Privacy
What EverData reads, where it keeps it, and the few occasions on which anything leaves your Mac.
Last updated 22 September 2026
Operator: EverData, operated by Amplify
Applies to: the EverData application and everdata.one
The short version
- Your contacts live on your own Mac, in a vault encrypted with a passphrase that only you hold. We keep no copy and no key. If you lose the passphrase, nobody can open the vault, including us.
- If you connect Google, EverData reads contacts and calendar, read-only, into that same local vault. It asks for no access to Gmail and cannot read a message.
- Online features include update checks, feedback, lookups, optional AI questions and chat, crash reporting, and Google when you connect it. Sections 6 and 9 explain what is sent.
- We sell nothing to anyone. There is no account, no analytics, no advertising and no tracking, in the app or on this site.
1Who this is
EverData is made and operated by Amplify. Write to privacy@amplify.one with any question about this policy or about data held about you. It reaches the person responsible for privacy.
[owner to confirm: the registered legal entity and its Chamber of Commerce number.]
2Where your data lives
EverData is a single-tenant desktop application for the Mac. Its vault is one encrypted file on your Mac: AES-256-GCM, with the key derived from your passphrase by PBKDF2 at 600,000 iterations. We never receive the passphrase, hold no key, and cannot recover a vault. There is no EverData account, no login, no user database, no synchronisation between machines and no server-side backup. One person, one vault, on one machine.
Everything the app holds is in that file: each contact record, the source and time of every fact on it, your shortlists, your history and your imports. Deleting the vault deletes the data. A file you send us to build a vault is described in the next section. Information sent through optional online features is described in sections 6 and 9.
3The file you send us to build the vault
A vault has to be filled from somewhere. If you send us a contact export — through the private upload link, with the confirmation code that reaches you separately — that file is used for one purpose only: building the vault that is then handed to you.
- Encrypted, in the European Union. It is stored in a private, access-blocked store in AWS eu-west-1 (Ireland), under a key kept for this purpose alone.
- Barely reachable, deliberately. It can be read only after an automated malware scan passes, and only by the person building your vault. The website itself has no route that can download it back.
- Deleted after fourteen days, automatically. That happens whether or not the vault has been built. If you want it gone sooner, write and ask.
4Google data, and what we do with it
Connecting Google is optional. When you choose to connect, you sign in with Google yourself, in your own browser, and grant exactly two scopes:
- .../auth/contacts.readonly, the contacts you already keep with Google. Used to build one record per person and to fill in ways of reaching them.
- .../auth/calendar.readonly in existing releases, narrowed to .../auth/calendar.events.owned.readonly in updated connector releases. EverData reads events on your primary calendar only. Used to record that you have met someone, and when, so a record can say how current it is. EverData uses the attendees and the time of an event for this, plus event and attendee status to filter the results: not the title, not the description, not the location.
Both are read-only. EverData writes nothing back to your Google account, and requests no scope that can read the body of a message. The sign-in happens between you and Google; no server of ours takes part, and the app on your Mac reads from Google directly. The connector does not route Google responses through our servers. Optional AI and lookup features can send selected contact information as described in sections 6 and 9.
Where it is kept. The contacts and calendar data EverData reads are written into the encrypted vault on your Mac. The sign-in tokens are held in your macOS Keychain, marked so that they require an unlocked Mac, never sync to iCloud, never enter a backup, and never reach a second machine.
How long. For as long as you keep the vault. Revoking access stops any further reading; what was already read stays in your vault as your own records until you delete them, or the vault.
How to end it. Disconnect inside the app, which removes the tokens from your Keychain. That is local, so it stops EverData reading anything further from this Mac; to withdraw the grant at Google itself, revoke EverData at myaccount.google.com/permissions. Using the app’s start-over control also removes the local tokens.
How we protect sensitive Google user data
These protections apply to Google contact information, calendar attendance data and OAuth credentials. Requests between this Mac and Google's authorization, token and API endpoints use HTTPS with TLS encryption in transit. The desktop authorization callback uses a temporary loopback address on this Mac; it is not an Internet service. Each authorization attempt uses PKCE with S256 and a random state value to bind the response to the request that started it.
