Privacy Policy

1. Data Controller & Founding Principles

Welcome to Evolve ("the Application" or "the Service"). We deeply respect your privacy and consider the protection of your personal data a load-bearing pillar of the entire Evolve growth ecosystem. The design and the technical architecture of the application itself are built to keep the data we collect to the strict minimum.

Our core principles:

• No advertising tracking: Evolve contains no commercial advertising, uses no third-party advertising profiling code (such as the Facebook SDK or Google Analytics for marketing purposes) and will never sell your data to outside parties.
• Awareness and Control: You are the sole owner of your routines, your goals and your daily thoughts. We guarantee your right to export or entirely delete your data at any time with a single click.

2. Categories of Personal Data Collected

Depending on how you interact with Evolve, the application collects different categories of technical and personal data needed to give you a reliable tracking and synchronisation experience:

A. Registration and Authentication Data

To create an account and enable secure cloud synchronisation, we collect:

• Email Address: Collected and processed **solely for authentication purposes**, access management and protection of the user account. It is provided directly at registration through Supabase Auth, or transmitted securely through the built-in authentication systems of Apple Sign-In or Google Sign-In.
• Optional Profile Data: Username or nickname, language preferences, the application's theme settings, and the profile picture voluntarily uploaded by the user (stored securely on Supabase Storage).

B. Data Entered by the User (Personal Growth, Habits and Mood)

The essence of Evolve rests on the information you enter voluntarily to monitor your progress. We collect the following data entered directly by you:

• Habits: Routines created, frequency set, notification times, completion history and consecutive streaks.
• Macro Goals: Titles of the goals you set, the life areas associated with them (e.g. Health, Work, Finances), due dates, custom colours and progress percentages.
• Daily Logs & Mood: Daily emotional state (mood tracking on a numeric or emoji scale) and personal notes or thoughts written in the journal, in order to correlate emotional wellbeing with productive output.
• Memento Mori / Life View (Optional): Date of birth, entered solely to calculate and render the life-weeks widget. It is stored securely and is not used for any other purpose.

C. Technical, Synchronisation and Diagnostic Data

• Local Cache: The application is "Offline-First". Your data is saved locally on the device in encrypted or isolated databases (an encrypted SQLite database using SQLCipher) so that it remains immediately usable even without an internet connection.
• Synchronisation Metadata: Date and time of updates, OS version (iOS/iPadOS), device make and model, so that the Supabase PostgreSQL synchronisation system can resolve offline/online data conflicts through timestamps (last_updated_at).

D. Health Data (Apple Health, Optional)

• Read-only access: If you turn on auto-verification for a habit and grant permission, Evolve reads from Apple Health only the metrics relevant to the habit you choose to verify (e.g. steps, workouts, mindful minutes). Evolve never writes any data to Apple Health.
• On-device processing: The health measurement is processed locally on your device to produce a simple completion outcome (done / not done). The raw health value never reaches our servers: it is deliberately stripped before any sync. Only the completion status is synced, exactly like a habit you complete by hand.
• No secondary use: Apple Health data is never used for advertising or profiling, and never shared or sold to third parties. Processing is based on your explicit consent and can be withdrawn at any time in Apple Health or in the app's settings.

E. Screen Time Data (Optional)

• Optional, read-only access: On iPhone and iPad only, and only if you create a habit with a Screen Time rule (e.g. "under 2 hours of social media") and grant Screen Time (Family Controls) permission. If you never create such a habit, Evolve never accesses Screen Time.
• We do not learn which apps you use: The selection of apps and categories to monitor is handled by iOS as opaque tokens: Evolve cannot read their identities and never learns which apps you picked. The selection stays on your device and is never sent to our servers.
• No usage figures, on-device processing: The system notifies a small extension only when a limit you set is crossed. That extension records only the habit's identifier, the type of event and the date — never minutes, totals or usage statistics. As with Apple Health, only the completion outcome (done / not done) is synced, exactly like a habit you tick by hand.
• No secondary use: Screen Time data is never used for advertising or profiling, and never shared or sold to third parties. Processing is based on your explicit consent and can be withdrawn at any time in Settings > Screen Time or in the app's settings.

3. Purposes of Processing

The data collected is used solely to provide the Evolve application service (such as account management, data synchronisation and the correct functioning of the app). We guarantee 100% that your personal data is never disclosed, sold or transferred to third parties for commercial, advertising or marketing purposes.

4. Legal Bases for Processing

We process your personal data in full compliance with European (GDPR) and international regulations. Data processing relies on the following main legal bases:

• Performance of a Contract: This is the primary legal basis that allows us to process your email address (for authentication) and the data actively entered by the user (habits, goals, mood) in order to deliver the essential features and the service of the Evolve application.
• Consent of the Data Subject: This is the legal basis required to enable the application's optional and ancillary features. In particular, consent is requested for:
  • The optional sending of crash logs and diagnostic data through the Sentry service in order to improve the app's reliability.
  • The processing of journal texts by the AI Coach in order to generate growth reports.
  • The calculation of the "Life View" widget based on your date of birth.
• Compliance with Legal Obligations: In the rare cases where we are required to comply with tax regulations or formal requests from the competent authorities.

