Evenfall — Privacy Policy

Applies to Evenfall 2.0 and later. Last updated: 13 October 2026.

Evenfall is a journal with an AI companion, made by Erek Studio. This page says what happens to what you write: what is kept on your phone, what leaves it and when, who handles it, and what is kept elsewhere.

In short

• No account. You do not sign up or log in, and we do not ask for an email address or a phone number.
• No ads. The app contains no advertising and no advertising or tracking software. The stores' own purchase and integrity libraries — which the app needs in order to sell a subscription and to prove it is a genuine copy — talk to Apple or Google (see "Purchases" and "Identifiers").
• Your journal, Evenfall's memory of you, your answers and your mood marks are kept on your phone.
• To write replies and to keep its notes up to date, what you write is sent to a third-party AI service. When you send a message, its text — with your answers, the memory notes and the mood marks of the last seven evenings — goes through our gateway to an AI provider, which writes the reply. Nothing you write is sent before you press Agree and begin, and you can take that agreement back (see "Withdrawing your agreement").
• Our gateway does not keep what you write. It keeps counts and request identifiers, filed under an identifier for your installation of the app.
• One exception, which you choose: a reply you report to us is kept for 90 days.
• Evenfall is an AI, not a person, and not a therapist, a doctor or a crisis service. What it does if you tell it you are thinking of harming yourself is set out below, under that heading.

What is kept on your phone

Evenfall keeps these in its own storage on your phone:

• Journal — the evenings you kept: your messages and the companion's replies.
• Memory — the notes Evenfall keeps about you, shown as cards.
• Your answers — what you told Evenfall when it asked: for example what to call you, the tone you prefer, the people who may come up, and what to leave alone.
• Mood marks — the mood you mark for an evening on the sky dial, one of five steps.
• Settings and small records — such as your language, the appearance, the reminder time, whether the lock is on, the line you left for tomorrow, and the fact that you agreed on the introduction.

They are ordinary files in the app's private storage. Evenfall does not encrypt them separately; they are protected by your phone's own lock and storage protection. We keep no copy of them. "Kept on your phone" does not mean they never leave it: parts of them are sent when you use the companion, as the next section describes, and the whole of them goes wherever you send an export (see "Export").

Backups. On Android, Evenfall switches off the system's cloud backup and device-to-device transfer for its data. On iPhone, Evenfall's files are part of your own device backup — iCloud Backup, or a backup to a computer — if you use one. That backup is yours and is held under your Apple account, not by us.

Deleting. In the app you can delete a journal entry and edit or remove any memory card or answer. Deleting the app removes the journal, the memory, your answers and your mood marks from the phone. Two things outlive that:

• On iPhone, a few small items are kept in the system Keychain, which iOS does not clear when an app is deleted: the install identifier described below, a sign-in token for our gateway that expires after 12 hours, the last known count of free messages, your subscription status with the store's proof of purchase, and settings such as your language and appearance. None of them contains anything you wrote. Like other Keychain items they are also carried to a new iPhone when you restore it from an encrypted backup.
• If you made a device backup while Evenfall was installed, the copy inside that backup stays there until the backup is replaced or deleted.

What leaves your phone, and when

Nothing in this section happens until you have pressed Agree and begin on the last screen of the introduction. Everything is sent over an encrypted (HTTPS) connection to our gateway, a small server program we run on Cloudflare.

1. When you send a message — to write the reply. The message; the recent part of the same conversation (a rolling window of at most 20 messages); your answers; the memory notes; and the mood marks you set on the last seven evenings, as one line. The gateway passes them to an AI provider and streams the reply back.
2. When a session opens — to write the greeting. Your answers, the memory notes, the mood marks of the last seven evenings, the line you left for tomorrow if there is one, your language and the part of the day. No message of yours is sent for this.
3. To keep the memory up to date — at points during a conversation and when you leave the app. The recent conversation (the app sends at most the last 30 messages), the current memory notes, and the text of memory cards you asked Evenfall to forget — sent so that they are not written again. The provider returns updated notes, which are saved on your phone. A note you wrote or edited yourself is returned by the gateway exactly as you left it. Mood marks are not sent for this.
4. To register the app and check your allowance. The install identifier, a proof from Apple or Google that the app is a genuine copy (see "Identifiers"), the platform (iOS or Android) and the app's version number. If you have a subscription, also the store's proof of purchase (see "Purchases").
5. If you report a reply. See "Reporting a reply".

