Security of Your Data

Last updated: September 2026

This summary describes EVOCU's actual technical measures today, not a certified security audit. It complements the Privacy Policy.

How we protect your account

• Sign-in (email and password) is managed by Supabase Auth; we never see or store your password in plain text — Supabase stores it encrypted.
• All communication between the app and the server is encrypted (HTTPS).
• Your signed-in session is stored securely on your own device; signing out from Settings removes it from there.

Per-user isolation

Every database table has Row Level Security rules enabled: the database itself, not just the app, checks that each row belongs to whoever is requesting it before returning it. In practice, no other EVOCU user can read or modify your check-ins, weight, routines, or any other data of yours, even if they tried to access the database directly without going through the app.

Profile photo: the exception

It's the only piece of data that's publicly readable by design (necessary to be able to display it inside the app): whoever has the exact link could view it, although it's not listed anywhere searchable. Uploading, changing, or deleting the photo remains restricted to your account. See the Privacy Policy for more detail.

What we don't do

• We don't integrate third-party analytics, advertising, or trackers.
• We don't sell or share your data with third parties.
• We don't send push notifications from a server — the daily reminder is scheduled locally on your phone.

Control over your data

• Export: Settings → Export my data generates a complete copy that you share yourself (AirDrop, Files, email...) — it doesn't go through our servers.
• Reset: Settings → Reset EVOCU data deletes profile, calendar, check-ins, sessions, weight, nutrition, and restrictions. It doesn't delete your custom routines, saved generator personalization, or your active program — nor the profile photo or the account itself.
• For a complete account deletion (including the photo and access), email us — it's not an automated process yet.

Recommendations for you

• Use a password you don't reuse on other accounts.
• Don't share your signed-in session on devices you don't control.
• Sign out if you lend or sell your phone.

Found a security issue?

Email us at evocu.soporte@gmail.com with the details — we'll review it as soon as possible.