5. Data Security: Isolated Architecture (RLS)

The security of your data is not left to the application code alone: it is rooted in the structural architecture of the cloud database provided by Supabase. We have implemented enterprise-grade protection:

PostgreSQL Row Level Security (RLS)

Every single table inside our PostgreSQL database (such as `profiles`, `macro_goals`, `habits` and `daily_logs`) has row level security (RLS) enabled at server level. This means the database system itself physically prevents anyone but you from reading, inserting or updating the rows associated with your unique user identifier (the UUID provided by authentication). No app-side code leak or configuration error can expose your data to other users.

Encryption and Secure Channels

All data transfers between the smartphone and the server infrastructure take place exclusively over encrypted HTTPS connections using state-of-the-art TLS encryption protocols. The local cache on your smartphone relies on the iOS sandboxing modules, ensuring that other applications cannot access the encrypted SQLite (SQLCipher) database in any way.

6. AI Coach & Data Processing

Evolve offers one of the most advanced features in the field of personal awareness: the AI Coach. This feature analyses your notes and your daily rhythms to offer you reflective prompts and scientific behavioural reports.

How privacy is protected in AI processing:

• API Key Isolation: The mobile application contains no API Key or direct credential for artificial intelligence services. All requests travel securely via encrypted JWT tokens to the Supabase Edge Functions (serverless functions executed in a protected Deno environment).
• Processing via Third-Party APIs: When you use the AI Coach, the data relating to your messages and to the notes of the last 30 days is transmitted securely over encrypted HTTPS connections to OpenRouter, Inc. (United States), which routes the request to the provider that runs the model: Google LLC, via Google AI Studio, when the AI Coach runs on your Evolve Pro subscription — Evolve pins that provider and disables fallbacks, so no one else receives your text on this path; or, if you connect your own OpenRouter account, to whichever provider OpenRouter selects under your account's settings. This data is sent only following your explicit consent and your active interaction with the feature.
• API Use & Training: The Standard mode of the AI Coach (included with Evolve Pro) runs on Google's free tier through Google AI Studio. Because it is a free tier, Google may retain the transmitted text for a limited period and use it to improve its services, which can include training its models. If you connect your own OpenRouter account instead, the text is processed by the provider OpenRouter routes to, under that provider's terms and your account settings. In every case the AI Coach transmits data only after your explicit consent and while you actively use the feature; a future version will add on-device models so it can run with nothing leaving your device.
• Evolutionary Roadmap (Local LLM): In line with our philosophy of absolute control and privacy over personal data, the AI Coach can already run entirely locally on your device (Local LLM) in the desktop (macOS) app, through a local server such as Ollama or LM Studio — in that mode no message ever leaves your machine. We are working to bring the same on-device option to the mobile app in a future version.

7. Processors (Sub-processors)

To deliver the app's services, we rely on selected first-rate technology partners acting as external Processors (Sub-processors) in accordance with Art. 28 GDPR:

• Supabase, Inc.: Our cloud provider for the database and authentication. It handles the secure storage of all data entered by the user, profile storage (Supabase Storage) and the secure authentication system (Supabase Auth). EU users' data is hosted on AWS infrastructure located in Frankfurt (Germany).
• Sentry (Functional Software, Inc.): A service used to monitor the application's stability, capture crashes and continuously improve the user experience. Sending this diagnostic data is **entirely optional** and relies on the user's **prior consent**, which can be enabled or disabled at any time within the app's settings.
• OpenRouter, Inc. and Google LLC: OpenRouter routes AI Coach requests through secure APIs; Google LLC runs the model that answers, via Google AI Studio, when the AI Coach runs on your Evolve Pro subscription. If you connect your own OpenRouter account, the provider that runs the model is whichever one OpenRouter selects under your account's settings. On the Standard (Evolve Pro) path this is Google's free tier, so the texts may be retained for a limited period and used to improve Google's services, including model training.
• Apple Inc. & Google LLC: Operators of the secure authentication channels (Sign-In) and of any in-app subscriptions.

8. Data Retention & Right to Erasure

Your growth data is retained for as long as you choose to keep your Evolve account active.

Immediate deletion: We guarantee absolute control. If you decide to delete your account, you can do so at any time directly from the App's internal settings by pressing "Delete Account". This action starts an instant server-side procedure that:

• Permanently removes your user record from Supabase Auth.
• Cascade-deletes all the rows associated with you from the `profiles`, `macro_goals`, `habits` and `daily_logs` tables, irreversibly.
• Deletes every uploaded file (e.g. profile picture) from the storage buckets.

9. Users' Rights (GDPR / CCPA) & Exercising Your Rights

In accordance with the European Union's General Data Protection Regulation (GDPR), you hold the following inalienable rights in relation to your personal data:

• Right of Access: To obtain confirmation as to whether or not personal data concerning you is being processed, and to obtain a structured copy of that data.
• Right to Rectification: To correct or complete inaccurate or incomplete data.
• Right to Erasure (Right to be Forgotten): To obtain the definitive and irreversible deletion of all data stored on the servers in relation to your account.
• Right to Restriction and to Object (Withdrawal of Consent): To withdraw at any time the consent previously given for optional features.
• Right to Data Portability: To receive the data concerning you in a structured, commonly used and machine-readable format in order to transmit it to another controller.

For any further clarification, support request, or to exercise your legal rights manually, you can contact the Data Controller by writing directly to the email address: mattioli.simone.10@gmail.com.