1. Who operates Eva Store
Eva Store is operated by the Eva Store Team, represented by its Chief Executive Officer, Eng. Al-Khansaa Ali Mohammed. The registered legal entity, address, and data-protection contact are [OWNER/LEGAL APPROVAL REQUIRED].
This policy explains which data the app and backend actually handle, why, who can see it, and the choices you have. It covers the Eva Store app, its backend API, and this static legal website. It does not cover third-party pages you open from the app, such as a payment provider's checkout page or Google/Apple sign-in.
This web edition is policy version 1.0, last updated 10 November 2026. Its effective date is pending owner approval.
2. Data we collect
We collect the following categories. "Optional" means the app does not require the field to create an account, but a feature may need it.
Account and sign-in
- Email address, account identifier, authentication events, session information, and sign-in method.
- If you use Google or Apple sign-in, the provider returns an identity token and may return your name, email address, and profile image. The app sends the token to Supabase Auth; the backend receives the resulting access token. Passwords are handled by Supabase Auth and are not stored in readable form by Eva Store.
Profile
- Name, optional phone number, profile type (student or client), specialization, country, biography, profile image, display currency, language, and theme.
- Student profile fields: university, student number, study year, and additional links. Client profile fields: organisation and interests.
- Profile visibility is limited to the projection the backend grants; other users do not get a public profile directory. Staff with the relevant permissions can read wider projections.
Content and communications
- Messages in support, service-request, group, and stream conversations; replies, reactions, read state, typing and presence indicators; message edits and delete tombstones.
- Images, video, audio, voice messages, documents, and other attachments you upload. Attachments are stored as resources with their declared and detected type, size, checksum, and scan result.
- Group content, reviews, and provider responses.
Service activity and commerce
- Service requests, intake answers, quotes and decisions, assignments, deliveries, revisions, disputes, and reviews.
- Orders, order items, payment status, refunds, vouchers, reward points, subscriptions, and related finance records. Card numbers are entered on the payment provider's page and are not collected by the app.
Notifications and device data
- Notification preferences, quiet hours, in-app notifications, and push-device registrations.
- The push token is stored in its original form because it is needed to deliver a push, and as a SHA-256 hash for lookup. It is never returned to clients or written to events or logs.
Security, operations, and advertising
- Audit entries for sensitive actions, including IP address, user agent, request identifier, timestamp, and result. Audit logs are append-only.
- Technical metadata used for security, rate limiting, diagnostics, and abuse prevention.
- Feature usage such as course progress, assessment answers, and advertising impressions or clicks. The app does not include a third-party analytics or crash-reporting SDK.
3. Data we do not collect
We do not request precise or approximate location, contacts, call logs, or camera access. The microphone permission is requested only when you choose to record a voice message. The app includes no third-party advertising or analytics SDK; server-side OpenTelemetry tracing and metrics may be used for reliability and security when configured.
We do not claim end-to-end encryption. Messages are encrypted in transit and stored on the server, where authorised staff and processes can access them as described in this policy. We do not claim anonymity or "zero logging".
4. Why we use data
- To create and secure your account, authenticate you, and maintain your sessions.
- To display your profile and let authorised users interact with you in the workspaces the backend grants you.
- To deliver messages, service requests, notifications, attachments, and purchases you send or receive.
- To protect the service: authorization checks, workspace isolation, rate limiting, malware scanning, fraud prevention, and audit records.
- To provide support, resolve disputes, and comply with legal obligations.
- To operate features you use, such as groups, reviews, learning progress, rewards, and advertising measurement.
Where the law requires a legal basis, the bases are contract performance, legitimate interests in securing and operating the service, consent where required, and legal obligation. The formal legal-basis mapping is [OWNER/LEGAL APPROVAL REQUIRED].
6. Service providers and processors
| Provider or component | What it receives | Why |
|---|---|---|
| Supabase Auth and Storage | Sign-in credentials and tokens; uploaded files and signed-URL metadata | Authentication and private file storage. The deployment may be self-hosted or hosted; [OWNER/LEGAL APPROVAL REQUIRED]. |
| PostgreSQL and Redis (Eva Store backend) | Application records; cache, rate-limit, presence, and pub/sub data | Source of truth and operational acceleration. Redis is not a source of truth. |
| Firebase Cloud Messaging (Google) | Device push token and notification content | Push delivery to registered devices. |
| Google Sign-In / Sign in with Apple | Identity token and the profile data you authorise | Authentication, if you choose that method. |
| LiveKit | Real-time audio/video and connection metadata for sessions you join | Live audio/video features, where enabled. |
| Email and SMS providers | Email address or phone number and the message | Transactional notifications, when those channels are configured. |
| Payment provider | Payment data you enter on its checkout page; order reference | Payment processing for available FIAT purchases. The provider is [OWNER/LEGAL APPROVAL REQUIRED]. |
| Malware scanner | Uploaded file bytes for scanning, or only the SHA-256 hash if a hash-only provider is configured | Detect malware before a file becomes available. The production scanner is [OWNER/LEGAL APPROVAL REQUIRED]. |
| Response-translation provider | Authorised human-readable response text only | Translation, when the feature is enabled; it does not receive database records, identifiers, or secrets. |
Processors may store data outside your country. The hosting locations and transfer safeguards are [OWNER/LEGAL APPROVAL REQUIRED]. They are used only for the purposes above.
