What we hold, and what leaves the machine.

This policy covers everylittle.app and the Every Little Thing app (the “Service”).

Every Little Thing is operated by Daniel van der Wel, an individual established in Cyprus, who is the data controller for everything described below. You can reach a person at support@everylittle.app, or through the feedback form, which works without an account.

The short version

• We store what you add, because the product is a record and there is no way to keep one without keeping it.
• An AI model weighs each moment, so the title of what you add, and anything you privately tell the app about your life, is sent to OpenAI for that purpose and no other. Spelled out in its own section below.
• Your private notes are never shown to your partner. That is enforced in one place in the code rather than promised here.
• A photo you add to a moment is kept for a year, in a private bucket, with its location and device data stripped, and shown to your partner the way the moment is. If you ask the app to read a photo, it is sent to OpenAI once for that. Its own section below.
• Your weekly review answers stay private until you have both submitted. Also enforced in code, in both directions.
• We do not sell anything about you, and we run no advertising, no remarketing, no data brokers, no session recording and no heatmaps.
• Analytics only if you agree to it, and you can change your mind here at any time.
• No third-party analytics script runs anywhere behind the sign-in.
• You can delete your account yourself, without writing to us.

What we store

All of it lives in a PostgreSQL database in Amazon Web Services, in one account and one region, encrypted at rest, reachable by the application and nothing else.

The one address nobody gave us themselves

If you ask us to email an invitation to your partner, we store the address you typed for them. It is kept as a record of what was sent where. We never use it to contact that person again, and we never check it against the address they eventually sign up with. If they never sign up, the invitation expires and the address is attached to no account.

The alternative asks us for nothing at all: copy the link and send it yourself. That is the option the screen offers first, and it is there for exactly this reason.

Who else sees anything

Five companies, and no others.

Amazon Web Services

Hosting and the database. Everything above sits there. Amazon Simple Email Service sends our outgoing mail: address verification, password resets, the weekly review reminder, an invitation you asked us to send, and the message telling you it was accepted. It sees the recipient address and the message.

Migadu

Hosts the mailbox that receives mail, so a reply to one of our messages reaches a person. Anything you send to support@everylittle.app lands there.

Polar

Payments, as merchant of record. The checkout is hosted on their side: no card detail ever passes through this site. What comes back to us is a signed message saying a subscription exists and what it is. We never see your card.

OpenAI

An AI model does four jobs here, and each one sends something to OpenAI:

• Weighing a moment. When a moment is added, its title (the catalog’s wording, or your own words), its category, the app’s working notes about your couple, and both partners’ private “about you two” texts are sent so the moment can be weighed one to three hearts for your life in particular. The sentence that comes back never quotes or hints at what either of you wrote.
• Learning your week. Roughly once a week the model rewrites its private working notes about your couple, from those same texts and the titles of recent moments. The notes are read by the weighing and by nobody else.
• Filing your words. When you type something the catalog has no name for, the words you typed are sent to be filed into it.
• Reading a photo, only when you ask. If you log a moment from a photo, a reduced copy of that photo — at most about a thousand pixels across, with every tag stripped: no location, no device, no time — is sent once so the model can say in a line what it shows you did. You then keep or change that line. A photo you simply attach to a moment is never sent to OpenAI.

What never goes, in any of the four: a private note, a description, a weekly review answer, your name, your email, or your partner’s. Each call is metered by count only. We keep no copy of the text or the picture in the meter.

Photos on moments

A photo you add to a moment is kept in a private storage bucket at Amazon Web Services, in the same account and region as everything else here, encrypted, with public access blocked. What is kept is a reduced copy — at most about three thousand pixels across, as a JPEG, with the location, device and time tags removed — never the original file. It is shown only to the two of you, and only while signed in: there is no link to a photo that works without your session. It is deleted one year after you added it, and sooner if you take it off the moment, withdraw the moment, or close your account. Your partner sees the photo the way they see the moment’s description; it is not private the way a note is.

A photo you choose as your face is kept the same way, for as long as your account exists, and is shown to you and your partner only. It is replaced when you pick a new one, removed when you pick a drawn face or none, and deleted with your account. It is never sent to the AI model.

Voice input, if you use it

The microphone button on the add screen uses your browser’s (or, in the app, your device’s) own speech recognition. The audio is handled by that vendor (Google in Chrome, Apple in Safari and on an iPhone) under their terms; it never passes through us and we never store it. Only the resulting text lands in the field, where you check it before anything goes in. Typing works everywhere the button does not.

Google Analytics

On thirteen public pages only. This is spelled out in its own section below, because it is the claim most often made loosely.

Google Analytics, precisely

Where it runs: the thirteen public pages, and only those: the landing page, sign-in, sign-up, feedback, this page, the terms, the glossary, the two essays and the four feature pages. That is the whole list, and it is default-deny: a page added to this product later is untracked until somebody adds it to that list deliberately.

Where it does not run: everywhere behind the sign-in: your dashboard, the inbox, the weekly review, the add screen, settings, the connect screen. Also the password-reset, address-confirmation and unsubscribe pages, because those carry a single-use token in the address bar.

What is sent: the page’s origin and path, its title, and what Google’s own tag collects: approximate location derived from your IP address, device, browser, language and referrer. The query string is removed before anything is sent, and there is a test that fails if that stops being true.

