Privacy Policy

This Privacy Policy explains what Iris Tech(“we”) collects when you use Evertree, why, and the choices you have. A family archive is personal by nature, so we keep data collection to what the Service needs to work.

1. What we collect

Information you provide

• Account details — your email and sign-in credentials. If you sign in with Google, we receive your name, email address, and profile photo from Google. We also store your language preference.
• Family archive content — the people, relationships, and dates in your tree, together with any biodata you choose to add (which can include details such as race, religion, occupation, and places of birth, death, and burial), written memories, birthday-wall posts and tributes, life stories recorded as audio or video, and the photos and videos in your albums, including captions and people tags.
• Messages to our AI Archivist — the conversation you have with the in-app assistant while building your tree.
• Guest contributions — a keeper can share a link that lets someone without an account record a story or add a tribute; we collect the recording or text and the name they provide.
• Support messages — anything you send us directly.

Information collected automatically

• Basic usage and device data — log data needed to operate, secure, and troubleshoot the Service, plus privacy-friendly, cookieless analytics that do not track you across sites.
• Approximate location at archive creation — the country, region, and city inferred from your network address when you create an archive, stored so the Archivist can be culturally aware (for example, naming customs). This is coarse, best-effort location, not precise tracking.
• Photo metadata — when you upload a photo, we read the metadata embedded in the file (such as the date taken and GPS coordinates, if present) to suggest when and where it was taken.
• Transcripts — when a story or tribute is recorded as audio or video, we automatically generate a text transcript of it.
• Essential cookies — see the Cookies section below.

We do not collect or store full payment card numbers — payments are handled by Stripe (see below).

2. How we use your data

• to provide, maintain, and secure your family archive;
• to power features you use, including AI-suggested questions and story tools;
• to process purchases and prevent fraud and abuse;
• to respond to you and provide support;
• to comply with legal obligations.

We do not sell your personal data, and we do not use your family content to build advertising profiles.

Where laws such as the EU/UK GDPR apply, we rely on: the performance of our contract with you (running your archive); our legitimate interests (securing and improving the Service and preventing abuse); consent, for sensitive information and anything else we ask you about separately; and compliance with legal obligations.

3. Sensitive data, and people who don’t use Evertree

A family archive naturally contains personal data about relatives — including people who never use Evertree themselves — and some of it can be sensitive (for example race, religion, or health details mentioned in biodata, stories, or tributes). When you add such information about a living person, you are responsible for having their permission — and their explicit consent where the law where they live requires it, including Malaysia’s Personal Data Protection Act.

If you appear in an archive and want your information corrected or removed, you can ask the archive’s keeper, or contact us at dev@iristech.my and we will address the request as applicable law requires. Data-protection laws generally apply to living individuals only; we nonetheless treat In Memory content about the deceased with the same care as the rest of an archive.

4. Service providers we share with

We use a small number of trusted providers to run Evertree. They only process data as needed to provide their service to us:

• Convex — our backend and database, where your archive is stored and processed.
• Vercel — web hosting and the privacy-friendly, cookieless analytics described above.
• Stripe — payment processing. Stripe receives the information needed to take payment; we receive confirmation and limited details (not your full card number).
• Google — sign-in, if you choose to sign in with your Google account.
• Bunny.net — storage and delivery of the photos, videos, and recordings in your archive.
• AI providers— Replicate runs the speech-to-text model that transcribes recorded stories and tributes, and DeepSeek powers the Archivist’s question suggestions and conversation. Content sent to an AI provider is used to generate that response, not to train public models on your family’s data.

Each provider has its own privacy terms. We choose providers that offer appropriate safeguards.

5. Cookies

We use essential cookies to keep you signed in and to keep the Service secure. These are required for the app to function. We do not use third-party advertising or cross-site tracking cookies.

6. Sharing within an archive

Content in a family archive is visible to the members of that archive according to their role (keeper or viewer) and any visibility settings on an album or story. Adding someone as a member lets them see the content shared with them — invite only people you trust with your family’s memories.

7. Data retention

We keep your archive for as long as your account is active. When you delete content or your archive, we remove it from the live Service; residual copies may persist in backups for a limited period before being overwritten.

8. Security

We use reasonable technical and organisational measures to protect your data. No method of transmission or storage is perfectly secure, but we work to protect your archive and to limit access to it. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.

9. Your rights

You can manage, correct, and delete much of your archive directly in the app; for anything else, contact us at dev@iristech.my and we will respond within the time required by applicable law.

• If you are in Malaysia, the Personal Data Protection Act gives you rights to access and correct your personal data, to withdraw consent, to prevent processing likely to cause distress, and to data portability. You may also complain to the Personal Data Protection Commissioner.
• If you are in the EEA or UK, the GDPR gives you rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. You may also complain to your local supervisory authority.
• Wherever you live, you may have similar rights under local law — we honour them on the same basis.

10. Children

Evertree is not directed to children under 16. A family archive may include information about children added by an adult keeper; if you believe a child’s information has been added improperly, contact us and we will address it.

11. International transfers

Our providers process data in the United States and other countries outside Malaysia and outside your own. Where the law requires it, we rely on appropriate safeguards for such transfers, such as contractual protections with our providers.

12. Changes to this policy

We may update this policy; we will change the date above and, for material changes, take reasonable steps to notify you.

13. Contact

For privacy questions or requests, email dev@iristech.my. See also our Terms of Service.