EvidentlySo Privacy Policy

Who we are

EvidentlySo is a product of Family Docs, Inc., 3440 Youngfield St. #423, Wheat Ridge, CO 80033 ("we," "us"). This policy covers the EvidentlySo apps, evidentlyso.com, our license service and PDF registry, and our support.

The short version

• Messages are saved to your own cloud storage account, not our servers. Our servers never receive or store your messages, pictures, contacts or PDFs.
• To run your license, we keep a small record: your license key, whether your pass or Add-on is active, and a scrambled code for your phone.
• When you make a PDF, our registry keeps its fingerprint, its Transcript ID and when it arrived, so anyone with the PDF can check it hasn't changed.
• Stripe, through Link, handles payments. We never see your card number.
• The website uses no cookies. The app has no analytics and sends no crash reports.
• We don't sell or share your information for advertising.

1. What stays with you

When you save a conversation, EvidentlySo copies its messages, with their pictures, to your phone and then to your own cloud storage (currently Dropbox, in its own folder, Apps › EvidentlySo). The PDFs you make are saved there too, along with logs that describe each save and PDF (such as your phone model, Android version, app version and times).

If you allow Contacts, EvidentlySo also saves the names and contact photos your phone shows for the people in the conversations you choose, so they appear in your PDFs. It doesn't save the rest of your address book.

Our servers never receive or store any of this. If you stop using EvidentlySo, none of your messages are left with us. Uninstalling the app deletes the copies on your phone. The copies in your cloud storage stay until you delete them. Your phone's own backups don't include EvidentlySo's files.

Because we never have your messages, we can't recover them for you, and we can't hand them to anyone else.

Desktop app (beta). The desktop app reads iPhone backups already on your computer, including messages and contact names. If a backup is encrypted, the password you type is used on your computer and not kept. Like the phone app, it saves only to your device and your own cloud storage.

2. App permissions

• Text messages (required). To copy the conversations you choose. EvidentlySo never changes, deletes or sends a message, and never writes messages back to your phone.
• Default texting app (direct-download version only, for a minute or two). To include encrypted chat (RCS) messages, the app may ask to be your texting app briefly. While it is, texts and picture messages that arrive are kept on your phone, and your usual texting app shows them after you switch back. [Confirm wording against the current app.]
• Contacts (optional). For names and contact photos, as above.
• Notifications (optional). To show the progress of saving messages or making a PDF.
• Internet. Only to reach your cloud storage, our license service and our PDF registry. The app refuses connections to anything else.

3. Personal information we collect

We collect only what we need to sell and run your license, check PDFs, and answer you.

Messages you send us anyway. Please don't send screenshots or copies of your messages; a description in words is enough. If you do, we use them only to answer you and delete that conversation when your question is resolved.

4. Payments

You pay on a Stripe checkout page, with Link (a Stripe company) as the seller of record. Stripe and Link collect your payment details, name, email and billing address under their own privacy policies, and calculate and collect sales tax. We never see your full card number. In Stripe's dashboard we can see your name, email, purchases and the last digits of your card; our license service keeps only Stripe's customer reference. If you cancel the Add-on, you do it in Stripe's customer portal.

5. What the app sends to us

• To the license service: the license key, the phone code and the app version. When you buy, the plan you chose. When you ask for an activation link, the email address you typed and the link's code.
• To the PDF registry: the PDF's fingerprint and Transcript ID, with a token from our license service. The token holds nothing about you and isn't kept with the fingerprint.
• When the app opens: it reads a small status file from our server to learn about required updates and critical notices. That request sends nothing about you.

The app sends no analytics and no crash reports, and we don't use advertising IDs.

Error reports and diagnostics

Error reports are off unless you turn them on. We ask once when you set up the app, and again after a crash if reports are off. You can turn them on or off at any time in Settings.

What an error report contains

• The EvidentlySo app version
• Your phone or computer model
• Your operating system version
• The step in the app that failed, and technical details of the error
• A random ID created when you installed the app, so we can tell repeat errors apart. It is not linked to your name, phone number, email or account.

What an error report never contains

Error reports never include your messages, the names or phone numbers of anyone in your conversations, your file names, or any information that identifies a conversation. The app removes this kind of information before a report is sent, and Sentry removes it again when the report arrives. Error reports do not include screenshots, screen recordings, a record of what you tapped, or your IP address.

Who handles error reports

Error reports are sent to Sentry, a service that stores crash reports for us. Sentry stores them in the United States, does not keep your IP address, and may use them only to provide that service to us, under a written agreement that protects your data. Only our team can see error reports, and every account that can see them must sign in with two-factor authentication.

How long we keep error reports

We keep error reports for 90 days and then delete them.

Report a problem

Help > Report a problem opens your own email app with a message to our support team. You write the description and choose whether to include the app's technical details, and you see everything before you send it. The app itself sends nothing. We keep support emails until your request is resolved, and then delete them. Please don't include private details you don't want us to have.

Your messages stay with you

Your messages and PDFs are saved to your own device and your own Dropbox. They are never sent to us through error reports.

