Evadí Privacy Policy
This policy covers the Evadí app and its test version, Evadí Dev. It is available in Spanish and English; if the two differ, the Spanish version prevails.
In 30 seconds
| What we keep | What we never keep |
|---|---|
| How many steps you took each day (the total, nothing more) | Your location: Evadí doesn’t use GPS |
| Your time zone, to know when your day ends | Your heart rate, your sleep or any other health data |
| How your game is going | The detail of your steps: what time or where you walked |
| An identifier for your phone, if you have notifications turned on | Anything for advertising: there are no ads and we don’t sell data |
| Server technical logs (they may include your IP address), for 30 days | Your contacts or the photos on your phone |
- Your email and password are kept by the sign-in service, separate from your game data. Your password is protected: nobody can read it, not even us.
- We only share data with the services that make the app work (sign-in, servers, notifications and email), and each one gets only what its part needs.
- To delete your account: Profile → Delete my account. We delete your data right away, and it can’t be undone.
- Questions: write to privacy@evadi.app.
The creature chasing you doesn’t know where you walk. Neither do we.
1. Who we are and how to reach us
Evadí is an app by Víctor Hugo Gregorio Valencia Florez, with a postal address at Avenida Perú 3014-B, San Martín de Porres, Lima 15106, Peru, who decides why and how your data is used (the “controller”).
For any question about this policy, or to exercise your rights, write to privacy@evadi.app. We answer access requests within 10 calendar days, and requests to correct, delete, object or withdraw consent within 5 business days.
2. What data do we keep?
Your account. You sign in with your email and a password, or with your Google account. That data is kept by our sign-in provider (Supabase), separate from your game data: the app’s database doesn’t keep your email, and your password is protected so that nobody can read it, not even us. If you sign in with Google, Supabase receives your name, email and profile photo from Google. Supabase also records the IP address and device type of each sign-in.
Identifiers. We give your account an internal identifier, and we keep the identifier the sign-in service gives us so we can recognize you.
Your time zone (for example, “America/Lima”), and any changes to it. We use it to know when your day starts and ends. It isn’t your location, but it does show the region you’re in.
Your steps. Only the total steps for each day, which we read from Health Connect (Android) or Apple Health (iPhone) with your permission. Each sync reads the totals for the last 7 days. When you start a game we also read the last 30 days, only to work out your usual pace: of those 30 days, only the average reaches our server. We also read your steps while the app is closed, so your game moves forward even if you don’t open it: on Android, from time to time during the day; on iPhone, only when the system allows it. With each total we keep where it came from (your phone) and when we received it. We never read individual records or any other health data, and we never write anything to Health Connect or Apple Health.
Your games. Which route you play, which creature you’re escaping, under which rules, and how each day ended (including the steps that counted that day).
Notifications. If you have notifications turned on, we keep an identifier for your phone so we can send them, and whether it’s Android or iPhone. Each game also keeps the list of notifications that belong to it (which notification and for which day), even if you don’t have notifications turned on.
Technical records. Our server notes some usage moments, such as “created the account” or “started a game”, with your internal identifier, the game and the date. They don’t include steps or location. It also logs each request it receives, which may include your IP address and device type. All of that stays in the server’s technical logs, which are deleted automatically after 30 days.
Only on your phone
The app keeps these on your phone, and not on our server: your session (encrypted by the system), your language, light or dark theme, your character, whether you’ve seen the introduction, whether we’ve already asked you about notifications, which game moments you’ve already seen, a copy of the route so the map works offline, and a log of recent syncs that includes the day’s steps. Your session is deleted when you sign out. The rest is deleted when you uninstall the app: for now, signing out or deleting your account doesn’t delete it.
What if you don’t give us some data?
An email or a Google account is required to have an account. Sharing your steps is optional, but without them your character doesn’t move and the creature does. Notifications are optional too: the app works the same without them.
3. What we never keep
- Your location. Evadí doesn’t use GPS. Your character moves along the map with the sum of your steps, not with your real movements. The notification service has location turned off, and we don’t use your IP address to work out where you are.
