EverDiary Privacy Policy
EverDiary ("EverDiary", "we", "our", or "us") builds a searchable memory of your life so you can ask questions like "Where did I park at Costco?" or "Who was that plumber?" This policy explains what we collect, why, and the rights you have over your data.
1. Who we are
EverDiary is operated by EverDiary LLC, located at 1111 6th Ave, Ste 550. Questions? Email support@everdiary.app.
2. What we collect
2.1 Data you give us directly
- Account: email address, password (stored as a bcrypt hash - we never see the plaintext), optional name.
- Memories you capture: text notes, voice recordings, photos, imported emails, imported text messages, optional location tags. This is your primary content.
- Documents Vault: images of everyday personal documents you choose to scan and store (receipts, warranties, tickets, manuals), plus the crop you apply and an AI-generated text description that makes the document searchable. The Documents Vault is not intended for medical records or prescriptions - EverDiary has no health features and does not process health data.
- Find My Stuff (items): photos of belongings and the storage location you type in (e.g. "garage, top shelf"), so you can later ask where an item is.
- Time Capsules: memories you seal until a future unlock date. Sealed content is stored (encrypted) like any other memory during the sealed period and is included in exports and deletions.
- Recipient email addresses: if you use the "email this document" feature, the recipient address you type is used once to deliver that email (via Resend) and is never added to any marketing list.
- Payments (Premium): processed by Stripe. We never store your card number. Stripe returns us only a customer ID and subscription status. We keep records of your subscription status, plan, billing events, and invoices (via Stripe) as long as needed for accounting, tax, and dispute-resolution obligations, and we send transactional billing emails (subscription welcome, cancellation confirmations, payment-failure notices) - these are service emails, not marketing.
2.2 Data we generate about your memories
- AI transcripts: Voice notes are transcribed to text using OpenAI Whisper.
- AI descriptions of photos: Each photo you save (including document scans and item photos) is analysed by OpenAI GPT-5.2 vision to produce a short searchable description (e.g. "receipt total $47.23, Whole Foods, Aug 12"). This is what lets us answer questions about the contents of photos later.
- AI answers & conversation history: Your questions to EverDiary and its replies are stored so the assistant can carry multi-turn conversations.
2.3 Data your device sends automatically
- Approximate technical info: app version, OS version, crash logs. Standard for any published mobile app.
2.4 What we do NOT collect
- We do not read your emails, texts, or contacts automatically. Any email or text message content in EverDiary is content you chose to paste or share into the app.
- We do not access your device's SMS/iMessage database. That is not possible for third-party apps on iOS, and we do not request the special permission required on Android.
- We do not sell your data. Ever. There is no advertising SDK in EverDiary.
3. Device permissions we request
- Microphone - only when you tap "record" to create a voice memory. Audio never leaves the device except to be transcribed to text and immediately discarded from our transcription pipeline.
- Camera - only when you tap "take photo" to create a photo memory.
- Photo library - only when you tap "pick from library" or "scan library" and pick specific photos. We do not scan your library in the background.
- Location (while using the app) - only when you tap "attach location" to tag a memory. You can decline and the memory is still saved without location.
You can revoke any of these in your device's OS settings at any time; EverDiary will keep working with reduced capability.
4. How we use the data
- To store and retrieve your memories at your request - including document scans, item photos, and time-capsule memories that stay sealed (encrypted) until the unlock date you chose.
- To generate transcripts, photo descriptions, and answer your questions using EverDiary. If you are in a family circle and use the family AI mode ("Ask Us"), memories that family members shared with the family may be used to answer each other's family-mode questions.
- To email a scanned document to a recipient you specify, only when you explicitly tap "Email" on that document (sent on your behalf via Resend).
- To operate your account, process Premium payments, and prevent abuse.
- To improve the app (aggregate, non-identifying usage patterns only - e.g. "N% of users use voice notes weekly").
We do not use your memories to train third-party AI models.
