What we hold, and what leaves the machine.
This product asks two people to write down the details of their week. The least it owes them is a plain account of where that goes.
Last updated
This policy covers everylittle.app and the Every Little Thing app (the “Service”).
Every Little Thing is operated by Daniel van der Wel, an individual established in Cyprus, who is the data controller for everything described below. You can reach a person at support@everylittle.app, or through the feedback form, which works without an account.
The short version
- We store what you log, because the product is a record and there is no way to keep one without keeping it.
- Your private notes are never shown to your partner. That is enforced in one place in the code rather than promised here.
- Your weekly review answers stay private until you have both submitted. Also enforced in code, in both directions.
- We do not sell anything about you, and we run no advertising, no remarketing, no data brokers, no session recording and no heatmaps.
- Analytics only if you agree to it, and you can change your mind here at any time.
- No third-party analytics script runs anywhere behind the sign-in.
- You can delete your account yourself, without writing to us.
What we store
All of it lives in a PostgreSQL database in Amazon Web Services, in one account and one region, encrypted at rest, reachable by the application and nothing else.
| What | Why it exists |
|---|---|
| Email, display name, timezone, and a hash of your password | To sign you in and to cut your week at your own local midnight. The password is stored as a PBKDF2 hash — we cannot read it. |
| Your connect code | A permanent public identity, printed on a QR so your partner can find you. It identifies; it never authenticates. Every connection is approved by the person who owns the code. |
| Contributions — the action, when, effort, context, your own description, and the stored score receipt | The record itself. |
| Private notes on a contribution | Sent back only to whoever wrote them. Not to your partner, ever. |
| Weekly reviews, including anything you wrote in them | Invisible to your partner until you have both submitted. Private notes never cross at all. |
| Life-context periods — the name you gave a hard stretch | To read a week against what that week actually was. |
| Couple settings, and a log of every change either of you made to them | Either partner can change a shared setting alone, so both can see that it changed. |
| Subscription state | Whether the couple has a paid plan. Never which of you paid — the app does not surface that to either of you. |
| Sessions | Stored as the SHA-256 of the session token and never the token itself. |
| Feedback you send us | What you typed, and the route you were on with the query string stripped. No score, no partner, no contribution, no private note. |
| Invitations | The link’s secret, when it expires, and who used it. See the paragraph below. |
The one address nobody gave us themselves
If you ask us to email an invitation to your partner, we store the address you typed for them. It is kept as a record of what was sent where. We never use it to contact that person again, and we never check it against the address they eventually sign up with. If they never sign up, the invitation expires and the address is attached to no account.
The alternative asks us for nothing at all: copy the link and send it yourself. That is the option the screen offers first, and it is there for exactly this reason.
Who else sees anything
Five companies, and no others.
Amazon Web Services
Hosting and the database. Everything above sits there. Amazon Simple Email Service sends our outgoing mail — address verification, password resets, the weekly review reminder, an invitation you asked us to send, and the message telling you it was accepted. It sees the recipient address and the message.
Migadu
Hosts the mailbox that receives mail, so a reply to one of our messages reaches a person. Anything you send to support@everylittle.app lands there.
Polar
Payments, as merchant of record. The checkout is hosted on their side: no card detail ever passes through this site. What comes back to us is a signed message saying a subscription exists and what it is. We never see your card.
OpenAI
When you describe something in your own words and ask us to file it into the catalog, the words you typed are sent to OpenAI to be categorized. Nothing else goes with them — not your partner, not a score, not a private note, not your name. Logging in your own words without asking for that is free and always will be, and it sends nothing anywhere.
Google Analytics
On four public pages only. This is spelled out in its own section below, because it is the claim most often made loosely.
Google Analytics, precisely
Where it runs: the thirteen public pages, and only those — the landing page, sign-in, sign-up, feedback, this page, the terms, the glossary, the two essays and the four feature pages. That is the whole list, and it is default-deny: a page added to this product later is untracked until somebody adds it to that list deliberately.
Where it does not run: everywhere behind the sign-in — your dashboard, the inbox, the weekly review, the quick log, settings, the connect screen. Also the password-reset, address-confirmation and unsubscribe pages, because those carry a single-use token in the address bar.
What is sent: the page’s origin and path, its title, and what Google’s own tag collects — approximate location derived from your IP address, device, browser, language and referrer. The query string is removed before anything is sent, and there is a test that fails if that stops being true.
One event: that an account was created. It carries no parameters — not your email, not your name, not an identifier.
What is switched off: Google Signals and ad personalization. This is the setting that would otherwise make this data available for building advertising audiences.
Cookies: Google Analytics sets its own cookies on those pages to recognize a returning browser, and only once you have agreed. Our own cookie is the session cookie, which is set only after you sign in, cannot be read by JavaScript, and is not sent to other sites. It is necessary for the Service to work at all and there is nothing to consent to about it.
If you block it, nothing breaks. A visitor with an ad blocker sends nothing at all, and the product behaves identically.
