Privacy Policy

Last updated 2026-10-01.

Everbecome is a trade name of SupaFuse LLC, a Delaware limited liability company, registered at 1007 N Orange St., 4th Floor #3471, Wilmington, DE 19801, US. "Everbecome" is a product and brand, not a separate legal entity — the controller of your data is SupaFuse LLC.

Applicable privacy laws

Depending on where you live and how Everbecome processes your information, additional privacy laws may apply to you. We will provide the rights and protections required by applicable law. Nothing in this Privacy Policy limits rights you have under applicable law.

Data protection contact

For privacy questions or requests, contact us at privacy@everbecome.com. We have assessed, with counsel, that Everbecome is not currently required to appoint a Data Protection Officer or an EU or UK representative. If that changes, the relevant contact details will be added here.

What we collect, and why

When you join: your email address, a display name you choose, your country, your timezone, and your home community. The email is how you sign in. You can sign in with a code we email you, or with a Google or Apple account. We do not store a password for your Everbecome account.

If you sign in with Google or Apple: Google or Apple tells us your email address, whether it is verified, and an account identifier, and Google also sends the name on the account. We keep the email and the identifier, which is how the same person signs in next time. We do not keep the name, we do not show it to anyone, and we never use it to fill in the name you choose on Everbecome. If you hide your email through Apple, we get the relay address Apple gives us and that address is your Everbecome email. Signing in this way gives us nothing else: no contacts, no calendar, no files, nothing from your Google or Apple account beyond those fields.

Your practice: which practices you completed and when, in your own local date. This produces the days-practiced count on your You page.

If you speak a check-in: you can say a check-in instead of writing it, up to ninety seconds. Writing stays the ordinary way; speaking is there if you prefer it. The recording is kept with that check-in in Everbecome's private storage. Your pod can hear it, just as they can read a written check-in. If the check-in is reported, one authorized reviewer may also hear it while that report is open.

It is not public, is not posted outside the pod, and does not appear in any public feed. We do not transcribe it, interpret its content, or run automated content analysis on it. The Everbecome app keeps a temporary copy on your device only until the upload is confirmed, then deletes that temporary copy.

One person who knows, if you name someone: their name and email, the date they said yes, and the lines you wrote them. Used only to deliver those lines, held for you, and deleted when you remove them or delete your account. They are never contacted for anything else, and an address that asks never to be contacted is honored platform-wide.

Your reflections, your journal and your letters to yourself: what you write during a practice, in your journal, and in a letter to yourself. These are encrypted at rest. They are decrypted only through your own signed-in read path, and they are not available through any staff-facing, Guide-facing or administrative interface: no screen we operate shows them to anyone but you. To be precise about the limit of that: the encryption key is held on our servers, not on your device, so this is not end-to-end encryption. Staff do not read your reflections in the ordinary course of operating the platform.

A letter to yourself. You can write a letter to your future self and seal it for thirty days, ninety days or a year. While it is sealed we do not show its text to anyone, you included, until you open it; you may open it early, and an opened letter cannot be sealed again. When its day comes we tell you it is ready, in the app and, if you receive email from us, by email. The letter's text is never put in an email or a notification. A copy of your data that you request includes your letters, sealed or not, because they are yours. Deleting your account deletes them.

Your posts, comments and reactions in the community, and your pod check-ins. These are visible to other members as described below. Check-ins on a promise you hold without a pod are private to you and are shown to no other member.

Pod preference, and gender only if you ask for a same-gender pod. If you do, we store it, use it only to place you, and never display it to anyone. If you don't, we don't ask.

Payment records: what you paid, when, in what currency, and your subscription status, together with the reference IDs our payment processor uses to identify your subscription and transactions. We never see or store your card details — those go directly to our payment processor (Stripe, or Paystack in some regions), who processes the payment. If you subscribe inside the iPhone, iPad or Android app, the purchase is processed by Apple or Google as the store's own merchant, and we receive only your subscription status and the store's reference IDs.

Device and delivery data: your push subscription if you enable notifications, and whether lifecycle emails were sent.

We do not collect a date of birth. You confirm you are 18 or over; we store that confirmation, not your age.

Anonymous posts — read this part

When you post anonymously, other members see "A member" and never your name. We retain the link between you and that post internally. We are telling you this plainly because the alternative — implying the post is untraceable — would be untrue.

That link exists so moderation can act on abuse and so crisis support can reach someone in danger. It is not used to reveal who you are to other members: it never appears in any feed, in anything another member can download, or in any analytics record. Your own data download does include your anonymous posts, marked as anonymous, because they are yours — and a formal privacy request from you may likewise include them, because they are personal data we hold about you.

Crisis-related information

If something you write matches signals associated with an immediate safety concern, Everbecome may process the relevant information to provide crisis resources and route the content for human moderation. Where the information constitutes sensitive or special-category personal data under applicable law, we process it only on a lawful basis permitted by that law and apply appropriate safeguards.

