Privacy Policy
We collect as little as we can and tell you exactly what happens to it. This policy covers the Evibe apps (iPhone, iPad, Mac and Apple Watch), the web app at app.evibe.com, the Evibe community and this website.
Who we are
Evibe is operated by Wonderlink SL, a company incorporated in Spain, which is the controller of the personal data described on this page. Our registered details are on the Contact page.
For any privacy question, to exercise your rights or to reach us about the community, write to contact@evibe.com. This address is also our single point of contact under the EU Digital Services Act, for users and for public authorities. We reply in English, French or Spanish.
In short
We never sell your data and there are no ads in Evibe. Your portfolios are stored on our servers in Canada under a random account identifier, not under your name or email address.
Some features depend on outside providers — sign-in, payments, broker connections, emails, crash reports and AI. Each one is listed below with what it receives and why.
The community is optional. Nothing about you is public unless you create a community profile, and even then your portfolios are only shown as percentages, never as amounts.
What we collect
Your account. Your email address and the sign-in method you chose (an email code, or your Apple, Google or GitHub account). Sign-in is handled by Firebase Authentication (Google): your email address is stored there, not in our database, and we never see the password of your Apple, Google or GitHub account. If you turn on two-step verification, Firebase stores what it needs for it.
Your portfolio data. The portfolios, holdings, transactions, balances, watchlists, alerts, goals and settings you create, type in, import or sync. They are stored in our database under a random account identifier. That makes them pseudonymous, not anonymous: they are still your personal data, and we protect them as such.
Optional details. Only if you fill them in: your country of tax residence, the markets you are interested in and, for the U.S. tax features, your filing status, an approximate annual income and your state. They are only used to compute what you asked for and are never shown to anyone.
Your devices. For each device you sign in on: its type, the name set in its settings (it appears in your list of signed-in devices), the app version, the notification and Live Activity tokens issued by Apple, and when you last used Evibe.
Usage and crash data, in the apps. The iPhone, iPad and Mac apps use Firebase Analytics (Google) to measure which screens and key steps are used — onboarding, paywall, imports and the like — and Firebase Crashlytics to receive crash reports. This involves an app-installation identifier and information about your device and the app; crash reports also carry your account identifier and email address, so that we can trace a problem that affects your account. You can turn off usage statistics at any time in the app’s settings. We use no advertising identifiers and do not track you across other companies’ apps or websites.
Key steps in your account. In the apps and the web app, we also record in our own database, linked to your account, a few key steps — a paywall shown, a free trial started or ended, a subscription, a free-plan limit reached, and your agreement to AI processing given or withdrawn — with their date and context, such as the platform or the feature involved. We use them to understand how the free plan and subscriptions work, and they are deleted with your account.
Purchases. Your subscription status and purchase history (plan, dates, store, country) — never your card details. See “Payments”.
Messages and logs. The emails you send us, and our server logs (IP address, date and time, request and device information), which we keep for security and troubleshooting.
What we don’t collect: your contacts, your precise location, your photos (other than an avatar you choose to upload to the community), advertising identifiers, or the passwords of your bank or broker.
Why we use it, and our legal bases
To provide Evibe — your account, portfolios, prices, sync, imports, alerts, widgets, subscription and support, and the AI features you choose to use (see “AI features”). This is necessary to perform our contract with you (Article 6(1)(b) GDPR).
To keep Evibe secure and prevent abuse, to moderate the community, to sort support messages and public feedback about Evibe, to understand which features are used and fix crashes, and to tell existing users about news from Evibe. These are our legitimate interests (Article 6(1)(f) GDPR), which we weigh against yours; you can object at any time (see “Your rights”).
To send you push notifications, which rely on your consent (Article 6(1)(a) GDPR), given in your device’s settings, where you can withdraw it at any time.
To meet our legal obligations — accounting and tax records, requests from authorities, and our duties under the EU Digital Services Act (Article 6(1)(c) GDPR).
