album. You choose who sees your stories: all friends, or only friends you pick, in Photos and story settings; a change works at once, for today's story too. Friends see the photo, your caption, Evaari's words and sticker, and the name of the step only for quests and for habits you show to friends. There is no public feed, and nobody else can open your photos, not even with a link.
• Stickers, not comments. Friends answer with stickers only. A friend sees which stickers a photo got, not how many. You see who sent stickers, never who looked: we note which stories a friend has opened only to mark the new ones for them, and delete that note after 48 hours. You can turn stickers from friends off, and hide anyone's stories; they aren't told.
• Quest for two. A photo you add to a quest for two is shown only to that friend, for the same 24 hours, next to theirs.
• Your choices. You can edit the caption, replace or delete any photo, or delete all your photos at any time. A deleted or replaced photo leaves your album and your friends' stories at once and is erased from our photo storage within the hour, with no copy kept. You can download all your photos at any time, for free (section 13). If you save a photo to your phone, that copy is yours and stays in your phone's gallery.
• Free and Plus. On Free, the album shows the last 30 days, and older photos rest behind a veil; on Plus, the whole album is open. Nothing is deleted for being old, and every photo can always be downloaded for free.
• People and private things. Only show people who are happy to be shown, and never other people's private information, such as documents, chats or addresses. When the AI sees a person in a photo, Evaari answers with one of a few ready-made warm lines and never comments on the person.
• Reports. If a friend reports a photo, it disappears for them at once. A report for nudity, violence, bullying, self-harm or someone's private information hides the photo from all friends until we have looked; you still see it, marked "Under review". The report (the reason and an optional note of up to 200 characters, seen only by moderators) and a copy of what was reported (the picture, its caption and Evaari's words) go to our moderators; we never tell you who reported it. That copy is kept in a restricted place, never shown in the app, for up to 30 days, and longer only when the law requires us to keep it. You can also report Evaari's words about your own photo: they are replaced at once, and the words go to our moderators.
• When the law is involved. If the check finds sexual content involving a minor, the photo is not kept, the account's friends features are paused at once and we act as the law requires, which may include reporting to the authorities.
• Screenshots. A friend can still take a screenshot. Show friends what you would show them in person.
• Age. Show Evaari and stories are off for people under 13. If we learn later that an account belongs to someone under 13, its photos leave every story at once, stay available for download for 30 days and are then deleted.

7. Notifications

With your permission, we send notifications through Firebase Cloud Messaging (on iPhone, through Apple's push service). Evaari sends at most two of his own notes a day, at least three hours apart, plus the reminders you set (scheduled on your phone), news from friends (for example when a friend sends a sticker to your photo: the notification shows their name and the sticker, never your caption or Evaari's words) and service messages. Quiet hours are 22:00 to 08:00 by default. We don't send marketing notifications. You can change any of this in Me → Settings → Notifications or in your phone's settings.

8. Analytics and crash reports

• Google Analytics for Firebase shows us which screens and features are used, with a random app-instance ID, device and app version, region and language. We don't send names, e-mail addresses, photos or what you write.
• Firebase Crashlytics (in store versions of the app) sends crash reports with device model, operating system, app version, language and Evaari's form.
• Our own server records a few key events (for example onboarding steps, the subscription screen and ratings) linked to your account.
• We don't use ad networks or data brokers. You can object to analytics at any time (section 13).

9. Purchases

Evaari Plus and Lumi are bought through the App Store or Google Play. Adapty manages subscriptions for us: it receives your Evaari user ID, purchase and renewal events, the product, store, country and currency, and your app version and device type. We have switched off IP address collection in Adapty. We never receive your payment card details.

10. Who we share data with

We don't sell your personal information and don't share it for cross-context behavioural advertising. We share it only with service providers that process it for us under contract, and only as much as they need:

We may also share information when the law requires it, to protect someone's safety or rights, or with a company that takes over Evaari, which then has to follow this policy.

11. Where your data is stored

Our servers and database are in the United States, and the photos you show Evaari are kept in a private Cloudflare R2 storage in North America that only our server can reach. Our providers may process data in other countries. When data leaves the EEA, the UK or Switzerland, we rely on the EU Standard Contractual Clauses (with the UK Addendum and the Swiss amendments), on the EU–US Data Privacy Framework where a provider is certified, or on other lawful safeguards. You can ask us for a copy at [email protected].

12. How long we keep data

13. Your rights and choices

Everyone can:

• see and download your data: Me → Settings → Your data → Export my data (a ZIP file of JSON files, with your photos; the link works for 24 hours);
• correct your profile in the app;
• delete notes, talks, photos or your whole account (section 14), and edit, replace or delete any photo, or delete all of them, in the photo album and in Photos and story settings;
• turn memory, health-related memory, notifications, friends sharing and stickers from friends on or off in the app, and choose who sees your stories;
• withdraw your consent to the AI service at any time in the app: Me → Settings → Privacy & data → Turn off AI replies. Your choice is saved with your account, and talks and Show Evaari pause until you allow AI replies again. Withdrawing doesn't affect what was processed before. Deleting your talks, photos and memory is a separate choice that you can make in the app at any time. You can also object to analytics by writing to us.

