Privacy Policy | Everythings

1. Who we are

Everythings ("Everythings", "we", "us") is a collaborative workspace application that lets you organize notes, ideas, projects, and lists into hierarchical "things" inside shareable workspaces.

This Privacy Policy explains what personal information we collect when you use Everythings on the web or mobile, how and why we use it, when we share it, how we protect it, and the choices available to you.

2. Information we collect

Depending on how you use Everythings, we may collect:

Account information: your name, email address, profile picture, and other information you provide when creating or managing your account. If you sign in using Google or Apple, we receive the basic profile information described below.
Content you provide: workspaces, things, comments, marks (reactions), files, images, and other information you create, upload, store, or share through Everythings ("User Content"). User Content may contain personal information about you or other individuals.
Usage information: information about how you interact with Everythings, such as items you have viewed or recently accessed and product analytics events recording which features you use, where necessary to provide, secure, and improve the service.
Payment information: if you subscribe to a paid plan, our payment processors collect and process your payment details. We do not receive or store your full payment card number. We receive subscription status and related billing identifiers needed to apply your plan to your account.
Credentials you choose to store: if you use the optional AI and voice features, you supply your own AI provider API key. We store it encrypted and use it only to send your requests to the provider you selected.
Technical and security information: information reasonably necessary to operate and secure the service, such as device, browser, log, authentication, and security-related information. We use cookies and similar local storage that are necessary to sign you in and keep you signed in. We do not use advertising or third-party tracking cookies.

3. Google and Apple account data

When you choose "Continue with Google" or "Sign in with Apple," we request only basic profile information made available through those sign-in services, such as your name, email address, and (for Google) profile picture. If you use Apple's option to hide your email address, we receive a private relay address instead of your real one.

We use this information to:

Create and authenticate your Everythings account;
Display your name and profile picture to users with whom you collaborate; and
Send account-related communications.

We do not request access to your Gmail, Google Drive, Google Calendar, iCloud, or other services of those providers through sign-in. We do not sell Google or Apple account data or use it for third-party advertising.

4. Personal information contained in User Content

Users choose the information they create, upload, store, and share through the service. Everythings does not determine what information users choose to include in their User Content. As a result, User Content may include personal information about other individuals.

If you provide personal information about another person, you are responsible for ensuring that you have all rights, permissions, consents, and other lawful authority necessary to upload, store, use, and share that information through Everythings.

You must not upload, store, or share personal information that you are not legally authorized to provide, or information that is prohibited under our Terms & Conditions.

Everythings processes personal information contained in User Content only as reasonably necessary to provide, maintain, secure, and support the service and as otherwise described in this Privacy Policy.

5. How we use information

We may use information collected through Everythings to:

Create, maintain, and authenticate your account;
Provide and operate the Everythings service;
Store and display User Content according to workspace permissions and sharing settings;
Enable collaboration between users;
Provide features such as recently visited items;
Process subscriptions, payments, and plan limits for paid plans;
Carry out the AI and voice requests you make, and the requests made by applications you have connected to your account;
Communicate with you about your account or the service;
Provide customer support;
Maintain the security and integrity of the service and investigate suspected misuse;
Diagnose technical problems and improve the reliability and functionality of the service; and
Comply with applicable legal obligations.

We do not sell your personal information.

6. Sharing and disclosure

We may disclose personal information:

With users you choose to collaborate with: when you share a workspace or invite another user, information and User Content within that workspace may become accessible to that user according to the applicable permissions and sharing settings. You are responsible for choosing the individuals with whom you share your workspaces and User Content.
With service providers: we use third-party providers to help host, operate, maintain, secure, and support Everythings, including providers of hosting, database, storage, authentication, email, and payment processing services. These providers may process information on our behalf as necessary to provide their services and are subject to appropriate contractual or confidentiality obligations.
With AI providers you choose: if you use the optional AI or voice features, the content of your requests — which can include the text of your things, workspace names, and related User Content — is sent to the AI provider you selected, using the API key you supplied, so that it can generate a response. That provider handles the data under its own terms and privacy policy. These features are off unless you add a key.
With applications you connect: Everythings can be connected to external applications and AI assistants that you authorize. When you grant an application access, it can read — and, if you grant write access, modify — the workspaces and things in your account until you revoke that authorization. You are responsible for the applications you connect.
For legal and safety purposes: we may disclose information where we reasonably believe disclosure is required by applicable law, legal process, or governmental request, or where necessary to protect the rights, security, or integrity of Everythings, our users, or others.
In connection with a business transaction: if Everythings is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, information may be disclosed as reasonably necessary in connection with that transaction, subject to applicable law.