One event: that an account was created. It carries no parameters. Not your email, not your name, not an identifier.

What is switched off: Google Signals and ad personalization. This is the setting that would otherwise make this data available for building advertising audiences.

Cookies: Google Analytics sets its own cookies on those pages to recognize a returning browser, and only once you have agreed. Our own cookie is the session cookie, which is set only after you sign in, cannot be read by JavaScript, and is not sent to other sites. It is necessary for the Service to work at all and there is nothing to consent to about it.

If you block it, nothing breaks. A visitor with an ad blocker sends nothing at all, and the product behaves identically.

Your analytics choice

Nothing is loaded and no analytics cookie is set until you say yes. We ask once, on the first public page you land on, and declining is one click in the same place as accepting. There is no second screen and no pre-ticked box.

You can change your mind here, at any time, in either direction:

Withdrawing is not retroactive. It stops anything further from this browser immediately, and what Google already received is a separate question you can put to us at support@everylittle.app.

Sign in with Google and with Apple

If you use either, that provider hands your browser a signed token, your browser passes it to us, and we verify it. We learn the email address and name the provider releases to us. If you use Apple’s private relay, we get the relay address and never your real one. We do not post anything, read anything, or ask either provider for anything else.

Server logs

Our web server writes a line per request (address, path, referrer, user agent) to a log that rotates. We read it to count visits, and the tool that does so prints only totals; no address is stored or exported anywhere.

Keeping it, and deleting it

We keep what you add for as long as your account exists, because that is what a record is for.

You can delete your account from settings, without writing to anyone and without being asked why. It removes the account and what belongs to it.

One honest caveat about backups. The database has point-in-time recovery over a 35-day window. A deleted account is gone from the live database immediately, and ages out of that recovery window over the following 35 days. We would rather say that plainly than imply an erasure that is instant everywhere.

Security

The connection is HTTPS and nothing else is accepted. Passwords are stored as PBKDF2 hashes. Session tokens are stored only as a hash of themselves. The database is encrypted at rest and is not reachable from the public internet. Which third-party scripts may run at all is restricted by a policy the browser enforces, and it names each one.

No system is perfect, and a policy claiming otherwise would be the least trustworthy sentence on this page.

Children

The Service is for adults and is not directed at children under 13. We do not knowingly collect anything from them. If you believe a child has created an account, write to support@everylittle.app and we will remove it.

Your choices

• See and export what you have. The export is yours: CSV or JSON.
• Correct it. Everything you added is editable after the fact.
• Delete it. From settings, at any time.
• Stop the one scheduled email. The weekly reminder can be switched off in one click from the message itself, with no sign-in, or from settings.
• Turn the numbers off without losing the record: quiet mode hides every comparison and keeps every explanation.

Your legal rights

Because the operator is established in Cyprus, the EU General Data Protection Regulation applies to everything described here, wherever you live. You have the right to:

• Access the personal data held about you, and get a copy of it.
• Correct anything inaccurate.
• Erase it. Account deletion in settings does this yourself, immediately, with the backup caveat described above.
• Take it with you in a machine-readable format. That is what the CSV and JSON export is.
• Restrict or object to particular processing, including the analytics described above.
• Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what was done beforehand.

Write to support@everylittle.app for any of these. You also have the right to complain to a supervisory authority. For Cyprus that is the Office of the Commissioner for Personal Data Protection, and if you live elsewhere in the EU or EEA you may complain to your own country’s authority instead.

If you are in California or another US state with its own privacy law, those rights sit alongside these. We do not sell personal information and we do not share it for cross-context behavioral advertising, which is why there is no “do not sell” link. There is nothing for it to switch off.

Why we are allowed to hold it

GDPR asks for a stated legal basis for each purpose. Ours are:

• Performing our contract with you: your account, the record you keep, your couple’s settings, your subscription. Without this data there is no Service to provide.
• Legitimate interests: keeping the Service secure and working, rate-limiting abuse, and reading server logs to count visits.
• Consent: the analytics described above, and the optional feature that sends your own words to be filed into the catalog. Both are things you can decline without losing the product.
• Legal obligation: keeping what tax and accounting law requires us to keep about a payment.

Where your data goes geographically

The database and the application are hosted in Amazon Web Services. Mail is sent through Amazon SES and received through Migadu. Payments are processed by Polar. Photos on moments are kept in Amazon S3. Analytics data goes to Google, and what the weighing reads (moment titles, and what you privately told the app about yourselves) goes to OpenAI, as does a photo you ask the app to read.

Several of those involve a transfer outside the EEA, principally to the United States. Where that happens we rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one covers the recipient. You can ask us which applies to a particular provider.

How long we keep it

• Your account and what you added: until you delete it. There is no automatic expiry. A record whose point is to be looked back on should not quietly erase your first year.
• After deletion: gone from the live database immediately, and out of the 35-day backup window over the following 35 days.
• Invitations: expire after 14 days, including the address typed for a partner who never signed up.
• Feedback: kept while it is useful to act on.
• Payment records: as long as tax law requires, which is longer than your account may last.
• Server logs: rotate, and are not archived.

Changes

When something factual here changes, the date at the top changes with it. If a change is material (a new company seeing your data, or a new kind of data leaving the machine) we will say so in the app rather than quietly editing this page.