In the EEA, the UK and Switzerland (GDPR): you have the right of access, correction, deletion, restriction, data portability and objection, and you can withdraw consent at any time. You can also complain to your data protection authority.

In California and other US states with privacy laws: you have the right to know what we collect and why, to access, correct and delete it, to get a portable copy, and to opt out of the sale or sharing of personal information and of targeted advertising (we do none of these). You can limit the use of sensitive information (we use it only to provide the Services), appeal if we refuse a request, and use an authorised agent. You won't be treated differently for using your rights. On our website, we treat a Global Privacy Control signal as an opt-out.

In Brazil, Japan, South Korea, Türkiye, Canada and elsewhere: you have the rights your local law gives you, for example under the LGPD, the APPI, the PIPA or the KVKK.

How to ask: in the app, or by e-mail to [email protected] with the subject "Privacy Request". We may need to confirm that the request comes from you. We answer within one month (45 days under US state laws) and tell you if we need more time. If we say no, you can appeal by replying to our answer with the word "Appeal".

California notice. In the last 12 months we collected identifiers (such as user IDs, e-mail and IP address), customer records, commercial information (purchases), internet and app activity, audio (voice messages), photos you send or show Evaari, inferences about your preferences (such as memory notes), and sensitive information (account sign-in data, and health information you choose to share). We collected it from you and your device, for the purposes in section 3, and disclosed it only to the service providers in section 10. We did not sell or share it.

14. Deleting your data

• In the app: Me → Settings → Your data → Delete account. Your account and its data in our database are deleted right away: progress, steps, moods, talks, memory, letters, photos and stories, friends data, Lumi and settings. Right after that, a background process deletes your files (every photo is erased from our photo storage within the hour), your profile at Adapty and the Sign in with Apple link.
• Without the app: see Delete your account.
• What stays: a deletion record (an internal number and a date); AI cost records and safety counts without any link to you; security records that may contain limited technical identifiers (such as a device code) to protect accounts and prevent fraud; a scrambled device code used only to prevent invite-reward fraud; and, for Lumi purchases, a scrambled transaction code so a purchase can't be credited twice. Reports you made about other people stay so that we can finish handling them, but they are no longer linked to you; they still contain the note you wrote and a snapshot of the reported profile. If someone reported one of your photos, the copy kept for that review stays until its time is up (up to 30 days), no longer linked to your account. Copies in backups disappear as described in section 12.
• Deleting your account does not cancel a subscription. Please cancel it in your store account first.

15. Children and teens

• Evaari is made for a wide audience and has no age gate. We ask for your age range during onboarding (you can skip it) to adapt examples and safety features.
• Talking with Evaari's AI is for people aged 13 and older. If someone tells us they are under 13, in the age question or in a talk, talks with Evaari, voice messages and photos (in talks and with Show Evaari) are switched off, and an age range under 13 also switches off friends features and stories. They can still take steps, breathe and grow Evaari. What happens to the photos of an account we later learn belongs to someone under 13 is described in section 6.
• For ages 13 to 15, memory is off and friends features are limited (section 5). Purchases follow the parental controls of the device and store, such as Ask to Buy and Family Link.
• If you are a parent or guardian and think your child is using Evaari, write to [email protected]. After checking that the request comes from you, we will help you review the account, stop further collection and use of your child's information, or delete it.

16. Security

Data travels between the app and our servers encrypted (TLS). Access to our systems is limited to people who need it. In the current app, sign-in codes and tokens are stored only as hashes and Sign in with Apple tokens are encrypted; some sign-in records from the earlier version of Evaari are still stored in their original form. Passwords from the earlier version are stored only as salted hashes, and our server logs hide tokens, e-mail addresses and message text. The photos you show Evaari are kept in a private storage that only our server can reach: a photo opens only through our server, after it checks that the person asking may see it, with a link that works for a few minutes and only for that person. Backups are encrypted with a key that we keep offline. No system is perfectly secure, so please protect your device and sign-in, and tell us if you notice anything suspicious.

17. Website and cookies

• evaari.com has no advertising or tracking cookies and no third-party analytics.
• We count page visits with our own tool that stores nothing on your device: the page, the referring page, campaign parameters, device type, language and browser type, plus a one-way scrambled code made from your IP address and browser. If your browser sends Do Not Track or Global Privacy Control, nothing is counted.
• One functional cookie, lang, remembers the language you chose for up to 12 months. You can delete it in your browser at any time.
• Because there are no non-essential cookies, the website shows no cookie banner.
• In the app, we use storage on your device only to make the app work, for example to keep you signed in, save your settings and your choice about the AI service, and cache your progress.

18. Changes to this policy

We may update this policy. We will tell you about important changes in the app or by e-mail before they take effect and, where the law requires it, ask for your consent. The version and date at the top always show the current text.

19. Contact

[email protected], subject "Privacy Request". This policy is available in 12 languages. If a translation differs from the English version, the English version prevails, unless the law of your country requires otherwise.