Privacy

Your sort, your choices and your result are kept in this browser’s storage, on this device. They are not sent to Even Over. Closing the tab keeps them, except in some private windows, where they last only as long as the tab. Clearing your browser’s site data removes them.

If you ask for a resume code instead of saving with an email, a copy of your answers goes to our database so the code can bring them to another device. The code works for 30 days. We keep only a scrambled form of the code (a hash), never the code itself. Expired copies are not yet removed automatically; a clean-up job is planned.

You give an email address, and we send you a sign-in link. Your email is the only thing that identifies your account; we do not ask for your name. The link works once and stops working after 15 minutes. Until you press the button on the link’s page, your answers wait in our database under a scrambled form of your email, and that waiting copy cannot be used after an hour.

When you confirm, your answers, your result and your consent choices are written to your account. From then on, only you can read them: our database refuses every other account’s request, and share cards are read through a separate check of the card’s own link.

You can change each one in Settings at any time.

Core

The cards you put in each pile, the words you add, the pairs you choose between, your answers about your top five, the order that results, and the portrait if you take it.

Required to use Even Over. Removing it means deleting your account.

Reflections

What you write in your own words in later steps: notes, principles and decision entries.

Off until you switch it on. While it is off, nothing you write there is stored. Switching it off deletes what you wrote.

Social

Share cards now, friend feedback later.

Off until you make your first share card. Switching it off stops every card you have shared at once.

Product events

Which screens you open, how long steps take, and counts such as how many cards you sorted.

Depends on where you are: see Product events below. You can switch it off on any device in Settings; signed in, that also deletes the events kept with your account.

Product events tell us which screens people open and how long steps take, so we can see where the app is unclear. They never include your values, your ranking, any pair you chose between, or anything you write. They carry no web address, no referrer and no email. The country comes from the network in front of the site (Cloudflare), and we tell our analytics provider not to look up a location from your IP address.

We use PostHog, in its US cloud, with automatic page and click capture, session recording, heatmaps and surveys all switched off. It keeps its identifier in your browser’s local storage. The only cookies Even Over sets keep you signed in. A copy of each event is kept in our own database.

In the European Union, the European Economic Area, the United Kingdom and Switzerland, and wherever your country cannot be told, you see a banner first. Nothing is sent, and the PostHog code is not even downloaded, unless you choose Allow. Elsewhere, including the United States, events are sent unless you switch them off in Settings. A choice to switch them off is kept on that device and holds wherever you are.

A share card shows your top three values and, if you add it, your first name. Anyone with the link can see it, and the page asks search engines not to list it. Stopping a card, switching off Social, or deleting your account makes the link stop working at once.

Export. Settings has Export, which downloads everything your account holds as one JSON file.

Delete. Settings has Delete. It signs you out on every device, stops every share link at once and clears your answers from the browser you use. Your account and everything in it are then deleted for good 30 days later. You can also delete any device’s answers before saving by clearing that browser’s site data.

Inactive accounts. Today an account stays until you delete it. A rule to delete accounts after 24 months without use, with a warning email at 22 months, is planned; this page will say when it applies.

• Supabase: our database and sign-in, in the United States.
• Vercel: hosting for the site.
• Cloudflare: the network in front of the site.
• PostHog: product events, in its US cloud, under the rules above.
• Inngest: runs the delayed deletion of an account. It receives the account’s id and nothing else.
• An email provider sends your sign-in link; it receives your email address.

There are no advertising or third-party tracking scripts on any page, and we do not sell or rent your data.

Write to hello@evenover.app. The terms say what Even Over is and is not.