Privacy Policy
Last updated: 16 September 2026
What we hold
EverRoot stores the account email you sign in with, the quiz answers that shape your routine, the products you scan (as extracted ingredient text — never the photos of labels), your routine activity (steps completed, check-ins, streaks), your progress photos, and any photo you take of a bottle on your own shelf. It also keeps the words written for you: the summary of your answers, the explanation on each scan, and your weekly reports.
Your photos
Progress photos are private to your account. They are stored encrypted in a private bucket, are readable only through short-lived signed links tied to your session, and are never public, never shared, and never analysed — the app does not measure or score anything from a photo. No one sees them unless you export a share card yourself. A photo you take of a product on your shelf is held the same way, and you can remove it whenever you like.
Label scans
The scanner reads the ingredients panel on your phone. The photo itself never leaves your device — only the extracted ingredient text is sent to our servers, which work out your match verdict from it and use it to write the explanation you read. This is true of both shots: when the app asks for the front of the bottle to name the product, that picture is read on your phone too and only the text goes anywhere.
AI writes some of the words
The explanation on a scan, the summary of your answers, the answer when you tap an ingredient, the weekly report, and the reading of a check-in you write in your own words are all written by AI. It happens on our servers, never on your phone: we send the text to OpenAI, which writes the words and sends them back. What we send is the ingredient text from a label, your quiz answers including anything you typed yourself, the note you write at a check-in, and the ingredient you tapped. What we never send is a photo of any kind, your name, your email, or your account id. We ask OpenAI not to store what we send, and it is not used to train its models. The note you write at a check-in is not kept by us either — we keep only that you wrote one that day, so the daily limit works. Every one of these falls back to words we wrote ourselves when the AI does not answer.
What we never do
We do not sell your data. We do not show ads. We do not send marketing email — if we email you, something needed your attention. Payment details are handled entirely by the App Store or Google Play; we never see them.
Analytics and processors
We record product events (like completing a routine step) to understand what works, tied to your account, in our own infrastructure and in PostHog. Crash reports go to Sentry. Subscriptions are processed by RevenueCat against your store account. None of these receive your photos or your ingredient scans. The AI text described above is written by OpenAI, which receives what that section lists and nothing else. Infrastructure runs on Supabase and Vercel in the EU/US under standard contractual clauses.
Deleting your data
In the app: the You tab → Photos → “Delete all my photos and data” removes photos and activity immediately and permanently while keeping your account, and the You tab → Account → “Delete my account” removes everything including the account itself. You can also request deletion from the account deletion page. Nothing is retained beyond operational backups that expire within 30 days. Subscriptions are cancelled separately through the store.
Contact
EverRoot is operated by 8x Social. Privacy questions (including KVKK and GDPR requests) reach us through the support page. This policy is provided in English and Turkish; where they differ, the English text controls.