We do not sell your data, share it with advertisers or data brokers, or use it to build advertising profiles.
AI features
Some features use AI models provided by Anthropic (see “Service providers”). Each one only receives what it needs:
Statement import (CSV or Excel). We send the file name, the column headers, a sample of up to 25 rows and a summary of the values that repeat in some columns (such as transaction types), after automatically masking the columns that look like names, account numbers, addresses, email addresses or phone numbers, and any IBAN. Our own code then reads the rest of the file. If a security can’t be recognised, we may also send its label, currency and date to help match it.
Statement import (PDF). A PDF has to be read as a whole, so we send the statement file itself, with its file name (statements longer than a set number of pages are refused). It can include your name, postal address, account numbers and transaction history.
Portfolio analysis. The content of the portfolio you analyse: holdings, weights, values, gains and losses, performance and risk figures, and the portfolio’s name — not your email address or your identity.
Community moderation. The text of posts and comments (with the reason and note of a report, if there is one), and any avatar photo you upload, together with your pseudonym — see “Community”.
Support emails. When you write to support@evibe.com or hello@evibe.com, AI sorts your message and suggests draft replies. It receives the subject and text of your message, your name and email address as they appear in it, and up to six earlier messages of the same conversation — not the attachments. A person reads every message and writes or approves every reply; nothing is sent automatically.
Public feedback. When Evibe or portfolio tracking is discussed publicly on Reddit or X, or when Evibe is reviewed on the App Store, we may use AI to judge whether a post calls for an answer and to draft one. It receives the public post or review and the public name of its author. A person decides whether to reply.
Statement import and portfolio analysis run when you ask for them, to provide the service you requested (Article 6(1)(b) GDPR). The current versions of our apps and of the web app also explain what will be sent and ask for your agreement before you first use one of these features, and PDF import is only available once you have agreed. You can withdraw your agreement at any time in the app’s settings or by writing to us: we then stop sending your data to our AI provider for these features. Community moderation, support emails and public feedback are different: they rely on our legitimate interest — and, for moderation, on our legal obligations — not on your agreement.
Anthropic acts as our processor. Under its commercial terms, it may not use what we send it to train its models, and it deletes inputs and outputs within 30 days, unless a longer period is needed to enforce its usage policy or is required by law.
Stock analyses and market ideas are generated from market data only and contain no personal data. AI can be wrong: an import is always shown to you as a preview, and nothing is saved until you confirm it.
If you connect your own AI assistant to Evibe (through our MCP server), the data you let it read is sent to that assistant’s provider, under your own agreement with them. You can revoke this access at any time from Evibe.
Community
The community is optional. Nothing about you is public unless you create a community profile, which requires accepting our Community Terms.
Public — can be shown to anyone, including people without an Evibe account, on our public community pages, which search engines may index: your pseudonym, your avatar (one of our illustrations, or a photo you upload where this option is available), your bio, your numbers of followers and of members you follow, and the portfolios you choose to publish. A published portfolio only shows percentages — composition, gains and losses in %, performance, drawdown and ranking — never amounts, quantities, prices, transactions, its private name or the name of your institution.
Visible to Evibe users: your posts, comments, replies and reactions, and the members you follow, can be seen by other signed-in Evibe users. Treat everything you publish as public, and never publish information that identifies you or anyone else.
Your pseudonym is never publicly linked to your email address, your name or your account identifier. Photos are re-encoded on our servers before publication, which strips their metadata (including location).
Moderation. To keep the community safe and to meet our legal obligations, what you publish goes through an automatic filter (links, email addresses, phone numbers, IBANs, messaging apps, banned terms) and an automated AI classifier, and may be reviewed by a person. We keep a record of each decision — outcome, reason, whether it was automated, and the model used — to handle appeals and check that the system works. When we restrict something you published, we tell you why and how to contest it.