- Other health data. Health Connect and Apple Health hold much more; we only ask for permission to read steps.
- The detail of your steps: what time or where you walked.
- Your sex, your contacts or the photos on your phone. The character you pick stays on your phone. If you sign in with Google, the sign-in service receives your profile photo (see section 2).
- Anything for advertising. There are no ads in Evadí, and no advertising or tracking tools.
4. What do we use it for?
| Purpose | Data | Legal basis |
|---|---|---|
| Move your character and have the creature chase you | Time zone, games | It’s the service you asked for |
| Read and save your steps, use them to move your character and fit the game to your usual pace | Daily step total, and the steps that counted each day of the game | Your explicit consent, given in the app and in the system permission |
| Tell you, for example, how your day ended or if the creature is catching up (at most two a day, except the end-of-game one, and never at night in your time zone) | Phone identifier, language, and the game and day of each notification | Your consent, when you turn notifications on |
| Detect errors and cheating that affect games | Usage events, technical records | It’s necessary to provide the service |
| Count how many people complete each step of the app | Usage events | It’s part of providing the service, and we only look at totals, never person by person (in Brazil, on the basis of our legitimate interest) |
We treat your steps as health data, with the care that calls for: we only read them with your explicit permission, and you can withdraw it whenever you want (see section 8).
Automated decisions. The result of each day of your game (how far you moved and how close the creature got) is worked out automatically by the game from your steps. It only decides the result of the game: it has no legal effect and doesn’t affect you in any other significant way. If you think a calculation is wrong, write to us and a person will review it.
Limited use of your health data
The data we read from Health Connect and Apple Health:
- is used only for what you see in the app: moving your character, fitting the game to your usual pace and showing your progress;
- is never used for advertising, personalized or otherwise, or for marketing or commercial data mining;
- is never sold or transferred to advertisers, data brokers or information resellers;
- is never used to assess credit, insurance or employment, or for medical purposes;
- is only transferred to third parties with your explicit consent, for security (for example, to investigate abuse) or to comply with the law. The providers in section 5 store and process it on our behalf, only to run the app;
- is not looked at individually by anyone on the team, except with your consent, for security or to comply with the law; to run the service, we only look at aggregated, anonymous totals;
- is not stored in iCloud.
5. Who do we share it with?
Only with the services that make Evadí work, and each one gets only what its part needs.
| Service | Where | What for | What it receives | What it doesn’t receive |
|---|---|---|---|---|
| Supabase | Servers in São Paulo, Brazil (US company) | Sign-in and database | Your email, your protected password, the IP address and device type of each sign-in, and all the data in section 2 | — |
| Google Cloud (Cloud Run) | São Paulo, Brazil; technical logs may be stored in other countries (US company) | The app’s server | Your requests while they’re processed, and their technical logs | — |
| Cloudflare | Global network (US company) | The entry point to our domain, and forwarding the emails you send us | Your requests as they pass through, and your emails to privacy@evadi.app. We’ve turned off its request logs; it only keeps aggregate statistics | — |
| Gmail (Google) | United States and other countries | Receiving and answering your emails | Your email address, your messages and, if you ask for a copy of your data, that copy | — |
| OneSignal, and Google’s Firebase on Android | United States | Sending you notifications, if you have them turned on | Your internal identifier, your phone’s identifier, your language, your time zone, your IP address, technical data about your phone (model, operating system and app version), when you open the app and which notifications you tap, and the text of each notification with the game and day it refers to | Your steps and your location |
| — | If you sign in with Google | What Google already knows from your sign-in | Your steps |
Health Connect and Apple Health run on your phone: they aren’t third parties receiving your data from us.
We may also have to hand over data if a law or a competent authority requires it.
We don’t sell your data or share it for advertising.
6. Where is it stored?
Our servers are in São Paulo, Brazil. Some of the services in section 5 are US companies and may process data there, and the server’s technical logs may be stored outside Brazil. If you want to know which safeguards protect your data in each case, write to privacy@evadi.app.
