Privacy Policy
Effective date: the date EverPine v0.1.0 is publicly released
EverPine helps you organize and safeguard your personal health records. We believe your health data belongs to you, and only you. This policy explains, in plain language, what we collect, what we don't, where your data lives, and how you stay in control. Health data is also covered by our separate Consumer Health Data Privacy Policy.
Where EverPine is available: at launch, EverPine is offered in the United States, Canada, and Hong Kong. It is not offered in the European Union, the United Kingdom, or mainland China.
1. Our core principles
- Local-first: Your health records (visits, document photos, medication reminders) are stored, encrypted, on your own device by default.
- Minimal: We don't collect anything unrelated to the app's function, and we don't build user profiles.
- No tracking, no data sales: EverPine includes no third-party analytics, advertising, or tracking SDKs, and we never sell or rent your data.
- Fully deletable: Any data you create can be permanently deleted by you.
2. Information we handle
- Health information you enter: visit dates, hospitals, visit types, notes, document photos, medications and reminders. Stored locally on your device by default, in an encrypted database; document photos are additionally encrypted at the file level.
- Account information: your email address, used for sign-in via a one-time code. Sign-in does not use a login password. (Separately, you may set an archive password that protects the encryption of your own data; we never receive or store it.)
- Basic service and security information: technical information necessary to keep the service running (e.g., OS version, non-personal crash logs), plus a minimal security-event log on our servers recording the type and time of key account events (such as sign-in, giving or withdrawing consent, enabling backup, requesting account deletion). This log never contains health content, names, or notes. We collect no advertising identifiers and perform no behavioral tracking.
- Feedback you choose to send (optional): if you post feedback or ideas in the app's feedback space, the text you write is sent to our server. Please don't include personal details in feedback — submissions containing items like phone or ID numbers are automatically rejected. You can delete your feedback posts at any time.
3. Where your data lives, and who can see it
- On your device: health records stay on your device by default and work offline.
- Cloud backup (on by default, end-to-end encrypted): after you sign in, your records are backed up so you don't lose them if you lose your device. Backup data is end-to-end encrypted before it leaves your device. Our servers (Google Cloud) store only ciphertext, which we cannot read. Deleting a record or your account also deletes its cloud ciphertext.
- Exception — AI recognition (optional, separate opt-in): if you choose AI recognition, the document image is sent in readable form to Google, acting as our service provider, to extract details (see §4). This requires your separate opt-in before any image leaves your device, and never happens if you enter records manually.
- Exception — AI assistant (optional, only when you use it): if you ask the in-app assistant a question, your question and the relevant parts of your records needed to answer it are sent in readable form, through our server, to Google (Vertex AI) for processing (see §4). The content is processed transiently to generate the reply and is not stored on our servers in readable form. If you never use the assistant, nothing is sent.
4. Third-party services (data processors)
We use the following trusted providers. They process data only to provide the corresponding function to you, and are not permitted to use it for their own purposes.
| Provider | Purpose | Data involved |
|---|---|---|
| Google (Firebase Authentication) | Email one-time-code sign-in | Email address |
| Google (Vertex AI / Gemini) | Only when you choose AI document recognition or use the AI assistant: analyze a document image and extract structured fields; generate assistant replies | The document image/text you submit for recognition, or the question and record excerpts sent for an assistant reply. Processed transiently on Google's enterprise Vertex AI (US / global infrastructure). Google acts as our service provider (processor) and, under Google Cloud's data processing terms, does not use the content to train its models. |
| Google Cloud (Cloud Run / Cloud SQL / Storage) | Run the service; store encrypted synced data | End-to-end-encrypted ciphertext |
| Resend | Send sign-in codes and similar emails | Email address |
About AI recognition: this is optional and requires a separate opt-in. If you add records manually, no image or content is uploaded — everything happens locally. If you use AI recognition, the photo is sent to Google in readable form and is not automatically redacted, so it may contain personal information printed on the document (such as your name). We show you what is being sent before you agree.
About retention on Google's side: content sent to Vertex AI is not used to train Google's models; however, under its terms of service, Google may retain request logs for a limited period for abuse monitoring and platform safety before deletion. We do not control this retention and disclose it here for transparency.
5. Your rights and control
Wherever you live, you can:
- Access / export your data at any time. Export produces an archive (ZIP) containing your records as structured, machine-readable JSON together with your document images.
- Correct any record you have entered.
- Delete any single record permanently, or delete your account. Account deletion has a short cooling-off period (currently 7 days) during which it can be cancelled, after which it cascades to your cloud data and is irreversible.
- Withdraw consent you have given (including consent to AI recognition) at any time, in the app.
- Core control is always free: saving, viewing, exporting, and deleting your own data is never charged.
To make a privacy request, email hi@everpine.life. We respond within 30 days.
US state privacy rights (including California and Washington)
If you are a US resident, you have rights to access, delete, and correct your personal information, to opt out of any sale or sharing of personal information (we do not sell or share it), and to limit the use of sensitive personal information. Health-data-specific rights are described in our Consumer Health Data Privacy Policy. We do not discriminate against you for exercising these rights.
6. Retention
We keep your health records for as long as you keep them. When you delete a record, it is removed; when you delete your account, your cloud ciphertext is deleted after the cooling-off period. Locally stored data is removed when you delete it or uninstall the app. The minimal security-event log described in §2 (event types and timestamps only, never health content) is kept while your account exists and is permanently deleted 30 days after your account deletion completes.
7. Children's privacy
EverPine is not directed to children under 14 and does not knowingly collect their information. It is intended for use by adults; a minor should use it only with the involvement of a parent or guardian.
8. International transfers
Our servers and AI processing run on Google Cloud infrastructure located in the United States / global regions. If you use EverPine from Canada or Hong Kong, your data — encrypted backup ciphertext, and, if you use the AI features, the readable content described in §3 — is transferred to and processed in the United States or other regions on Google's global infrastructure. By using EverPine's backup or AI features you consent to this transfer. We do not offer EverPine in the EU/UK, so EU/UK cross-border transfer mechanisms do not apply.
9. Changes
We may update this policy. We'll notify you of material changes in the app or by email.
10. Contact
Questions or privacy requests? Contact hi@everpine.life. For the purposes of Canada's PIPEDA and Quebec's Law 25, the person responsible for the protection of personal information can be reached at the same address; it also handles data access and correction requests under Hong Kong's PDPO.
Data controller: Luwen Yu (individual developer). Contact: hi@everpine.life (written channel for privacy requests).