Imported contacts and derived meeting dates saved in the local vault are encrypted at rest with AES-256-GCM. The key is derived from your passphrase using PBKDF2-HMAC-SHA256 with a random salt and 600,000 iterations. Data is decrypted in memory while the vault is open. OAuth access and refresh tokens are stored separately in the macOS Keychain using device-only, when-unlocked protection; the app's web interface does not receive these tokens. The native connector attaches credentials only to permitted Google destinations and uses read-only API requests.
We limit the data requested: contact names, email addresses, phone numbers, organisations, addresses and URLs; and, for calendar matching, event status, start dates or times, attendee email addresses and attendance flags over a 24-month window. Calendar titles, descriptions and locations are excluded from the request. Imported information is used for contact records and calendar-derived “last met” dates. Optional online uses of contact information are described in sections 6 and 9.
Disconnect removes this Mac's Google tokens. Revoking access in your Google Account also withdraws Google's grant. Neither action deletes previously imported records; delete those records or use the app's start-over control to remove the vault and local tokens. Manually deleting a vault file does not itself erase Keychain items. Exports and backups you create are separate copies under your control. Protect your Mac account, passphrase and any exported files; encryption does not protect information displayed in an unlocked app from someone who can use your session.
5Limited Use
EverData’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The use of information received from Google Workspace scopes will adhere to the Google Workspace User Data and Developer Policy, including the Limited Use requirements.
Google user data is used only to provide and improve the features described on this page. It is never sold, never used for advertising or ad profiling, never used to judge creditworthiness, and never used to develop, improve or train generalised or non-personalised artificial-intelligence or machine-learning models. It is transferred to nobody except as this page describes: to the services providing the optional lookup and AI features you request, as described in sections 6 and 9, or where the law requires it; in a merger or sale of the business it would move only with your explicit prior consent. We do not use Google data for unrelated human review. The two exceptions are those Google itself allows: where you have explicitly asked us to help with a specific problem and shown us the data, or where the law requires it.
6What leaves your Mac, and when
The desktop app restricts network destinations through its native handlers. Google reads, updates, feedback, lookups, optional AI features and crash reporting have separate purposes. Optional AI requests are described in section 9.
- The update check. On launch the app may ask one fixed HTTPS address of ours whether a newer build exists. The request carries no body, no query and no identifying header: nothing about you, your Mac or your vault beyond the fact that a copy asked. It never installs anything.
- Feedback you write. If you send a note from inside the app, it reaches us with four things and nothing else: the kind of note, the text you typed, the screen you were on, and the version of the app. It carries no contact and no person identifier, deliberately, so that a note left while viewing someone is about the app and not about them.
- Looking a person up, when you ask. EverData can check a public source to fill a gap in a record. Before anything leaves, the app shows you the exact fields and values that would be sent, for that one person, and waits for you to press the button. Nothing is sent in the background, and nothing is sent for a person you did not ask about. The fields that can ever be included are name, company and role.
- A crash report, if the app itself fails. When EverData crashes, it sends a report so that the fault can be fixed: the type of error, its message with content scrubbed, the stack of file names and line numbers, the screen you were on with identifiers masked and the query removed, and the build version. Never a name, an email address, a phone number, a company, a person identifier, a search you typed, a breadcrumb, a console line, a cookie or a header. The report is stripped twice, once by the page that produces it and once by the shell that controls where it may go and cannot be redirected. It goes to Sentry, an error-reporting service, whose receiving server sees the IP address the request came from, as any server does.
- Google, if you connected it, as described in section 4.
Not every copy has every channel. A channel exists in a build only if that build was given the address for it; a copy built without a crash-reporting address has no crash reporting at all, the code path is simply absent. [CONFIRM: how an owner can see which channels their copy has, e.g. an About screen] — and we can tell you from your build number.