7. How long do we keep it?
- While you have an account, we keep your sign-in account, your time zone, your games (with the steps that counted each day), your monthly step totals and the list of notifications for your games.
- Your phone’s identifier for notifications, until you sign out on that phone or delete your account.
- The daily steps that come from your phone, for one year. After that we turn them into a monthly total and delete that daily detail, except for days still used by a game in progress. The steps that counted on each day of a game stay with the game while you have an account.
- Server technical logs are deleted automatically after 30 days.
- If you delete your account, we immediately delete your account, your games, your steps and your record in the notification service. The only thing left is the server’s technical logs, which carry your internal identifier but not your email or your steps, until they’re deleted automatically after 30 days. We currently have no database backup service.
8. How to delete, correct or take your data
- Delete your account: in the app, Profile → Delete my account. We delete your data right away, including your record in the notification service, and it can’t be undone (what stays for a while is in section 7). If you no longer have the app, email privacy@evadi.app from your account’s email address and we’ll delete it.
- What stays on your phone: deleting your account doesn’t delete what the app saved on your phone (see “Only on your phone”) or remove the steps permission. To do that, uninstall the app or remove the permission as explained below.
- Take a copy: write to privacy@evadi.app and we’ll send you your data in a readable format.
- Correct something: write to us at privacy@evadi.app.
- Stop sharing your steps: remove Evadí’s permission in Health Connect (on Android 14 or later it’s inside your phone’s Settings; on earlier versions it’s a separate app) → App permissions → Evadí, or in Apple Health (Health → your profile picture → Apps → Evadí). From then on we stop reading. What we’ve already kept stays until you delete your account; if you want us to delete it sooner, write to us: since your games depend on those steps, we’ll delete them too.
- Stop getting notifications: turn them off in your phone’s settings.
None of these requests has a cost.
9. Notifications
They’re optional. We ask for permission before sending the first one, and you can turn them off whenever you want in your phone’s settings. They never include your steps or health data: they say things like “Day closed” or “It’s catching up!”.
10. Children
Evadí is for people 16 or older and isn’t aimed at minors. If we learn an account belongs to someone under 16, we delete it.
11. How we protect it
- Everything that travels between the app and our servers is encrypted.
- Seeing or changing your data requires your session, which we verify on every request.
- Your session is kept in the phone’s secure storage.
- We keep as little as possible: the safest data is the data we don’t have.
No system is invulnerable. If an incident could affect your data, we’ll let you and the relevant authorities know, within the time limits set by law.
12. Changes to this policy
If a change is significant, we’ll tell you in the app at least 15 days before it takes effect, and if it needs your consent, we’ll ask for it again. If it’s minor, we update the version and the date at the top. Previous versions stay published on this page.
13. Your rights where you live
Wherever you live, you can ask us for access to your data, to correct it, delete it, take a copy, object to a use and withdraw your consent, by writing to privacy@evadi.app.
- Peru (Law 29733). You can file a complaint with the National Authority for Personal Data Protection, part of the Ministry of Justice and Human Rights.
- Argentina (Law 25,326). You can access your data free of charge every six months, or sooner if you have a legitimate interest. The control authority’s required notice, in its original Spanish: “LA AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.” In English: the Agency for Access to Public Information, as the Control Body of Law No. 25,326, has the power to handle the complaints and claims filed by those whose rights are affected by non-compliance with the rules in force on personal data protection.
- Brazil (Law 13,709, LGPD). You can also ask us to confirm whether we process your data, to anonymize, block or delete data that is unnecessary or excessive, to tell you who we share it with, and what happens if you don’t give your consent. Our encarregado (the person in charge of data protection, art. 41) is Víctor Hugo Gregorio Valencia Florez, at privacy@evadi.app. You can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
- Venezuela. Your data is protected by article 28 of the Constitution (habeas data), which you can exercise before the courts.
Previous versions
- 1.0 — October 16, 2026: first version.