Evoya

Privacy policy

Last updated 30 September 2026

The short version. Evoya works without an account. It has no ads, no tracking and no analytics, and it sells nothing about you to anyone. Your position is used to show what is near you. If you make an account, your email address and what you do with it (ratings, questions to Yannis) are kept until you delete the account, which you can do in the app at any time. Your photographs never leave your phone.

Who is responsible

Evoya is made and run by Christos Batsoulis, Athens, Greece, who is responsible for your data under the EU General Data Protection Regulation (GDPR). Write to privacy@evoya.app about anything on this page.

What the app sends, and what is kept

What	Why	Kept
Your position, when you use Near me or the walks	To put the nearest places first and to know which stop you have reached. On the phone for the walks; sent to Evoya's server for Near me.	Not kept by Evoya. The hosting provider's server logs, which include these requests, are kept for a short time.
A random id your phone makes when the app is installed	So a rating you make without an account can be counted once and changed later. It is not linked to your name, email, or phone number.	With your ratings.
Ratings: the place, good or bad, an optional note, and your position when you rated	To show others which places are good, and to give more weight to ratings made at the place itself.	Until you delete your account, or, if you rated without one, for as long as Evoya runs.
Your account: email address, how you sign in (Google, Apple or email) and an account id	So you can sign in, and your ratings follow you between devices.	Until you delete the account.
Questions to Yannis, with your account id and, if the app sends it, your position	To answer the question, and to limit how many questions each person can ask in a day.	Until you delete your account.
Photographs in My walks	Your own journal of the walks.	Only on your phone. They are never uploaded. If you share one, that is you sending it, through the app you choose.

Evoya does not use your data for advertising, does not build a profile of you, and does not share it with anyone except the services below, which handle it on Evoya's behalf.

Other companies involved

Supabase (database and sign-in), servers in Frankfurt, Germany.
Render (runs Evoya's server), servers in Frankfurt, Germany.
OpenAI (writes Yannis's answers), in the United States. It receives the text of your question, not your name or email. Under OpenAI's API terms at the time of writing, it does not use this to train its models and keeps it for up to 30 days to watch for abuse.
Google: if you sign in with Google, Google tells Evoya your email address and name. When you look for a pharmacy, Evoya's server asks Google Maps for the nearest ones using your position; the request comes from Evoya's server, not your phone, and carries nothing that identifies you. Opening a pharmacy takes you to Google Maps, under Google's own privacy policy.
Apple: if you sign in with Apple, Apple tells Evoya your email address, or a private relay address if you choose to hide it. On iPhone, the maps are Apple Maps.
OpenStreetMap Foundation: on Android, the map images are loaded straight from OpenStreetMap's servers, which see your phone's internet address and the area being shown.
Resend (sends the email that confirms a new account), in the United States. It receives your email address.

Transfers to the United States rely on the EU standard contractual clauses or the EU-US Data Privacy Framework, as each company provides.

The legal basis

Evoya uses your data to provide the service you ask for (GDPR Article 6(1)(b)): showing what is near you, keeping your account and ratings, answering your questions. Server logs and the daily question limit rest on Evoya's legitimate interest in keeping the service working and free from abuse (Article 6(1)(f)).

Your rights

You can ask to see the data Evoya holds about you, to have it corrected, to have it deleted, to receive a copy of it, or to object to its use. Write to privacy@evoya.app; you will have an answer within a month.

You can delete your account yourself in the app: Profile, Delete account. See what that deletes.

If you think your data has been mishandled, you can complain to the Hellenic Data Protection Authority, www.dpa.gr, or to the authority where you live.

Backups

The database is backed up every night and each backup is kept for 14 days, on an encrypted computer whose own backup can hold older copies for longer. Backups are only used to recover from a failure.

Children

Evoya is not meant for children under 15, and does not knowingly hold data about them. If a child has made an account, write to privacy@evoya.app and it will be deleted.

Changes

If this policy changes, the new version will be posted here with a new date.