Privacy policy

This policy explains what data EVY collects, why, where it goes and what you can do about it. It covers the website evy.so, the EVY desktop app for macOS, the EVY web app at app.evy.so and the EVY phone app for iPhone and Android (listed in the stores as “EVY: AI todo list” or “EVY”).

Who is responsible

EVY is operated by Helix Studio OÜ, Pärnu mnt. 139c, 11317 Tallinn, Estonia (registry code 14249878). Helix Studio OÜ is the controller of your personal data under the GDPR. Contact us at help@evy.so.

What we collect

On the website

• Access requests. Your name, company email, team size, how you heard about EVY if you tell us, and where you came from (for example a search engine or an AI assistant). We use this to bring you onto EVY and to see which channels work.
• Connection data. Your IP address and browser details pass through Cloudflare when you visit.
• Analytics cookies, only if you agree in the cookie banner. With the same consent, your browser tab remembers which site sent you, so an access request made a few pages later still counts that source. This note is cleared when you close the tab.

Your account

• When you open the desktop app for the first time, EVY creates an account for you without an email or password. A key is stored in your Mac’s Keychain. Our server keeps only a fingerprint of that key and your Mac’s name.
• You can add an email later. You need one to invite people.
• On the web app you sign in with an email and password, or with Google (we receive your email address and name).
• The phone app signs in when you scan the Connect your phone code in the desktop app. There is no password on the phone. Its sign-in key sits in the phone’s secure storage (the Keychain on iPhone, the Keystore on Android).

What you put into EVY

Your spaces, goals, initiatives, plans, tasks, notes, assets, comments, your chat with EVY and the transcripts of what you say to EVY. This is stored on EVY’s servers so EVY can plan with you and so your team can work in the same space.

From your Mac

• Folders you link to a space: the folder path, the number of files, up to 25 file names, the first lines of a README, and the git remote. For files inside space folders: size, dates and a checksum. The contents of your files stay on your Mac.
• Projects on your Mac: the names, folders, remotes and last commit dates of code projects in common project folders, so EVY can suggest spaces.
• Agent work: the tasks you hand to agents, their results, their questions, your answers, and how much each run used.
• Agent conversations in linked folders: when you work with Claude Code or Codex in a folder linked to EVY, EVY’s plugin can send your messages and the agent’s answers (shortened, without tool output) so EVY can keep your space up to date. We delete these excerpts once they are summarised.

On your phone

The phone app shows your To-do, the questions agents ask you and voice notes from your team. It keeps only what it needs to show the screen you are on, and a recording until it has been sent.

• Microphone: for voice notes to teammates, Talk to EVY and tasks you speak. The audio goes to EVY and is turned into text in the same way as voice input on your Mac (see Voice below).
• Camera: only to read the Connect your phone code when you sign in. No picture is stored or sent.
• Push notifications: if you allow them, EVY stores your phone’s push token and the phone’s name. EVY sends a push only when an agent asks you a question, when a voice note arrives, or for a To-do reminder you set. Pushes travel through Expo’s push service and then Apple’s or Google’s (listed below). When you sign out on the phone, EVY removes its token.
• Crash reports: when the app crashes, it sends a report to Sentry in the EU, without personal data and without screen recordings.
• No ads or tracking: the phone app has no ads, reads no advertising ID and does not track you across other companies’ apps or websites. It does not record which screens you open.

Voice

When you hold the shortcut, use Talk to EVY or speak a task on your phone, the audio goes to our server and is turned into text by OpenAI. We keep the text and discard the audio. Voice notes you send to teammates are kept for 24 hours, then deleted.

Calendar

If you connect Google Calendar, EVY reads it with read-only access and keeps the title, start, end and busy status of events from two days back to three weeks ahead. Your access token is stored encrypted.

How you use the app

In the web app and the desktop app we record which screens you open, what you click and which steps you take, such as finishing setup, making a note or starting a task, linked to your EVY account. We also keep short screen recordings of your sessions to see where EVY is hard to use. In these recordings every piece of text and everything you type is hidden, so your notes, tasks and messages never reach us this way; button labels such as the names of your spaces and folders can still appear. Nothing for this is stored on your device, so it needs no cookies. To have your account left out, email help@evy.so.

Technical data

Error reports, crash reports from the phone app, server health data, and the app’s update checks, which tell us which version you run.

How AI is used

Agents on your Mac. Claude Code, Codex and other agents run on your Mac under your own accounts with Anthropic, OpenAI or the agent’s provider. What they send to their provider is governed by your agreement with that provider, which EVY does not control.

EVY’s own features. Some features run on EVY’s servers and call AI providers: answers when you talk to EVY, the morning check-in, planning suggestions, transcription, search and sorting. These providers receive only what the feature needs and are listed below. We use them through their business APIs, and we do not use your content to train AI models.

Why we use your data (legal basis)

• To provide EVY (contract): your account, your content, agent work, voice, calendar, push notifications and the emails you need.
• To keep EVY working and secure (legitimate interest): error and crash reports, server monitoring, abuse prevention.
• To understand where people come from (legitimate interest): the source of access requests.
• To improve EVY (legitimate interest): usage analytics and screen recordings in the app, with all text hidden.
• Analytics cookies (consent), which you can withdraw at any time in the cookie settings.

Who receives data

We share data only with the providers that help run EVY, under data processing agreements, and never sell it.

Some of these providers process data outside the European Economic Area, mainly in the USA. Where they do, we rely on the safeguards the GDPR provides for this, such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• Your account and content: as long as you use EVY. When you ask us to delete your account, we delete it within 30 days, and it leaves our backups as they rotate.
• Agent conversation excerpts: deleted once summarised.
• Voice notes: 24 hours. Voice audio for transcription: not kept.
• Screen recordings of app sessions: 30 days.
• Calendar copy: two days back to three weeks ahead, refreshed as time moves.
• Phone push tokens: until you sign out on that phone or your account is deleted.
• Access requests: until you are onboarded or ask us to remove them, and at most 12 months.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Email help@evy.so and we will answer within 30 days. To delete your account, follow the steps on Delete your EVY account. You can also complain to a data protection authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority where you live.

Security

Traffic to EVY is encrypted. Keys on your Mac sit in the macOS Keychain, and the server stores only fingerprints of them. The phone app keeps its sign-in in the phone’s secure storage. Calendar tokens and your own API keys are stored encrypted, and database backups are encrypted.

Children

EVY is for people aged 18 and over.

Changes

When we change this policy, we update the date at the top. If a change matters for how we use your data, we tell you in the app or by email before it takes effect.