Privacy Policy (revised draft)

Draft status and who we are

DRAFT: NOT EFFECTIVE. For internal and counsel review only. This text is not an offer, not accepted terms, and not evidence of prior consent. Do not record draft acceptance.

This Privacy Policy describes how Evexia (“Evexia,” “we,” “us”) handles personal information in the Evexia website and mobile app. Contact: admin@evexia.living.

Evexia is a self-reflection and wellbeing product intended for US adults 18+. It is not a public social network and not a medical provider.

Information we collect

Account information: email address and optional display name or photo from Apple, Google, or a magic-link email sign-in. We do not use an app password.

Assessment and plan information: answers, scores, pattern labels, session timing, enrollment, timezone, practice completions, optional notes, reflections, and related day-log fields (including practice title/prompt snapshots and insights shown).

Personalization information: living-profile summaries and evidence derived from your activity and optional feedback, used to tailor practices and copy inside Evexia.

Shared-link information: if the Share Inbox pilot is available and you send Evexia a public web link, we store the normalized link, permitted public preview metadata, a constrained topic classification, and your save-only or personalization choice. We do not use a saved link as profile evidence unless you explicitly choose personalization.

Connect information: when you use Connect, we process session metadata (participants, heartbeats, status) and message bodies so the session can run. Optional “keep the pattern” on close may store derived signals without copying the full transcript into profile evidence.

Device information: local copies of assessment results, resume tokens, and session identifiers on your phone for app performance.

Communications: sign-in links and, if you request it on the website, an emailed copy of your reflection (via our email provider).

Product analytics: on the website we may record product events (for example starting an assessment or viewing results) when an analytics sink is present. A mobile production analytics SDK was not present in audited dependencies as of this draft.

We do not ask for payment card numbers, contacts access, or precise location for the core product described here.

How we use information

To create and secure your account; deliver the assessment, plan, and personalization; operate Connect sessions you join; send transactional email you request; improve product reliability and understand funnel performance; protect safety (including Connect reports); and comply with law.

We do not sell your personal information.

Connect messaging (important correction to older copy)

There is no separate local-only “rant transcript” store in the current app. When you send Connect messages, those messages are transmitted to Evexia servers for the session.

On a normal session close, message bodies are deleted unless a report retains them for a limited safety-review window defined in product code (currently seven days for reported sessions).

Connect may also be hidden from the main pilot UI while code remains available; that does not change how message storage works when Connect is used.

Who we share with

Service providers that help us run Evexia: Supabase (database, authentication, realtime, avatar storage), Vercel (website hosting), and Resend (optional results email when configured). Apple and Google receive what is needed for sign-in only.

A Connect peer receives the messages you send in that session.

We may disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction, subject to appropriate protections.

We do not make unverified claims about every subprocessor’s training uses or regional hosting. Those details remain under review.

Retention

Device data lasts until you sign out, use Start over, or remove the app.

Account and server data generally last while your account exists, subject to Connect message deletion rules above and ordinary backup rotation.

Start over clears local state and soft-resets certain server records but does not delete your sign-in.

Deleting your account removes your sign-in, protocol enrollments and day logs we can find, and Connect data tied to your account. Assessment session, result, and answer records may remain after the account link is cleared; clearing that link alone is not a verified anonymization. Profile photo removal can fail without blocking account deletion.

Your choices and rights

You can skip optional notes and feedback, sign out, Start over, or delete your account in Settings.

For access, further deletion help, or other privacy requests, email admin@evexia.living. We will need enough information to verify the request relates to your account.

Additional consumer-health rights, if applicable, are described in the Consumer Health Data Privacy Notice draft.

Children

Evexia is not directed to children under 18. We do not knowingly collect personal information from children under 18.

Changes and contact

We may update this Policy. Material changes after an effective release will be indicated by an updated date and appropriate notice.

Contact: admin@evexia.living.