5. Voice recordings - your consent
By tapping record or using a voice feature, you give your explicit, affirmative consent for EverDiary and its processors (currently OpenAI) to collect, transmit, store, and process your audio recordings and their transcripts for the sole purpose of providing the app's features to you.
- We do not use recordings to biometrically identify you, and we do not create voiceprints or faceprints.
- We do not sell voice data or use it for advertising or profiling.
- Recordings and transcripts are retained until you delete the memory (plus the 30-day Trash window) or delete your account, whichever comes first.
- If you live in a jurisdiction with specific biometric or voice-data laws (e.g., Illinois BIPA, Texas CUBI, the Washington My Health My Data Act), your use of voice features constitutes your written release and consent to the processing described here.
- You are responsible for obtaining the consent of any other person you record; recording-consent laws vary by jurisdiction.
6. Who else touches your data (sub-processors)
- OpenAI - for GPT-5.2 (memory Q&A, photo vision, email/text extraction) and Whisper (voice transcription). OpenAI's API does not use API inputs to train their models by default.
- Stripe - payment processing for Premium subscriptions.
- Resend - transactional emails, optional weekly digests, and user-initiated "email this document" deliveries.
- Cloudinary (when configured by us) - image hosting for photo memories.
- MongoDB / cloud hosting - where your account, memories, and AI conversation history are stored, encrypted at rest.
7. Encryption & security
- All API traffic uses HTTPS/TLS in transit.
- Every sensitive memory field - content, transcript, AI description, image data, location name, source metadata, tags - is encrypted at rest with AES-256 (Fernet) using a key derived per-user via HKDF-SHA256 from a master key stored in our secure environment. Compromising one user's data cannot decrypt another's.
- Passwords are stored as bcrypt hashes.
- Auth tokens on your phone are stored in the OS Keychain (iOS) or EncryptedSharedPreferences (Android).
8. Data retention & your right to delete
We keep your memories until you delete them. You can:
- Delete a single memory - Home -> tap the memory -> trash icon -> confirm.
- Delete your whole account & everything in it - Profile -> Privacy -> "Delete my account & wipe data". This is permanent; we cascade-delete your account, every memory, every conversation, and every integration record from our databases within 30 days (usually within minutes).
- Export your data - email support@everdiary.app and we will send you a machine-readable copy within 30 days.
9. Children
No one under the age of 13 is permitted to use, sign up for, or be invited to EverDiary. Where local law sets a higher minimum age of digital consent (up to 16 in certain European countries under GDPR Article 8), that higher age applies. We do not knowingly collect personal information from children (consistent with the U.S. Children's Online Privacy Protection Act, COPPA). If we learn an account belongs to a child under the applicable minimum age, we will terminate it and delete its data. If you believe a child has created an account, contact us and we will remove it.
10. International transfers
Our servers may be located outside your country. By using EverDiary you consent to your data being processed in the United States of America (and other countries where our processors operate). Where required - for example for EEA/UK/Swiss users - our processors rely on appropriate safeguards such as Standard Contractual Clauses.
11. Your rights (GDPR, CCPA, and others)
You have the right to access, correct, port, restrict, or delete your personal data, and to object to certain processing. To exercise any right, email support@everdiary.app. We respond within 30 days.
- California (CCPA/CPRA): you may know what we collect, opt out of "sales" and of "sharing" for cross-context behavioral advertising (we do neither), and you will never be discriminated against for exercising a privacy right.
- EEA / UK / Switzerland: we process your data on the legal bases of contract performance (the service you signed up for), your consent (optional features such as location, voice, and digest emails), and legitimate interests (security and abuse prevention). You also have the right to lodge a complaint with your local supervisory authority.
- Other jurisdictions (e.g., Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act): you may exercise your equivalent rights through the same channels.
12. Changes to this policy
If we change this policy meaningfully we will notify you in the app before the change takes effect. Small clarifications will just get a new "Last updated" date above.