Evelyn Privacy Policy

1. Information we collect

Depending on how you use the site, Evelyn may receive an anonymous acquisition identifier, first landing path, and attribution parameters such as UTM values or fbclid. The onboarding flow may collect a first name, optional email, goals, activity and movement preferences, age, optional height and weight information, life-stage and confidence answers, limitations, steadiness and safety-screening answers, and the answers needed to personalize a Restart.

The app may also process session completion, check-in, movement, progress, milestone, and report data. Production account and enrollment records will be associated with authenticated access when that feature is enabled. Security and server logs may contain technical request information needed to operate and protect the service.

2. Why we use it

We use this information to create and resume an onboarding session, personalize the program, deliver the correct day and easier options, maintain progress, provide support, prevent abuse, troubleshoot failures, and meet security and legal obligations. Wellness-like answers are first-party product data used for these service purposes.

3. Cookies and local state

The current service uses essential HttpOnly cookies for anonymous acquisition, onboarding session access, and local development preview state. These cookies help the server resume the right session. We do not currently operate a large advertising-cookie system. Development preview cookies are not a production entitlement.

4. Service providers and payments

Supabase is used as the planned database/authentication provider and may process the stored service data on Evelyn's behalf. If Paddle checkout is enabled, Paddle may process payment, receipts, invoices, taxes, and refund transactions as Merchant of Record or authorized reseller. Evelyn does not receive your full card details.

PostHog, Meta Pixel, Clarity, Resend, and Cloudflare R2 are not claimed as active analytics, messaging, or media integrations in this policy unless they are actually enabled and this policy is updated first.

5. Retention and security

We retain information for as long as needed to provide the Restart, support requests, security, legal obligations, and reasonable operational records. We use server-side access controls, hashed onboarding session tokens, row-level security where applicable, and HttpOnly cookies. No internet service can promise absolute security.

6. Your choices and requests

You may ask what personal information we hold, request correction or deletion where applicable, or ask a question about processing. Use the public Support route. Please avoid sending detailed medical or health history in a support email.

7. Changes

We may update this policy when the product, providers, or legal requirements change. The effective date at the top will identify the current version.