Privacy policy

This policy explains what personal data Eversince collects when you use our website, web app, desktop app, iPhone app, API, MCP server and command line tool (together, the “Service”), why we collect it, who receives it, how long we keep it and what choices you have.

Eversince is a media workspace for images, video and audio. People work in it directly and through agents they connect, such as ChatGPT, Claude, Muse, Grok Bot, Cursor, Codex and Claude Code.

1. Who we are

Eversince operates from Menakhem Begin Rd 121, Tel Aviv-Yafo, Israel. We are the controller of the personal data described in this policy, except where section 4 says we process data on your behalf.

For any privacy question or request, email support@eversince.ai.

EU representative (GDPR Article 27): Emi Tsoref, Estrada Colegio, Quinta Lys, Caixa Postal 450-R, 8600-073 Bensafrim, Lagos, Portugal. Email: hello@eversince.ai

2. What we collect

2.1 Your account

• Email address and password. Passwords are stored only as a hash by our sign in provider.
• Name and profile picture. If you sign in with Google, we receive your name, email address and profile picture and keep a copy of the picture. If you sign in with Microsoft, we receive your name and email address. If you sign in with Apple, we receive your name and email address, or the relay address Apple gives you if you choose to hide yours.
• Settings and preferences: time zone (read from your browser), theme, default models, and your answers during setup: your name, the kinds of work you do and what you tell us about it. The agent you say you use is sent to our analytics and not stored with your account.
• The date you were last active, used for the unused account notices in section 11.

2.2 Your workspace content

• Files you upload, import, record or generate, and the timelines, canvases, documents, boards, brand kits, skills, folders, labels and comments in your workspaces.
• What we derive from your files to make them usable and searchable: titles, descriptions, tags, transcripts, text read from images and video, audio analysis, file fingerprints, and search data computed from images, video and text.
• Files are kept as uploaded, including any metadata inside them, such as the location stored in a photo.

2.3 Generations and prompts

When you or your agent generate media, we keep the prompt, the model, the settings, any reference media, the result, the credits used and, if it failed, the error and whether it was refunded. Research queries (for example brand names or keywords searched in public ad libraries) and the posts you keep from them are stored in your workspace.

2.4 Agent connections and the activity log

• Connections: which agents and apps you connected, when, and to which workspace. API keys are stored only as a hash and a short prefix.
• Activity log: for every action taken in a workspace, by you in the app or by an agent, we record the tool used, a one line summary of what happened (for example file names or counts), the one line reason the agent gave, whether it succeeded, how long it took and the credits it cost. We do not store the full inputs or outputs of the call, your IP address or your user agent. Members of the workspace see the actions that post to the feed.
• Feedback you or your agent send us through the Service.

2.5 The desktop app

What stays on your computer:

• Your files in the Eversince folder and any file you choose or drop into the app. To find a file that has moved, the app looks in the folders your files were imported from.
• A local index of those files, working copies and previews.
• Face detection, person cut outs and subject tracking, which run on your computer.
• AI models the app downloads from our storage to work on your files.
• Your sign in session, stored in a file encrypted with your operating system's key, and crash dumps.

What reaches our servers:

• For every file in your library, even one kept only on your computer: its name, size, duration and shape, a small preview image, fingerprints (hashes) of its content, your computer's name and the file's full path on your computer.
• What the app works out from your files, even ones kept only on your computer: transcripts, text read from images and video, text of documents, audio analysis, voice prints of speakers (see section 5) and search data.
• The files themselves, when cloud sync is on. Cloud sync is on by default. A workspace owner can turn it off for a workspace in Settings, and you can take any single file off the cloud with Remove cloud copy. Recordings from your camera, microphone or screen are ordinary files and follow the same rule.
• The positions of faces and subjects in video, linked to each speaker. No face templates or identities are sent.
• Update checks to our update server, which see your IP address and app version.
• Crash reports, if the Send crash reports switch is on. The app replaces your home folder in file paths so your computer account name is not sent.

When you connect Claude Code or Codex from the desktop app, the app adds Eversince to that tool's settings file on your computer, after keeping a backup of it. The desktop app also accepts connections from agents on the same computer only.

2.6 The iPhone app

The iPhone app shows the same workspace as the web app. What it keeps on your phone: your sign in session, in the app's own storage, and copies of the photos and videos you share into it until they have uploaded. The app reads a photo or video only when you pick it or share it; it does not read your photo library. If you allow notifications, Apple gives the app a device token that we store with your account so we can send a notice when a render or generation finishes, your agent posts to the feed, or someone mentions you. Signing out of the app, or turning notifications off, removes the device token; an unused token is deleted after 90 days. At launch the app asks our server whether a newer version of its pages is available, sending the platform, its version and build number, and downloads it from our storage; nothing about the request is kept. The app sends no product analytics. Crash reports follow the Send crash reports switch, as on the web.