Every request also carries a sign-in token issued by the gateway. It contains the two identifiers described below and nothing else about you.

If you choose Let it go when you end an evening, that evening's conversation is removed from your journal and the memory goes back to how it was before the evening. It does not un-send what was already sent to write that evening's replies and memory updates.

Some of this can be sensitive. The mood marks, and some of the answers Evenfall offers as choices — for example "feeling low or alone" as what brought you here, or "faith" and "body and weight" as subjects to leave alone — say something about how you are. They are optional, they are kept on your phone, and they are sent as described above and for nothing else.

The weekly recap in Pro is put together on your phone from what is already there — the evenings you kept, the week's mood marks, the people and threads that came up. Nothing is sent for it.

Who processes it

What the AI providers are sent is the text and the companion's instructions. They are not sent your install identifier or your device identifier, and the request reaches them from our gateway, not from your phone, so they do not see your IP address. The text itself can of course contain whatever you wrote, including names.

Each provider handles what it receives under its own terms and privacy policy (DeepInfra, OpenAI, Anthropic, Cloudflare). As we read their published API terms on the date above, text sent this way is not used to train their models, and may be kept by them for a limited time for safety and abuse monitoring. Those are their commitments, not ours to make.

We do not sell what you write, and it is not used for advertising.

What our gateway keeps

The gateway does not store or log the text of your messages, your answers, your memory notes, your mood marks or the replies. While a request is being answered the text is held in memory, and then it is gone. The one exception is a reply you report.

What it does keep:

• Your free-message count. How many of the five free messages have been used, and the identifiers of the requests that used them (random identifiers the app creates, one per message, each with a retry count). Kept without an expiry, because the allowance is for the life of the installation.
• A mark that this installation uses version 2, and the link between your two identifiers. Kept without an expiry.
• Usage counters. Requests per minute; replies, greetings and memory updates per day; a measure of the amount of text processed per day; and for subscribers, replies per month. They expire by themselves: minute counters after about two minutes, daily ones after about 25 hours, monthly ones after about 37 days.
• A safety counter. A message that appears to express thoughts of self-harm is answered without spending a free message. To bound that, the gateway counts such messages per device per day. It stores the number, not the message, and the number expires after about 25 hours.
• A yearly count of crisis messages answered. Each time the gateway answers a message it has read as expressing thoughts of suicide or self-harm, it adds one entry to a count for that calendar year. An entry holds the name of the app, the year and a random value made for that entry alone: no device or install identifier, no time of day, no text. Entries are deleted after three years. Why it is kept is in "If you tell Evenfall you are thinking of harming yourself".
• Subscription status. Whether the installation has Pro, and which billing period is running. Kept for up to 13 hours and refreshed when the app signs in again.
• A registration throttle by IP address. When the app registers, the gateway counts registrations from that IP address, per minute and per day. These expire after about two minutes and about 25 hours.
• Operational logs. For each request, a line with no message content: which app, free or Pro, the kind of request, whether a free message was at stake or the request was answered under the safety allowance, which provider and model answered, and the app version. A line about a reply carries no identifier. A report adds a line with the device identifier. Cloudflare, as the host, also records technical data about requests under its own policy.

Identifiers

There are two, and neither is your name, your Apple or Google account, your phone number or an advertising identifier. We do not link them to a name or to any account.

• Install identifier. This is what the five free messages are counted against. On iPhone it is a random identifier the app creates and keeps in the iOS Keychain. On Android it is a one-way hash made from the device's Android ID and a fixed value of our own; the Android ID itself is not sent. It is built to survive deleting and reinstalling the app, so that reinstalling does not start the five free messages again.
• Device identifier. When the app registers, your phone proves to the gateway that it is running a genuine copy of Evenfall, using Apple's App Attest or Google's Play Integrity; on Android the gateway sends Google's integrity token back to Google to be checked. From that proof the gateway derives a device identifier, which changes when the app registers afresh. The usage counters, the safety counter and reports are filed under it.

If you tell Evenfall you are thinking of harming yourself

Evenfall is an AI. It is not a person, and it is not a therapist, a doctor or a crisis service; it cannot help in an emergency. The app says that it is an AI in the conversation itself: at the start of each day's conversation, and again every three hours while a conversation continues.