Your analytics choice
Nothing is loaded and no analytics cookie is set until you say yes. We ask once, on the first public page you land on, and declining is one click in the same place as accepting — there is no second screen and no pre-ticked box.
You can change your mind here, at any time, in either direction:
Checking what you chose…
Your choice is kept in this browser’s local storage, not in a cookie and not on our server — so it applies to this browser, and clearing your site data will make us ask again. Switching it off stops the page sending anything from that moment; it does not delete what Google already received, which you can ask us about at support@everylittle.app.
Withdrawing is not retroactive — it stops anything further from this browser immediately, and what Google already received is a separate question you can put to us at support@everylittle.app.
Sign in with Google and with Apple
If you use either, that provider hands your browser a signed token, your browser passes it to us, and we verify it. We learn the email address and name the provider releases to us. If you use Apple’s private relay, we get the relay address and never your real one. We do not post anything, read anything, or ask either provider for anything else.
Server logs
Our web server writes a line per request — address, path, referrer, user agent — to a log that rotates. We read it to count visits, and the tool that does so prints only totals; no address is stored or exported anywhere.
Keeping it, and deleting it
We keep what you log for as long as your account exists, because that is what a record is for.
You can delete your account from settings, without writing to anyone and without being asked why. It removes the account and what belongs to it.
One honest caveat about backups. The database has point-in-time recovery over a 35-day window. A deleted account is gone from the live database immediately, and ages out of that recovery window over the following 35 days. We would rather say that plainly than imply an erasure that is instant everywhere.
Security
The connection is HTTPS and nothing else is accepted. Passwords are stored as PBKDF2 hashes. Session tokens are stored only as a hash of themselves. The database is encrypted at rest and is not reachable from the public internet. Which third-party scripts may run at all is restricted by a policy the browser enforces, and it names each one.
No system is perfect, and a policy claiming otherwise would be the least trustworthy sentence on this page.
Children
The Service is for adults and is not directed at children under 13. We do not knowingly collect anything from them. If you believe a child has created an account, write to support@everylittle.app and we will remove it.
Your choices
- See and export what you have. The export is yours — CSV or JSON.
- Correct it. Everything you logged is editable after the fact.
- Delete it. From settings, at any time.
- Stop the one scheduled email. The weekly reminder can be switched off in one click from the message itself, with no sign-in, or from settings.
- Turn the numbers off without losing the record — quiet mode hides every comparison and keeps every explanation.
Your legal rights
Because the operator is established in Cyprus, the EU General Data Protection Regulation applies to everything described here, wherever you live. You have the right to:
- Access the personal data held about you, and get a copy of it.
- Correct anything inaccurate.
- Erase it. Account deletion in settings does this yourself, immediately, with the backup caveat described above.
- Take it with you in a machine-readable format — that is what the CSV and JSON export is.
- Restrict or object to particular processing, including the analytics described above.
- Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not undo what was done beforehand.
Write to support@everylittle.app for any of these. You also have the right to complain to a supervisory authority — for Cyprus that is the Office of the Commissioner for Personal Data Protection, and if you live elsewhere in the EU or EEA you may complain to your own country’s authority instead.
If you are in California or another US state with its own privacy law, those rights sit alongside these. We do not sell personal information and we do not share it for cross-context behavioral advertising, which is why there is no “do not sell” link — there is nothing for it to switch off.
Why we are allowed to hold it
GDPR asks for a stated legal basis for each purpose. Ours are:
- Performing our contract with you — your account, the record you keep, your couple’s settings, your subscription. Without this data there is no Service to provide.
- Legitimate interests — keeping the Service secure and working, rate-limiting abuse, and reading server logs to count visits.
- Consent — the analytics described above, and the optional feature that sends your own words to be filed into the catalog. Both are things you can decline without losing the product.
- Legal obligation — keeping what tax and accounting law requires us to keep about a payment.
Where your data goes geographically
The database and the application are hosted in Amazon Web Services. Mail is sent through Amazon SES and received through Migadu. Payments are processed by Polar. Analytics data goes to Google, and the words you explicitly ask us to file go to OpenAI.
Several of those involve a transfer outside the EEA, principally to the United States. Where that happens we rely on the European Commission’s standard contractual clauses, or on an adequacy decision where one covers the recipient. You can ask us which applies to a particular provider.
How long we keep it
- Your account and what you logged: until you delete it. There is no automatic expiry — a record whose point is to be looked back on should not quietly erase your first year.
- After deletion: gone from the live database immediately, and out of the 35-day backup window over the following 35 days.
- Invitations: expire after 14 days, including the address typed for a partner who never signed up.
- Feedback: kept while it is useful to act on.
- Payment records: as long as tax law requires, which is longer than your account may last.
- Server logs: rotate, and are not archived.
Changes
When something factual here changes, the date at the top changes with it. If a change is material — a new company seeing your data, or a new kind of data leaving the machine — we will say so in the app rather than quietly editing this page.
Something here wrong, unclear, or missing? Tell us. You do not need an account.