7Who receives anything
Nobody receives your vault. The parties below receive the specific things named, and nothing more. There is no analytics provider, no advertising network and no data broker, and nothing is sold.
- Amazon Web Services EMEA SARL
- The intake file, for up to fourteen days.
- Functional Software, Inc. (Sentry)
- Crash reports, stripped of personal data; the IP address of the request.
- Vercel Inc.
- Ordinary web server logs for everdata.one, including IP addresses.
- Google LLC
- Nothing beyond your sign-in and the read requests the app on your Mac makes; Google’s own terms apply.
- EverData
- Feedback notes, email you send us, and the address the intake code was sent to.
8Where it is processed
Your vault: on your Mac, wherever you are. Our own correspondence and feedback: the European Union.
9Asking questions of the vault
If you use optional AI questions, chat or research, the app sends your question and relevant conversation or search context to the configured AI service. Context can include names, roles, companies, locations, tags and aggregate results from your vault, including imported Google contacts. Research can send a selected person's name and company. The app filters email addresses and phone numbers before sending chat data; this does not make the remaining information anonymous. Avoid including unrelated sensitive information in your questions.
Depending on your build and configuration, requests go through an EverData service to an AI provider, or directly to the configured provider. These features are separate from the direct Google import. Imported Google data must not be used to train generalised or non-personalised models. Contact privacy@amplify.one for the provider, processing location and retention details for your build before using these optional features.
The chat endpoint on everdata.one runs on Vercel and forwards authorized requests to OpenAI using the Astra model. The OpenAI key stays on the server. This endpoint does not log question or answer contents and requests no stored response from OpenAI. That setting is not a promise of zero provider retention. Hosting services may retain operational metadata such as IP addresses and request timing.
10How long things are kept, and how to delete them
There is no account to close. What exists, where it is, and how it ends:
- Your vault
- Your Mac, for as long as you keep it.
- Google sign-in tokens
- Your macOS Keychain, until you disconnect or revoke.
- Your email address for the handover
- Our correspondence, for 24 months after the last message.
- Feedback notes
- Support inbox, for 24 months.
- Crash reports
- Sentry, for 90 days.
- Email you send us
- Our mailbox, for 24 months after the last message.
To delete anything on our side, write to privacy@amplify.one from the address you used with us. We delete it within thirty days and confirm when it is done. For the vault, the deletion is yours to perform and it is immediate: nothing of it exists anywhere else.
11This website
everdata.one sets no cookies, runs no analytics, and embeds nothing from a third party. Its host keeps ordinary server logs, which include IP addresses, for the short period needed to serve and secure the site. There is nothing to opt out of because there is nothing collecting.
12Your rights, and the basis for what we do
Where the GDPR applies, you have the right to access, correct, export and erase personal data held about you, to restrict or object to its processing, and to withdraw any consent you have given. For the vault, those rights are yours to exercise directly: it is your file, on your machine, and the app can export it. For anything you have sent us — a contact file, a feedback note, an email — write to privacy@amplify.one and we will answer within thirty days. If you are not satisfied, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the authority where you live.
The basis on which we do each thing on this page: building the vault from your file, our agreement with you; the Google reading and the look-up, your own instruction, given each time; the update check and crash reporting, our legitimate interest in software that works, and they carry nothing that identifies you [CONFIRM: or your choice at first launch, if that decision is taken]; feedback and email, your choice to write; the website’s server logs, our legitimate interest in keeping the site up and secure; invoices, the law.
If someone else’s vault holds a record about you, that vault is on their Mac and we have no copy, no index and no way to search it. Ask them; the app lets them show you the record, correct it and delete it.
EverData is a professional tool and each copy is built for the person who receives it. It is not intended for anyone under sixteen.
13Changes
If this policy changes, the date at the top changes with it, and a material change will be described here rather than absorbed quietly. Anything that would send new data off your Mac is added to section 6 before it ships, not after, and the app will ask you before it uses Google data for a purpose not described here.
—EverData privacy policy
Questions to privacy@amplify.one. See also the terms.