2.7 Usage, billing and technical data

• Billing: your plan, subscription status and dates, credit and cloud processing balances, a record of every charge and refund, and storage used. Invoices are fetched from our payment provider when you open them.
• How many requests your connected agents make, counted against your plan's allowance for the day and the month, and a record of the days you reached a limit.
• Product analytics in the app: a small set of events, such as sign up, template opened and checkout started, with the kind of device (phone, computer or desktop app) and the desktop app's version, linked to your account id, not your email address.
• How you first found us, saved with your account when you sign up: the campaign tags in the link you followed, the site that sent you and the first page you opened.
• Error reports from our servers and apps, with no account id attached. Query strings are removed from web addresses in error reports.
• Server logs kept by our hosting provider, which include IP addresses, browser type and the pages or endpoints requested.

2.8 People who visit public pages

When someone opens a page you publish with a public link, we record a view against a random session id. If they download a file, we record which one. If the page asks visitors for their name and email, or they leave a comment, we store the name and email they give. We use visitors' IP addresses only to limit request rates and do not store them in our database.

2.9 Support and contact

• Support chat runs on Intercom and loads only after you open Support in the app. Once opened on a device, it loads each time the app starts on that device. Intercom then receives your account id, name, email address, account creation date and your conversations.

2.10 Invitations

When you invite someone to a workspace or a Business account, we store the email address you enter and send them an invitation.

3. Why we use it

If you are in the European Economic Area, the United Kingdom or Switzerland, the table also gives the lawful basis for each use.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Your content and other people in it

Your files may contain other people: faces, voices, names and words. For personal data about other people inside your workspace content, and for the names and emails visitors give on your public pages, you decide what is collected and why, and we process it on your behalf. You are responsible for having a lawful basis for it, including any consent the law requires.

5. Voices, faces and real people

5.1 Speaker recognition

To tell speakers apart in a recording, a model we run on our servers or on your computer computes a voice print for each speaker: a list of numbers describing the voice. Voice prints are stored with the recording and are never sent to an AI provider. When you or your agent name a speaker, the workspace keeps that voice print under the name so the same person is recognised in later recordings in that workspace.

You can make the workspace forget a named voice at any time. Deleting a recording deletes the voice prints stored with it; a named voice stays in the workspace until it is forgotten. Deleting a workspace or your account deletes all of them. In some places voice prints count as biometric data. Under our Terms, the account holder is responsible for having the person's permission where the law requires it before a voice is named.

5.2 Voice cloning

When a voiceover is translated in the original speaker's voice, up to 120 seconds of that speaker's audio is sent to ElevenLabs to create a cloned voice. Cloning does not run until someone confirms that the speaker agreed. We keep a record of that confirmation: who confirmed, the exact statement shown, whether it was confirmed in the app or relayed by an agent, and which recording it covers. Cloned voices are deleted from ElevenLabs when the workspace or your account is deleted, and you can ask us to delete one sooner.

5.3 Verified people on BytePlus models

To generate media with a real person's likeness on BytePlus models, that person verifies with a live face scan on a page run by BytePlus. The scan goes directly from their browser to BytePlus; we receive only a reference and the result. After verification, the photos and videos of that person you add are uploaded to BytePlus for reuse in generation. The person and their photos and videos are deleted from BytePlus when the workspace or your account is deleted. To delete one verified person sooner, email support@eversince.ai.

5.4 People in video

Some tools find people in video to cut them out, follow them when reframing, or see who is speaking. These tools produce outlines and positions, not identities.

6. AI providers and training

When you or your agent use an AI feature, the prompt and any media it needs are sent to the provider that runs the chosen model (listed in section 8). Each provider processes it under its own API terms and privacy policy.

We do not train or fine tune AI models on your content, prompts or results. The models we run ourselves, for search, speaker recognition and cut outs, are used as they are and are not trained on your data.

7. Your connected agents

When you connect an agent, such as ChatGPT, Claude, Muse, Grok Bot, Cursor, Codex or Claude Code, it can read and change everything in the workspace you chose, including other members' content, spend that workspace's credits, publish public pages and delete files. What the agent reads is then handled by its own provider under that provider's terms. The agents you connect are your choice and are not our service providers. You can see and disconnect them in Settings at any time.

8. Who receives your data

We share personal data with the service providers below, only to run the Service. We do not sell personal data.

8.1 Infrastructure and operations

8.2 AI and media providers

When a design uses a Google font, your browser loads it directly from Google Fonts, which sees your IP address. Videos or other content embedded in a public page (such as YouTube, Vimeo, Loom, Figma or Spotify) are loaded from those services.

8.3 Other disclosures

• Webhooks you set up: we send event data to the addresses you configure.
• Legal reasons: to comply with the law or a valid legal request, to enforce our Terms of Use, or to protect the rights and safety of our users, the public or Eversince.
• Business transfers: to a successor in a merger, acquisition or sale of assets, under this policy.