Analytics — what we do and don't do

We record that things happened, never what you wrote.

An analytics record can say: a struggle post was created, anonymously, tagged to a trail. It cannot say what the struggle was. This is enforced in the database itself — a constraint rejects any analytics field whose name or length looks like content, so it is a property of the system rather than a promise about our conduct. Every event carries your community, membership tier, and signup month; it does not carry your name, email, or anything you wrote.

These records stay on our own servers. We do not send behavioral data to any third-party analytics provider, and there is no advertising, ad-tech, or cross-site tracking on Everbecome.

One exception, on the public website only. On everbecome.com (the marketing pages — not the app, and never anything you do once signed in) we use Cloudflare's cookieless Web Analytics to count page views, referrers and page speed. It sets no cookie, uses no fingerprinting, and identifies nobody; Cloudflare already delivers the website and sees the same requests as our own server would. (If any other third-party analytics tool is ever introduced, this section and, where required, a consent mechanism must change before it ships.)

Your first steps: a count, not a record. The app adds one to a daily total for each opening step it reaches: opened for the first time, each intro screen, the sign-in screen, asking for a sign-in code, and each of the five sign-up screens. It sends only the platform (iOS, Android or web) and the name of the step. It sends no device identifier, no advertising identifier, no address and no account (on the sign-up screens you are signed in, and the total still records nothing about who added to it), so the totals cannot be tied to a phone or to you. The app remembers on your device that a step was already counted; that memory never leaves it. We keep these totals on our own servers, and they are how we tell whether people who install the app ever open it, and which screen loses them.

Which link brought you. Some links to Everbecome carry a short code naming where they were shared, such as src=wave1 on a personal invitation or src=paid-google on an ad. If you arrive through one, on our website or in the app, we keep that code in your browser (a first-party cookie on everbecome.com, for up to 30 days) or on your device until you sign in, then record it once with your account. An Android install from Google Play can carry the same code, and an install that came from a Google ad is recorded as paid-google; the ad's click identifier is never kept. If you arrive without one, we record "direct". The code comes from a short list we approve and is a channel name, never your name, email or anything you wrote; a code that is not on the list is recorded as "unknown". It is recorded once and never changed by a later link. Only our own operations reports read it. Other members never see it, and it changes nothing about your pods, prices or notifications. It is kept separately from an invitation code from a member, which works as before.

Crash and error reports. When the app crashes or hits an unexpected error, it sends us a report so we can fix it. A report contains six things: where in the app it happened, the technical error message, the technical stack trace, which build of the app you were running, your platform (iOS, Android or web) and its version. That is the complete list — a report never contains what you were writing, your journal, your check-ins, your name or anything you typed. Reports go to our own database (the same one that runs the service — no additional company receives them) and are deleted automatically after 30 days.

The legal grounds we rely on

If you are in the UK or the EU, the law asks us to say which legal ground we rely on for each kind of processing. Where we rely on legitimate interests, the interest is named.

Who else processes your data

We do not sell your data. We do not share it for advertising. There is no advertising on Everbecome.

International transfers

Everbecome's servers are located in Germany (Hetzner). Everbecome is operated by SupaFuse LLC, a United States company, and our staff operate the platform from the United States, so the people who administer those servers access them from there. Our card payment processor is Stripe (United States), and Resend (United States) sends our email. The marketing site, not the app, is delivered through Cloudflare's global network, and a nightly backup of our database is stored with Cloudflare and kept for 30 days (your reflections stay encrypted inside it). If you enable notifications in the phone apps, they are routed through Expo (United States) to Apple (United States) or Google (United States) for delivery to your device. Turning notifications off in Settings deletes your device's token from our systems. Server and application logs stay on our servers in Germany; Cloudflare keeps its own request logs for the marketing site. So, depending on where you are, your personal data may be transferred to Germany and to the United States. Where applicable law imposes requirements for international transfers of personal data, we use a legally recognized transfer mechanism and appropriate safeguards, and you can ask privacy@everbecome.com for information about the safeguards that apply to your data.

Eligible Nigerian members who pay through Paystack. For eligible Nigerian members, payments may be processed through Paystack Payments Limited, a Nigerian payment processor. Paystack may process or store payment-related personal data in Nigeria and in other countries used by its affiliates and subprocessors, including Ireland for cloud storage. Where Paystack transfers personal data outside Nigeria, those transfers are handled under safeguards permitted by the Nigeria Data Protection Act 2023 and applicable data-protection laws, including contractual protections and other legally recognized transfer mechanisms.

Who can see what

A spoken check-in is fetched only for someone who is allowed to hear it: you, the current members of your pod, and, if it is reported, one authorized reviewer while that report remains open. Permission is checked each time playback is requested, so leaving a pod, or the closing, dismissal, or resolution of a report, ends that access. There is no reusable public URL to the recording, and access granted to one person does not grant access to anyone else.