6. The website

• No cookies. The website sets no cookies and uses no local storage.
• Visit counts. Cloudflare Web Analytics counts visits without cookies and without identifying you (pages viewed, the site you came from, your browser and your country).
• Spam checks. Our forms use Cloudflare Turnstile to check that a person is sending them; Cloudflare's Turnstile Privacy Addendum covers its use of data. To limit spam, our host counts requests from your internet address (and, on forms, a scrambled code of your email address) for one minute, in memory, and saves nothing.
• Checking a PDF. On EvidentlySo.com/Verify, your browser works out the PDF's fingerprint on your device and sends only that. The PDF isn't uploaded.
• Logs. We've turned off request logging for the website's own code. Cloudflare, which hosts the site and our servers, keeps its own sampled security records (which can include your internet address and the time) for up to about a month.

7. Email

We email you about your purchase, your license and your support questions. If you sign up for updates, we send them through HubSpot, and only after you tick the sign-up box and confirm by email. That is your express consent, which Canada's Anti-Spam Legislation (CASL) requires, and we record when and where you gave it. Every update email names Family Docs, gives our mailing address and has an unsubscribe link, and we act on an unsubscribe within 10 business days. HubSpot records whether our update emails are opened and which links are clicked. Our email is hosted by Google Workspace. We don't send marketing texts.

8. Who we share information with

We don't sell your personal information, we don't share it for cross-context behavioral advertising, and we don't use it to train AI. We share it only:

• With the service providers that help us run EvidentlySo, listed on our Subprocessors page, under contracts that limit their use of it;
• When the law requires it, as described on our Legal Requests and Security page. We have no message content to give;
• To protect people, if we believe in good faith that someone faces an imminent risk of death or serious injury;
• In a business transfer, such as a merger or sale, where the new owner keeps this policy's promises for information collected under it;
• With your permission.

9. Your choices and rights

Everyone, wherever you live in the US or Canada, can ask us to:

• tell you what personal information we have about you and give you a copy;
• correct it;
• delete it (for example, your license record). Deleting your license record ends your license. We keep the record that you agreed to our Terms, with the license key and phone code removed (section 3).

Email support@evidentlyso.com from the address you paid with, or use Contact support. We'll confirm who you are by matching that address with Stripe's records, and answer within 45 days. If we say no, we'll explain why, and you can appeal by replying with "Appeal" in the subject; we'll answer the appeal within [45/60] days. If we still say no, you can contact your state attorney general. You can use an authorized agent if you give them written permission, and we won't treat you differently for using your rights.

Your snapshots and PDFs are in your own cloud storage, so you delete those yourself. To disconnect EvidentlySo from Dropbox, use the app or Dropbox's connected-apps settings.

State privacy laws. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with consumer privacy laws have the rights above under those laws. We honor Global Privacy Control signals, though we don't sell or share information in a way they would stop.

California notice at collection. In the last 12 months we collected these categories: identifiers (email address, license key, phone code); commercial information (purchases, through Stripe); internet activity (anonymous visit counts; security records our host keeps); and inferences: none. Sources, purposes and retention are in section 3. We didn't sell or share any of them. We don't collect sensitive personal information as defined by California law. [Attorney: confirm.]

10. Children

EvidentlySo is for adults 18 and older. We don't knowingly collect personal information from anyone under 18. If we learn we have, we'll delete it. Messages you save may mention children; those stay in your own storage.

11. Where EvidentlySo is offered

EvidentlySo is offered in the United States and in Canada, except the province of Quebec. Our providers store and process data in the United States. If you're in Canada, that means your information is held outside Canada and may be accessed by US courts and authorities under US law. EvidentlySo isn't offered in Quebec, the European Union, the European Economic Area, the United Kingdom or Switzerland, and requests from there are turned away.

If you're in Canada. Canada's federal privacy law (PIPEDA), and in Alberta and British Columbia their provincial privacy laws, apply to how we handle your personal information. We collect, use and share it only for the purposes in this policy and with your consent, which you give by using EvidentlySo or, for update emails, by signing up and confirming. You can:

• ask for access to your personal information and a copy;
• ask us to correct it;
• withdraw your consent, for example by unsubscribing or asking us to delete your license record (which ends your license);
• complain to our privacy officer and, if you're not satisfied, to the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner.

We answer within 30 days. If a breach of our security safeguards creates a real risk of significant harm to you, we'll notify you and the Privacy Commissioner.

Privacy officer: [Name], Family Docs, Inc., 3440 Youngfield St. #423, Wheat Ridge, CO 80033 · [privacy@evidentlyso.com / support@evidentlyso.com]. [Larry to name someone. Canadian counsel to review this section.]

12. Security

We keep as little as we can, use HTTPS for every connection, hash the phone code on the phone, and keep the license key in your phone's secure key store. See Legal Requests and Security. If a security incident affects your personal information, we'll tell you as the law requires.

13. Changes to this policy

We'll post changes here with a new version and effective date. For a material change, we'll tell you in the app or by email before it takes effect.

Contact us

Email: support@evidentlyso.com · Mail: Family Docs, Inc., 3440 Youngfield St. #423, Wheat Ridge, CO 80033