Privacy Policy | EverStory

Who we are

EverStory is operated by Northwren Technologies. We build software for preserving family stories and legacies. Our contact email is hello@everstory.digital.

What data we collect

We collect only what is necessary to provide the service:

Your email address (for sign-in and notifications)
Story content you create: text, photos, audio, and video you upload
Account preferences and settings you configure
Basic usage data: pages visited and features used (no advertising profiles)
Payment information handled directly by Stripe (we never see your card details)

Cookies and tracking

We use essential cookies only. These cookies keep you signed in and remember your preferences. We do not use advertising cookies, cross-site tracking, or sell your data to any third party.

We do not use Google Analytics, Facebook Pixel, or any other advertising network tracker. The only third-party scripts we load are authentication (Supabase) and payment processing (Stripe).

How we use your data

To provide and maintain the EverStory service
To send you transactional emails (sign-in links, story activity, receipts)
To send you optional weekly memory prompts (you can opt out at any time)
To process payments via Stripe
To improve the product (aggregated, non-identifying usage patterns)

Your rights (GDPR)

If you are in the European Union or United Kingdom, you have the following rights:

Access: request a copy of all data we hold about you
Rectification: correct inaccurate data
Erasure: request deletion of your account and all associated data
Portability: export all your story data as a ZIP file at any time
Objection: opt out of non-essential communications

To exercise any of these rights, email hello@everstory.digital with the subject line "Data Request". We will respond within 30 days.

Data storage and security

Your data is stored on Amazon Web Services (AWS) in the us-east-1 region (North Virginia). Media files (photos, audio, video) are stored in Amazon S3 with private access controls. All data is encrypted in transit (TLS) and at rest.

Story visibility defaults to private. Only people you explicitly invite can see your story unless you choose to make it public. We enforce this at the database level, not just in the interface.

Data retention

We retain your data for as long as your account is active. If you delete your account, we begin a 30-day grace period before permanently deleting all data. Media files are removed from storage within that same period. Stripe retains payment records independently per their own retention policy.

Third-party services

We use the following third-party services:

Supabase (authentication and database)
Amazon Web Services (media storage, compute)
Stripe (payment processing)
SendGrid (transactional email)

Each of these services has their own privacy policy. We do not share your data with any service not listed here.

Changes to this policy

We will notify you by email if we make material changes to this privacy policy. The date at the top of this page shows when it was last updated. Continued use of EverStory after a policy change constitutes acceptance of the new policy.

Contact

Questions about this policy? Email hello@everstory.digital. We read every message.