Privacy Policy

We collect the information you give us directly and a small amount we collect automatically when you use EvadeGPT (the "Services").

Things you give us

• Account info. Email, password (stored only as a salted hash), and optional profile details like a display name or avatar.
• Payment info. Billing is handled by Stripe, we never see or store full card numbers. We keep the Stripe customer ID, plan tier, and invoice history.
• Content you submit. The text, prompts, and uploads you put into our tools. We process these to deliver the feature you asked for.
• Messages to us. Anything you email, post in our feedback channels, or submit through the contact form.

Things we collect automatically

• Device + network signals. IP, browser version, OS, and approximate region. Used to serve the app, protect against abuse, and keep sessions alive.
• Usage telemetry. Which features you use, how long requests take, and whether they succeed. We don't read your content to do this.
• Cookies. Essential (login, sessions), analytics (Vercel), and a marketing pixel (Meta) for ad measurement. You can opt out of non-essential cookies in your browser.

• Run the Services. Process your text, return results, bill correctly, and prevent runaway usage.
• Keep accounts safe. Authenticate sessions, detect abuse, and block automated attacks.
• Talk to you. Transactional email (password resets, billing receipts, critical security notices). Marketing email only if you opt in.
• Improve the product. Aggregate usage patterns help us know what to build next. We don't train foundation models on your content, see AI training, the honest answer.
• Meet legal obligations. Tax, fraud, subpoena response, and enforcement of our Terms of Service.

We share the minimum needed to run EvadeGPT, and nothing else.

• Infrastructure: Supabase (database + auth), Vercel (hosting), Stripe (billing).
• AI inference providers: OpenRouter, DeepSeek, Gemini, xAI, and similar upstreams receive only the text you submit for processing, under the terms of their data-processing agreements.
• Analytics: Vercel Analytics (anonymous) and Meta (conversion pixel).
• Legal: If compelled by valid legal process, or to protect against fraud/abuse.
• Business transfer: If EvadeGPT is acquired or merges, data moves with the business; we'll notify you if the handling changes.

Your prompts and outputs are processed ephemerally by our AI provider of choice and returned to you. They are not added to any training corpus. Our upstream providers (OpenRouter routing, DeepSeek direct, Gemini, xAI, etc.) operate under data-processing agreements that prohibit training on API traffic unless you explicitly opt in, which we do not.

We keep short-lived request logs for debugging and abuse detection. These are purged automatically.

• Encryption in transit (TLS 1.2+) on every request.
• Encryption at rest for the primary database.
• Passwords stored only as salted bcrypt hashes, we can never "look them up".
• Row-level security (RLS) on every user-scoped table so one account can't see another's data even via a bug.
• Production access limited to on-call engineers for incident response.

No service is 100% secure. If we ever detect a breach that affects you, we'll notify affected users within 72 hours of confirmation.

• Account records: kept for the lifetime of your account.
• Submitted content (humanizer input, chat messages, etc.): stored alongside your account so you can re-open past sessions, removed when you delete the session or the account.
• Billing + invoices: retained for 7 years to comply with tax law, even after account deletion.
• Short-lived logs: purged within 30 days.

• Access: request a copy of the personal info we hold about you.
• Correction: ask us to fix anything inaccurate.
• Deletion: delete your account in settings, or email us and we'll do it for you.
• Portability: export your sessions, essays, and flashcards from inside the app, or request a complete dump from support.
• Opt-out: unsubscribe from marketing email via the footer link in any message.

Email us at contactevadegpt@gmail.com to exercise any of these rights. We verify identity before acting and respond within 30 days.

EvadeGPT is not directed at children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we'll delete it. If you believe a minor has signed up, contact contactevadegpt@gmail.com and we'll act quickly.

By using EvadeGPT you consent to your data being transferred to and processed in countries where we and our vendors operate. We use Standard Contractual Clauses with EU/UK vendors and comparable safeguards elsewhere.

The "Updated" badge at the top of this page reflects the most recent revision. For material changes (new categories of data, new sharing, narrower retention), we'll tell you in the app or by email at least 14 days before the change takes effect.

Questions about this policy, or want to exercise a right? Email contactevadegpt@gmail.com or use the contact form. We read every message.