Reports. Signed-in users can report a post, comment, profile or published portfolio in the app; anyone, even without an account, can report content from a public community page or by email. We keep the report (reason, explanation, date) and who sent it — or, for a report from a public page, the email address you choose to give us, if any — to handle it, tell you what we decided and prevent misuse of reporting. We never tell the person reported who reported them, unless the law requires it. If a reporter later deletes their community profile or account, their reports are kept without any link to them.
Blocking and notifications. When you block a member, we store the block in order to apply it; the member is not told. We notify you of new followers (you can turn this off), of replies and of moderation decisions.
Example profiles. Some community profiles and portfolios were created by Evibe to illustrate how the community works. They are labelled “Example”, belong to no real person, do not appear in the ranking and are not counted in member or follower numbers.
Leaving. You can delete your community profile at any time without deleting your account. Your posts, comments, reactions, follows and published portfolios are deleted with it, and your pseudonym stays reserved for 90 days so that nobody can take it over straight away. So that our measures cannot be bypassed by creating a new profile, some records stay linked to your account: any suspension or restriction of your profile, with its reason; the members who had blocked you; and the members you had blocked yourself, who stay blocked. These records are erased when you delete your account.
Financial institutions
If you choose to connect a bank or broker, Evibe uses SnapTrade, operated by Passiv Inc. (“SnapTrade”), to retrieve your investment data. The connection is read-only: you sign in on your institution’s own page, Evibe never receives your credentials, and neither Evibe nor SnapTrade can place orders or move money. We receive your accounts, positions, transactions and balances, with each account’s name and number as provided by the institution (often partly masked) — not your name, address or other identity details held by the institution.
By linking an account you agree to SnapTrade’s End User Terms and Conditions (snaptrade.com/terms-and-conditions) and Privacy Policy (snaptrade.com/privacy-policy), which govern SnapTrade’s processing of the data needed to maintain the connection. You can unlink an account at any time from the app; the connection is revoked and no further data is retrieved.
Until September 2026, some connections used Plaid Inc. That service has been discontinued, and no data is shared with Plaid any more.
Payments
In the iPhone, iPad and Mac apps, subscriptions are sold and billed by Apple through the App Store; we never see your payment details.
In the web app, subscriptions are sold through RevenueCat’s web checkout and payments are processed by Stripe. Your card details go directly to Stripe and never reach us or RevenueCat; Stripe and RevenueCat receive your email address and the payment information needed for the purchase, receipts and fraud prevention.
RevenueCat keeps track of your subscription across platforms. It receives your random account identifier, your purchases and basic device and app information, and tells us which plan you have. In the apps, it is also linked to your Firebase Analytics identifier so that we can measure conversions.
Emails
We send emails through Resend: sign-in codes and links, account and security notices, and messages about the service. If you cancel a trial, we may send you a single email asking what didn’t work — whether you reply is up to you.
We may also send you occasional news about Evibe, such as major new features or offers, as Spanish law allows for existing users (Article 21.2 of Law 34/2002, LSSI). Every such email has an unsubscribe link, and once you unsubscribe we never add you back. You can also object by writing to us.
Service providers
We work with the following providers. They process data on our behalf under data-processing agreements, unless stated otherwise.
Google, through Google Ireland Limited (Firebase) — sign-in, analytics and crash reports in the apps, and sign-in codes. Data processed in the EU and the United States.
OVH Hosting Inc. — the servers that host our database, our API and the web app. Beauharnois, Canada.
Cloudflare, Inc. — delivery and protection of our websites and API (it handles your IP address and requests), hosting of our support inbox and support tools (the emails you send us and their attachments), and storage of our backups. United States and Cloudflare’s global network.
pCloud AG — a second copy of our backups. Switzerland. Our backups are encrypted on our servers before they are uploaded: neither Cloudflare nor pCloud can read them.
Anthropic Ireland, Limited, with processing by Anthropic, PBC — the AI features. United States.