7. Storage and security

We use administrative, technical, and organizational safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or loss.

Data is stored using managed infrastructure, including a PostgreSQL database provided through Supabase. Access controls, including row-level security, are used to restrict access to workspace information based on applicable permissions. AI provider API keys you store are encrypted at rest.

Uploaded files and images are stored in cloud storage and served from public links containing a randomly generated identifier. Uploading requires a signed-in account, and only the uploader can replace or delete their own files, but anyone who has the link to a file can open it without signing in. The links are not listed or published anywhere, and are impractical to guess, but they are not individually access-controlled — so treat a file you upload as shareable by link, and do not upload material that must remain strictly confidential.

Information transmitted between your device and Everythings is protected using HTTPS/TLS encryption.

No system or method of electronic storage or transmission can be guaranteed to be completely secure. Users are also responsible for protecting their account credentials and promptly notifying us if they suspect unauthorized access to their account.

8. Data retention and deletion

We retain personal information for as long as reasonably necessary to provide the service, maintain your account, meet our legitimate operational requirements, resolve disputes, enforce our agreements, and comply with applicable legal obligations.

You can edit or delete workspaces and things from within the service.

You may delete your account using Settings → Delete account on the web or Profile → Delete account in the mobile app. Additional information about account deletion and what information may be retained is available on our account deletion page.

Deletion from active systems may not result in immediate deletion from backups or other systems where limited retention is reasonably necessary for security, legal, or operational purposes. Information retained in those systems will be handled in accordance with this Privacy Policy and applicable law.

If you cannot access your account, contact us at support@everythings.app.

9. Your privacy choices and rights

Depending on where you live and applicable law, you may have rights relating to your personal information, including rights to request access to or correction of personal information we hold about you.

You may also update certain account information directly through the service.

To make a privacy request or ask a question about how we handle personal information, contact us using the information below. We may need to verify your identity before completing certain requests.

Where personal information about you forms part of User Content uploaded or controlled by another Everythings user or organization, that user or organization may be responsible for responding to your request. Where appropriate, we may direct your request to them.

10. Children

Everythings is a general-audience service and is not directed to children. You must be at least 13 years old to use it, and at least the higher minimum age set by the laws of the country where you live, if one applies. Our Terms & Conditions set out this requirement in full.

We do not knowingly collect personal information from anyone below the minimum age that applies to them. We do not ask for a date of birth, and we do not use personal information to build advertising profiles or to serve targeted advertising to anyone.

If you are a parent or guardian and believe a child has given us personal information, contact us at support@everythings.app. If we learn that we hold personal information collected from someone below the applicable minimum age, we will delete the account and that information.

Parents and guardians who share a workspace with a teenager should know that a workspace is visible to everyone invited to it. Things, comments, marks, and the record of who has viewed a thing are shown to the other members of that workspace.

11. International processing

Our service providers may process or store information in jurisdictions outside the province, state, or country where you live. As a result, information may be subject to the laws of those jurisdictions and may be accessible to courts, law enforcement, or governmental authorities in accordance with applicable law.

12. Privacy and security incidents

If we become aware of a privacy or security incident involving personal information, we will investigate and take appropriate steps in accordance with applicable law, including providing notifications where legally required.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Everythings, our practices, or applicable legal requirements. When we make changes, we will update the "Last updated" date above.

14. Contact us

If you have questions, concerns, or requests relating to this Privacy Policy or our handling of personal information, contact us at support@everythings.app.