Privacy Policy

For the Evalumate iOS app. Last updated 21 October 2026.

Evalumate is a place to review things you have bought and see what people you know thought of them. This policy describes what the app collects, why, and who else sees it. The Evalumate Chrome extension has its own policy.

What we collect

Your account

Email address and password, or your Sign in with Apple or Google account, handled by Firebase Authentication (Google). We never see or store your password.
Your profile — username, name, bio, website and profile picture, all of which you provide.
Your date of birth, used only to confirm you are old enough to use Evalumate. It is stored privately and never shown to anyone.
Whether your account is private, and the date you accepted these terms.

Your phone number — optional, and never stored in the clear

You can add a phone number when you set up your profile, or later in Settings. It is optional. On your device it is converted into a SHA-256 hash before it leaves the phone, and we store only that hash, so people who have your number in their contacts can find you. We never store your phone number itself. You can remove it at any time in Settings.

Your contacts — matched, never stored

If you grant contacts access, the numbers in your address book are normalised and hashed on your device, and only the hashes are used to look for matches. Your contacts are never uploaded and never stored. Each match is shown with the name you saved for that number, and that name stays on your phone. The permission is optional and the app works without it.

What you post

Photos and videos, captions, ratings, and the brand, product, store and categories you attach to a post.
Likes, comments, likes on comments, saved posts, who you follow, and who you have blocked.
Posts you send to other people in the app, which are visible to the recipient for one year and then deleted.

Which posts you open

When you open a post full screen, we record that your account viewed that post. Scrolling past a post in a feed is not recorded. We use this to count how many different people have seen a post.

Nobody using the app can see this, including the person who wrote the post. There is no “who viewed this” feature, and the app’s security rules refuse every request for these records.

Links you open and share

When you tap a post’s link to the shop, we record that your account opened it, the link as it was at that moment, and how many times you have opened it. When you share a post’s link outside the app and the share completes, we record that you shared it and the kind of app it went to (for example, Messages). We use these to count how many different people opened or shared a post’s link.

As with views, nobody using the app can see these records, including the person who wrote the post.

Technical data

Push notification tokens, so we can notify you. Stored privately to your account.
Crash reports via Firebase Crashlytics, which include device model, OS version and the state of the app when it crashed.
Content reports you submit, which are emailed to us so a person can act on them.

What we do not do

We do not sell your personal information.
We do not show advertising and do not use advertising identifiers.
We do not track you across other companies’ apps or websites.
We do not store your contacts or your phone number in readable form.

If this ever changes, we will update this policy and tell you in the app before it takes effect. Where the law requires your consent, we will ask for it first rather than rely on this page having changed.

Who else can see your data

We use Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Messaging, Crashlytics, App Check) to run the app. They process this data on our behalf. We use Apple’s App Attest to check that requests come from a genuine copy of the app.

Other people using Evalumate see what you choose to share: your profile, your posts, and your activity on other people’s posts. If your account is private, your posts are visible only to people you have approved.

Your rights

Delete your account from Settings. This removes your profile, posts, media, follows, likes, comments, view records and records of links you opened or shared.
Correct your information by editing your profile.
Make your account private at any time, which applies to your existing posts as well as new ones.
Turn off notifications by category in Settings.
Request a copy of your data, or ask a question about any of this, at the address below.

If you are in the UK or EU, you have rights under the UK GDPR / GDPR including access, rectification, erasure, restriction and objection. If you are in California, you have rights under the CCPA/CPRA including the right to know and the right to delete. We do not sell or share personal information as those terms are defined by the CCPA.

Children

Evalumate is not intended for anyone under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.

How long we keep things

Your account data is kept until you delete your account. Posts you send to someone in the app are deleted automatically after one year. Crash reports are retained by Firebase Crashlytics on its standard schedule.

Contact

Questions, requests, or anything about this policy: info@evalumate.net.