9. Sharing and public links

• Everyone in a workspace can see its content and its activity feed.
• Anyone with a public link can view the page it opens, unless you add a passcode or an expiry. Public pages ask search engines not to list them. A link can be passed on by the people you share it with.
• Files are served from private links that cannot be guessed. Anyone you give a file's link to can open it.
• In a Business account, the Admin sees each Member's email address, invitation status and what the Pool has given them. A Seat does not give the Admin access to a Member's own workspaces.

10. Cookies and browser storage

10.1 Website

• The affiliate referral cookie (Lemon Squeezy, ls_aff_ref) is set only after you choose Accept in the cookie banner. Choosing Reject, or browsing with Global Privacy Control turned on, keeps it off. You can change your choice at any time with the button at the end of this section. When you sign in with the cookie set, the referral is kept with your account so the person who referred you is credited for a purchase made in the next 60 days, on any device. Choosing Reject afterwards removes the cookie, not a referral already kept.
• Cloudflare Web Analytics counts visits to our website pages in aggregate. It sets no cookies and does not track you across sites, so it runs without asking for consent.
• Your cookie choice and theme are kept in your browser.
• After you choose Accept, how you first found us (campaign tags, the site that sent you and the first page) is kept in your browser until you sign up.

10.2 App

• Your sign in session is kept in browser storage on the web, in a file encrypted with your operating system's key in the desktop app, and in the app's own storage in the iPhone app. It is not a cookie.
• The app keeps a local copy of your workspace records, unsaved drafts and upload progress so it works quickly and offline. Signing out clears them. Display preferences stay.
• App analytics (PostHog) start when you sign in on the web and in the desktop app, apart from one event the first time the desktop app opens, and use browser storage and a cookie. The iPhone app sends none. Turn them off with Share usage data in Settings, Privacy; this switch, like Send crash reports, applies to the device you set it on. Global Privacy Control and a Reject on the website also turn analytics off.

10.3 Public pages

Public pages set only these cookies: a random session id the passes below are tied to (30 days), a pass after a correct passcode (7 days), a pass after a visitor gives their name and email where the page asks for it (30 days), and, after a visitor comments, their name and email in encrypted form so they are not asked again (90 days). Public pages load no analytics or advertising scripts.

We do not respond to Do Not Track signals. We do honour Global Privacy Control as described above.

Change cookie preferences

11. How long we keep data

Deleting your account removes it immediately, with every workspace you own and everything in them. Work you did in a workspace someone else owns stays with that workspace. We keep a one way hash of your normalised email address, with your account id removed, so the free starter minutes are given only once per address. We keep billing records as the law requires. An Admin must end their Business subscription before deleting their account.

Unused free accounts. This applies only to an account that has never had a subscription, has no Pro plan, extra storage or Seat, holds no AI credits or cloud processing, and owns a workspace with files on our servers in which no other member has been active in the last 180 days. After 150 days without activity we email a notice, and a last notice at 173 days. After 180 days the account's files on our servers are marked for removal, and after 210 days they are deleted. Copies on your computer are kept, and the account itself is not deleted. Any activity, such as signing in, resets the count.

Deleted data may remain in our providers' backups for a limited period until those backups are overwritten.

12. Security

Data is encrypted in transit. Access to data is limited by account and workspace, API keys are stored only as hashes, and the desktop app keeps your session in a file encrypted with your operating system's key. No method of transmission or storage is completely secure. If you think your account has been compromised, email support@eversince.ai. If a breach affects your personal data, we will notify you and the authorities as the law requires.

13. International transfers

We operate from Israel, and our providers process data in the European Union, the United States and Asia. Where required, transfers rely on an adequacy decision or on the standard contractual clauses in our providers' terms.

14. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict how we use it, to withdraw consent, and to complain to your data protection authority. We honour these requests wherever you live, subject to the limits the law allows.

• In the Service: edit your profile, download your files, turn off usage data and crash reports on each device, disconnect agents, turn off cloud sync, forget a named voice, and delete your account, all in Settings or your workspace.
• By email: send any other request to support@eversince.ai. We may need to confirm your identity, and we reply within the time the law sets.

California and other US states. We do not sell personal data and do not share it for cross context behavioural advertising. We honour Global Privacy Control as an opt out. You may use an authorised agent to make a request, and we will not treat you differently for exercising your rights. The categories we collect are those in section 2: identifiers, account and billing records, internet activity, audio and visual content, and voice prints.

15. Emails

We send service emails only: account confirmation and password reset, a welcome email once after setup, invitations, notices when someone mentions you in a comment or comments on a page you published, and notices about unused files. You can turn off mention emails in Settings, Notifications, or with the unsubscribe link in any mention email. We do not run a marketing email list.

16. Children

The Service is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email support@eversince.ai and we will delete it.

17. Business customers

If you need a data processing agreement for personal data you process in the Service, email support@eversince.ai.

18. Changes to this policy

We will update the date at the top when this policy changes, and tell you by email or in the Service before a material change takes effect.

19. Contact

Questions and requests about this policy or your data: support@eversince.ai.