If you are in danger now, contact your local emergency services or a crisis line in your country. Do not wait for a reply from an app.

This section says what the app and our gateway do when a message suggests that you may be thinking of suicide or of harming yourself. It describes what the software does, and nothing beyond that.

What happens, in order

1. Your message is checked on your phone before anything else. Before the app looks at how many free messages are left, and before it sends anything, it compares what you wrote with a short list of phrases that plainly express a wish to die or to harm yourself. The list covers the eleven languages Evenfall is offered in, and every language's phrases are checked whatever language the app is set to. The same check runs on the other things you can write in the app: your answers to its questions, a memory card you write or edit, and the line you leave for tomorrow.
2. Crisis resources are shown at once. A sheet opens over the conversation, headed "If things feel heavy". It says that Evenfall is not a therapist, a doctor or a crisis service and cannot help in an emergency. It asks you to reach out now to someone who can help — a person you trust, or a crisis line in your country — and, if you are in immediate danger, to contact your local emergency services. Its button, Find a helpline, opens findahelpline.com, an international directory of crisis lines, in your browser. On a phone whose region is set to the United States, the sheet also shows Call or text 988 — the 988 Suicide & Crisis Lifeline — above that button; it opens your phone's dialler. That is the only telephone number Evenfall shows. For it the app reads your phone's region setting and nothing else: it does not know where you are and has no list of lines by country, and everywhere else the directory is where the line for your country is found. The same text and the same buttons are in About & safety at any time.
3. The message is still sent, and the free limit does not stop it. A message recognised this way is sent even when you have no free messages left and no subscription. It does not open the paywall, and it does not use up a free message. If a reply to an earlier message is still being written, the app does not make you wait for it.
4. Our gateway makes the same check. It reads your latest message — your own words, not the memory notes or the answers that travel with them — against the same list. A message it recognises is answered without counting against your free messages or the ordinary daily limits. So that this cannot be misused, it allows 30 such messages a day from one device. Past that, a message sent without a subscription gets no reply from the AI (see 5), and one sent with Pro is answered under the subscription's ordinary limits.
5. If no reply can be given — that allowance is used up, the connection failed, or the AI service did not answer — the conversation shows neither an error nor an offer to subscribe. It shows one calm line written by the app, not by the AI, and under it the same crisis text and the same Find a helpline button — with Call or text 988 above it in the United States — which stay in the conversation.
6. Nothing is offered on top of it. The paywall is not shown in answer to such a message and is not laid over the crisis sheet. For the rest of that conversation the app does not put its "Keep this?" card or one of its occasional questions under what you said.

The lists are short on purpose: they hold phrases that are hard to mistake, so that the sheet is not put in front of someone who is only having a bad day. That means they do not recognise every way of saying this. The instructions below apply to every message, whether or not a list recognised it.

What the AI is told to do, and not to do

Every reply is written by an AI model that follows written instructions from us. One part of those instructions is about safety. It outranks everything else in them, including the preferences you gave: someone who asked for short replies with no advice is still answered with concern and still urged toward help. When a message expresses thoughts of suicide or self-harm — or of harming someone else, of abuse, or of being in danger — the AI is told to:

• stop its usual reflective questions;
• respond calmly and with real concern, and take what you said completely seriously;
• encourage you to reach out now to someone who can help: a person you trust, your local emergency number, or a crisis line where you are;
• make clear that you deserve support from someone equipped to give it, and keep steering toward that help.

It is told not to:

• play down what you said;
• give clinical instructions, diagnose, or act as your therapist;
• name one particular country's hotline, because it may not know where you are; it urges you toward local emergency services or a crisis line instead;
• pretend to be a person. It is told that it is an AI, and to say so plainly if asked.

A reply to such a message is written by the same AI services as any other reply (see "Who processes it"). An AI can get things wrong, and its reply is not a substitute for the people and services above. No person at Erek Studio reads the conversation, and nobody is alerted.

What is kept

The gateway does not keep the message. It keeps two numbers. One is the day's count of such messages for your device, which is what the allowance of 30 is measured against; it expires after about 25 hours (see "What our gateway keeps"). The other is a yearly count: each time the gateway answers such a message it adds one to it, as a number that cannot be tied to a person or to a conversation, because California law asks the operator of an AI companion for a yearly figure of how many times it referred someone to crisis services.