• Only you: your reflections, your commitments, your journal, your letters to yourself.
• Your pod (3–8 people): your check-ins and your display name.
• Only you, again — notes written about you: every four weeks, one person in your pod is asked to write about what they noticed in your practice, and a second may add a note of their own. A note written about you is delivered to you alone. The rest of your pod never sees it, and neither does the person who wrote the other one. If nobody is able to write, your Guide writes instead, and a note from your Guide always says so.
• The community: your posts, replies and taps, under your display name — or "A member" if you posted anonymously.
• Any signed-in member who opens your member card (from your name, while you currently share a pod; nobody you do not share a pod with can open it): your display name, and then four fields you switch on or off in Settings — your community, the month you joined, your current promise, and your last five closed practices with how each ended. Nothing else is on the card.
• Staff: account and billing records, moderation reports, and the contents of posts that were reported. Not your journal.

There are no direct messages, no member directory, and no online/presence indicators on Everbecome. That is a deliberate design decision, and it means members cannot search for or privately contact each other.

Notes your pod writes about you

This is the one thing on Everbecome written about you rather than by you, so it gets its own section.

It is checked before it reaches you. Every note is screened against our community guidelines before delivery. If a note breaks them it is not delivered, and we may act on it.

It is kept for a short time so we can look into problems. A note that never reached its member is kept for 90 days so that if something is reported we can investigate what was actually said; after that its words are deleted and only a record that the note existed remains — who wrote it, who received it, when, and a one-way fingerprint of the text that can confirm a match but cannot be turned back into the words. A note that was delivered stays on your You page for as long as you keep your account.

If you report a note, we keep it until the matter is settled, and for a short period afterwards, so the decision can be reviewed. Reporting is one tap on the note itself.

Your Guide does not get to browse pod notes. Nobody at Everbecome can read a note simply because they work here. Access requires a reported case, a stated reason, and it is logged.

How long we keep information

A spoken check-in is kept as long as the check-in it belongs to. If you delete your account or the check-in is removed, its recording is removed from Everbecome's storage as part of the same deletion process. Unclaimed recordings are also removed by our cleanup process.

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the service, maintaining security, handling disputes and moderation matters, complying with legal and accounting obligations, and enforcing our agreements.

Different categories of information have different retention periods:

Where we do not have a fixed retention period, we periodically review whether we still need the information and delete or anonymize it when it is no longer required.

Deletion

You can request deletion of your account through the account settings. When you delete your account, we delete or de-identify personal information that we no longer need to retain. Some information may be retained where necessary for legal, accounting, security, fraud-prevention, dispute-resolution, or other lawful purposes.

Content that you contributed to community conversations may be anonymized rather than removed where retaining the conversation is necessary to preserve the integrity of the community experience. We do not use anonymized content to identify you.

Your privacy rights

Your download contains the recordings themselves, not links to them, so the copy you keep does not depend on your Everbecome account remaining open.

Depending on where you live, you may have rights including access, correction, deletion, restriction, objection, portability, and withdrawal of consent where processing is based on consent. We will respond to valid requests within the period required by applicable law and may extend a response where the applicable law permits an extension.

If you believe we have not handled your personal information properly, you may also have the right to complain to the data protection authority where you live or work — in the UK, the Information Commissioner's Office (ICO); in the EU, your national authority. We would appreciate the chance to address your concern first, but you are not required to contact us before exercising that right.

Nigeria. If the Nigeria Data Protection Act 2023 applies to you, you may have rights including access to and correction of your personal data, objection to or restriction of certain processing, data portability, deletion where applicable, withdrawal of consent where processing is based on consent, and rights relating to certain automated decisions. You may also lodge a complaint with the Nigeria Data Protection Commission.

You can download your data and delete your account yourself in Settings at any time. To make any other request, contact privacy@everbecome.com.

Cookies and similar

We store a sign-in session in your browser's local storage — that is what keeps you signed in, and it is strictly necessary for the service to work. We do not use advertising or tracking cookies, and there is no third-party tracker on the app or the marketing site. The cookieless page-view counting on the marketing site (above) stores nothing in your browser. In short: we use browser storage that is necessary to keep you signed in, and, if you arrived through a link that carries one, short first-party cookies on everbecome.com that hold an invitation code, the community whose page you came through, or a channel code until you sign in (at most 30 days, cleared once used). None holds an identifier for you or your device. We use no advertising or behavioral-tracking technology. If that ever changes, this section changes before it ships.

Children

Everbecome is for adults. You must be 18 or over. If we learn that an account belongs to someone under 18, we will close it.

Changes

If we change this policy materially we will tell members in the app and by email before it takes effect.

---