RevenueCat, Inc. — subscription management. United States.
Stripe — payment processing in the web app. Ireland and United States. Stripe also acts as an independent controller for some purposes, such as fraud prevention and its own legal obligations.
Passiv Inc. (SnapTrade) — bank and broker connections, only if you link an account. Canada.
Resend — sending emails. United States.
Apple — App Store purchases, Sign in with Apple and push notifications. Apple acts under its own terms and privacy policy, as do Google and GitHub when you sign in with them.
Our market-data providers only receive requests for market data, such as tickers and dates — never information about you.
International data transfers
Wonderlink SL is based in the EU, so storing or accessing data outside the European Economic Area is an international transfer under Chapter V of the GDPR (EU 2016/679).
Canada (OVH, SnapTrade) and Switzerland (pCloud) benefit from adequacy decisions of the European Commission (Decision 2002/2/EC for Canada, Decision 2000/518/EC for Switzerland).
For providers in the United States (Google, Cloudflare, Anthropic, RevenueCat, Stripe, Resend, Apple), transfers rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and, where the provider is certified, on the EU–U.S. Data Privacy Framework. SnapTrade’s own onward transfers are described in its privacy policy.
Your data is encrypted in transit and, on our servers, at rest. For a copy of the safeguards, write to contact@evibe.com.
How long we keep data
Account and portfolios: as long as your account exists. When you delete your account in the app, your data is deleted at once from our live systems, together with your sign-in account at Firebase.
Backups: residual copies in our encrypted backups disappear within 35 days, as the backups rotate.
Inactive accounts: if an account has had no activity for 24 months, has no active subscription and no linked institution, we may delete it with its data.
Failed imports: when an import fails because of the file itself, we keep a copy of the file and a diagnosis so that we can fix the problem — for up to 90 days or, if we keep it as a test case to stop the problem from coming back, until you delete your account or ask us to delete it. The import log (without the file) is kept for 90 days.
AI: the analyses you generate stay with your account; the data used to produce them is kept for 90 days for troubleshooting. The activity log of connected AI assistants (MCP) is kept for 90 days.
Community: until you delete the content, your profile or your account, then as described in “Community”.
Support: the emails you send us and their attachments are kept for up to 3 years after the conversation ends, so that we can follow up on your requests; you can ask us to delete them sooner. Public posts and reviews collected to answer them are kept for up to 12 months.
Server logs: no more than about 60 days. Analytics data: at most 14 months. Crash reports: 90 days.
Emails: you stay on the news list until you unsubscribe, ask us to remove you or delete your account. Purchase records are kept by Apple, RevenueCat and Stripe, and by us where tax law requires it.
Your rights
Under the GDPR you can access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its use (including analytics and news emails), and withdraw any consent you gave, at any time. Write to contact@evibe.com — we reply within one month.
You can delete your account and all its data from the app at any time.
We take no decision about you based solely on automated processing that has legal or similarly significant effects. In the community, any automated moderation decision can be reviewed by a person if you ask.
You can also lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the data protection authority of your country.
Websites and cookies
This website (evibe.com) runs no analytics, tracking or advertising. It only remembers, in your browser, that you dismissed the cookie notice. It is delivered through Cloudflare, which processes your IP address to serve and protect it.
The web app (app.evibe.com) uses a cookie that keeps you signed in, and remembers a few display preferences in your browser. It uses no third-party analytics or advertising tools; the key steps described in “What we collect” are recorded in our own database. Signing in loads Google’s Firebase, and the checkout loads RevenueCat and Stripe. All of this is strictly necessary, so no consent is required.
Children
Evibe is not directed to children under 13 (or under the higher age set by local law in some EU countries, up to 16), and we do not knowingly collect their data. The community is reserved for users aged 18 or over.
Changes
We may update this policy from time to time. The date at the top of this page shows the current version, and we announce significant changes in the app.