7. Security
- Traffic between the app and the backend uses encrypted transport (TLS). The production edge is configured for TLS 1.2 and 1.3.
- Every backend operation authorizes the caller before reading or changing data. Workspace boundaries and permissions are enforced server-side; access denies by default.
- Passwords are handled by Supabase Auth. The app keeps only the refresh token on the device, in the platform keystore/keychain, and disables Android backup of app data. API calls use bearer access tokens, not cookies.
- Uploaded files are validated and scanned. A file becomes available to authorised users only after a successful scan; rejected files are removed from storage.
- Push tokens are stored as described in section 2 and are never returned or logged. Sensitive audit records are append-only and cannot be changed or deleted through the application role.
- The database runtime role has DML rights, not schema-owner rights. Redis holds only rebuildable data.
No overclaiming. We do not claim end-to-end encryption, anonymity, or zero logging. Authorised staff and processors can access data as described in this policy, and security records are kept.
8. Retention
Retention depends on the category. The main periods and known limits are summarised here; the detailed table is on Data retention.
- Account and profile data are kept while the account exists. After a deletion request, the account enters the deletion lifecycle and is anonymised unless a hold applies.
- Messages, service requests, reviews, and audit records are kept for the other participants and for service, dispute, financial, and security integrity. After deletion they are linked to an internal identifier with your name removed, as far as the workflow allows.
- Notifications are purged after about 180 days. Operational event records (outbox, integrations, extensions, MCP) are purged after about 30 days. Raw advertising events are rolled up after 3 complete UTC days and purged after 10 days.
- Push-device registrations are kept until you revoke the device, sign out everywhere, or delete the account. The current deletion workflow does not automatically remove them; see the deletion page.
- Audit logs, including IP address and user agent, are append-only and have no automatic retention period. A legal retention period is [OWNER/LEGAL APPROVAL REQUIRED].
- Backups, where the infrastructure provider keeps them, expire according to that provider's retention. The backup retention period is [OWNER/LEGAL APPROVAL REQUIRED].
These technical cleanup settings are not a complete legal retention schedule. The approved schedule, legal bases, and maximum periods are [OWNER/LEGAL APPROVAL REQUIRED].
9. Your rights and choices
You can view and correct your profile in the app, change notification preferences and quiet hours, hide your last-seen time, revoke registered devices, deactivate your account, or request deletion.
You can ask a privacy question or make a request through the in-app support conversation. Identity is verified before a sensitive request is executed. The app does not currently provide a self-service data export; an export must be requested through support, and the response process and time are [OWNER/LEGAL APPROVAL REQUIRED].
Withdrawing a notification preference does not stop security notices that the backend treats as mandatory (for example, account security alerts).
If you believe your data is handled unlawfully, you may complain to the supervisory authority that applies to you. The operator's lead supervisory authority is [OWNER/LEGAL APPROVAL REQUIRED].
10. Children
Eva Store is not directed to children. The app does not currently implement age verification or parental-consent collection. This is a known compliance gap under review before wider publication. The minimum age and the parental-consent process are [OWNER/LEGAL APPROVAL REQUIRED].
If you are a minor under the law that applies to you, use Eva Store only with the involvement of a parent or guardian.
11. International transfers
Eva Store and its processors may store or process data outside your country. Where required, transfers rely on an approved transfer mechanism. The hosting regions, processor locations, and transfer safeguards are [OWNER/LEGAL APPROVAL REQUIRED].
12. Changes and contact
We publish material changes with a new version and effective date. The current version is always available in the app and on this site. If a change requires renewed acceptance, the app asks for it; access to deletion and privacy information is not blocked.
The only published support channel is the in-app support conversation (Profile → Contact support). A public privacy contact for this website is [OWNER/LEGAL APPROVAL REQUIRED].