ELVA. Privacy Policy

Last updated: 10 September 2026

ELVA. ("ELVA", "we", "us") is operated by Elevar Studios Ltd, a company registered in England & Wales (company no. 17275546, ICO registration no. ZC243203), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the personal data described below and comply with UK GDPR and the Data Protection Act 2018.

This policy explains what we collect, why, who we share it with, and the rights you have. It applies to the ELVA iOS app and related services.

1. A quick summary

• ELVA helps you reflect and build daily habits by talking to an AI persona of "your future self." That persona is generated by AI. It is not a real person.
• Your onboarding answers and chats are sent to our AI provider (Anthropic) to generate your personalised content. We ask for your consent before this happens.
• Your content (tasks, chat history, insights, streaks, your analysis) is stored on your device and securely backed up to our servers, so you can restore it if you reinstall the app or sign in on a new device.
• You can delete your account and all associated data from within the app at any time (Profile → Delete account).
• We do not sell your personal data, and we do not track you across other companies' apps or websites.

2. Data we collect

2.1 Information you provide

• Account details: your email address when you create an account, or the private relay email Apple provides if you use Sign in with Apple.
• Onboarding interview & profile: your name, the focus area you choose (money, love, happiness, health) and the free-text answers you give during the AI onboarding interview.
• Chat messages: what you write to the "future self" AI persona.

2.2 Information generated for you

• Your AI analysis (a personality/"frequency" reading) and your daily tasks and insights, produced from your interview answers.
• Progress data: completed tasks, streaks and your "frequency" score.

2.3 Information collected automatically

• Product analytics: anonymous/pseudonymous usage events (e.g. screens viewed, onboarding steps completed, paywall shown) via PostHog (EU-hosted).
• Crash and error diagnostics: crash reports and non-fatal errors via Sentry (Functional Software, Inc., US-hosted), to keep the app stable.
• Subscription status: purchase and entitlement data via RevenueCat and Apple, to manage your subscription and free trial.
• Device/technical data: app version, OS version, device model and coarse region, as part of the above diagnostics and analytics.
• Device attestation: a device attestation via Apple's App Attest, used to verify the app is running on a genuine device (anti-abuse). This is processed by Apple.

We do not collect your contacts, photos, precise location, microphone or camera data.

3. Where your data is stored

• On your device: tasks, chat history, daily insights, streaks and your AI analysis are stored in a local database on your phone for fast, offline access. Authentication tokens are held in the iOS Keychain.
• On our backend (Supabase): your authentication account (email/identifier) and a backup copy of your content: your profile and AI analysis, chat messages, daily tasks and insights, streaks, and app preferences. This backup lets you restore your data on a new device or after reinstalling. Our backend is hosted in the UK / EU (London, eu-west-2). Data is encrypted at rest, and access is restricted by row-level security so each account can only ever reach its own data.
• AI requests are processed transiently by Anthropic and are not used to train their models (see §5).

4. Why we use your data (legal bases)

You can withdraw consent for AI processing at any time by deleting your account or contacting us; note that core features depend on it.

5. AI processing (important)

ELVA uses Anthropic's Claude models to generate your analysis, daily content and chat responses. When you use these features, the relevant inputs (your interview answers, your chat messages, your name and focus area) are sent to Anthropic via our secure backend to produce a response.

• The "future self" you chat with is an AI persona, not a real human, and may produce inaccurate content. It does not provide medical, legal, financial or psychological advice.
• We ask for your explicit consent before sending your personal inputs to the AI provider.
• Anthropic processes this data as our processor and, under our agreement, does not use it to train its models.

Your conversations may reveal sensitive information about your wellbeing. We process this information only with your explicit consent, to provide the features described above. Your messages are also automatically checked for signs of crisis so that, where needed, the app can show you safety resources (for example, 024 or 112 in Spain).

6. Who we share data with

We share limited data with service providers ("processors") who help us run ELVA:

• Supabase: backend, authentication and database hosting (UK/EU).
• Anthropic: AI processing (see §5).
• PostHog: product analytics (EU-hosted).
• Sentry (Functional Software, Inc., US-hosted): stability diagnostics; transfers are safeguarded by Standard Contractual Clauses / the UK IDTA.
• RevenueCat and Apple: subscription management and payments. Payments are processed entirely by Apple, and we never see or store your card or payment details; we only receive your subscription status.

We do not sell your personal data. Where data is transferred outside the UK/EU, we rely on appropriate safeguards (e.g. Standard Contractual Clauses / UK IDTA).

7. Data retention

• On-device data remains until you delete it, sign out, or uninstall the app.
• Account data is retained while your account is active. When you delete your account, we delete your authentication record and all of your backed-up content on our servers (profile, analysis, chat messages, tasks, insights and streaks) and wipe on-device data; provider logs are purged on their normal cycles.
• Analytics and diagnostics are retained for a limited period in line with each provider's retention settings.

8. Your rights

Subject to UK/EU GDPR, you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. In particular:

• Delete your account and data any time: Profile → Delete account.
• Sign out to clear this device's local data.
• Contact us to exercise any other right.

You also have the right to complain to the UK Information Commissioner's Office (ICO) (ico.org.uk), our lead data protection regulator, or, depending on where you live, to your local data protection authority.

9. Children

ELVA is not directed at children and is intended for users aged 17+. We do not knowingly collect data from children under the applicable minimum age.

10. Security

We use encryption in transit (HTTPS), the iOS Keychain for tokens, row-level security on our backend, and we keep API keys server-side only. No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by updating the "Last updated" date above.

12. Contact

Elevar Studios Ltd Data protection contact: admin@elevarstudios.co.uk Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

The live version of this policy is hosted at https://elevarstudios.co.uk/privacy.