Reporting a reply

If you choose Report on a reply, the text of that reply is sent to the gateway and stored with the device identifier, the time and the reason, for 90 days; then it is deleted automatically. This is the one case in which something from a conversation is kept on our side, and it happens only when you choose it. Version 2.0 sends the reply alone; the gateway can also store a short excerpt of the surrounding conversation if a later version sends one, and this page will say so if that changes.

Purchases

Evenfall Pro is sold and billed by Apple or by Google. We do not receive your card or billing details. To switch Pro on, the app sends the gateway the store's proof of purchase (the product, and Apple's signed transaction or Google's purchase token). The gateway checks it with Apple or Google and keeps only the result, as described above. The proof of purchase is also kept on your phone so that it can be checked again; when the store says a subscription has ended, the app removes it.

The purchase itself is made through Apple's StoreKit or Google's Play Billing library, which are part of the app and talk to Apple or Google directly. On Android, Google's billing library also sends Google operational data of its own about how the library is working. What those libraries send is governed by Apple's and Google's own policies, not by this one; none of it is anything you wrote.

Withdrawing your agreement

About & safety → Withdraw consent takes back what Agree and begin agreed to. From that moment the app sends nothing more to the gateway or to any AI provider, and it shows the introduction's last screen again; it sends again only if you agree again. Everything on your phone — journal, memory, answers, mood marks, settings — stays exactly as it is. Withdrawing does not un-send what was sent while the agreement stood.

Export

About & safety → Export everything builds one file on your phone — the journal, the memory, your answers, your mood marks and the small records, in a form you can read and a form a later import can restore — and hands it to your phone's share sheet. Where it goes from there is your choice; Evenfall sends it nowhere itself, and it removes its own copy of the file when the share sheet closes. The export contains none of the Keychain items listed above except your language and appearance settings.

Notifications

The evening reminder is a local notification: your phone schedules it and your phone shows it. Evenfall has no push-notification service, and no notification is sent to you from a server. The app asks for permission to notify only if you turn the reminder on.

The lock

If you turn on the lock, your phone's own system checks your face or fingerprint — or, when that does not work, the phone's own passcode — and tells Evenfall only whether the check succeeded. Evenfall does not receive your face or fingerprint data, or the passcode.

Dictation

If you use the microphone, your phone's speech recognition turns speech into text and Evenfall receives the text. Evenfall does not record or send audio. On iPhone the app requires recognition on the device, and dictation is unavailable where the phone cannot do that. On Android the app asks the system for on-device recognition and uses it where the system offers it; otherwise the request is handled by the phone's speech service — usually Google's — under that service's own policy.

Children

Evenfall is not directed to children, and we do not knowingly collect personal information from children. The age rating on its store page is the youngest age we intend it for. Evenfall is an AI companion, and an AI companion may not be suitable for some people under 18; the app says so under About & safety.

Deleting everything

• On your phone: delete the app. See "Deleting" above for what iOS keeps in the Keychain and for device backups. To take a copy with you first, see "Export".
• On our side there is nothing you wrote, unless you reported a reply. A reported reply is deleted automatically after 90 days. To have one removed sooner, write to us with the date, the approximate time and the text you reported, so that we can find it: there is no account to look it up by.
• The counters hold numbers and identifiers, not content. Those with an expiry delete themselves. The free-message count and the two marks kept without an expiry are filed under identifiers that the app does not show you and that we cannot connect to a name or an email address, so we are not able to pick out yours from a name or an address alone.

Depending on where you live, the law may give you rights over personal data, such as access, correction, deletion and objection. Most of what Evenfall holds about you is on your phone, where you can read, change and delete it yourself. For the rest, write to us.

Where it is processed

The gateway runs on Cloudflare's network, and the AI providers are companies based in the United States. What you send may therefore be processed outside your own country.

Contact

Questions, requests, or to report a problem: mustafasalimerek@gmail.com

If you are still using a version before 2.0

Versions before 2.0 showed rewarded video ads through Google AdMob, which received the device's advertising identifier, an approximate location derived from the IP address, and ad-interaction data. Version 2.0 contains no advertising and none of that software. Updating the app ends it. This section will be removed once versions before 2.0 are no longer offered.

Changes

If this policy changes, we will change the date at the top and post the new version here.