Data protection

Checked against our code on 21 October 2026.

Stored

Stored data, and why
What	Why
The messages, rows, emails, events and documents we read	So every number can show where it came from
Files and photos	So your team can open the original
Records of who was helped, how and when, with the words they came from	They are what we count
Each person's code, initials and the ways your team writes their name	So each person is counted once
Each person's name, as your team first wrote it	So an owner or admin can look someone up
Your staff and volunteers' names	So they are never counted as people served
Sign-ins for the accounts you connect	So we can keep reading on schedule
Members' email addresses, names and roles	To sign you in and decide what you can do

Files are kept private. A link to one stops working after 5 minutes. A shared report's photos and PDF are the exception. Anyone with its link can open them until it expires or you turn it off.

Encryption

Supabase, our database host, encrypts everything we store on its disks.
We also encrypt each person's saved name, and the sign-ins of accounts you connect.
We use AES-256-GCM, with a key held by our app server, not the database.
We don't add our own encryption to message text or files.
We don't encrypt names inside messages, or the spellings we match people by.

Claude

Claude, an AI model made by Anthropic, reads your messages and files to find records.
Before any text is sent, we hide phone, NRIC, FIN and passport numbers.
Emails, bank account numbers, postal codes and street addresses are hidden too.
This works by matching patterns, so an unusual format can slip through.
Claude still sees names, because it needs them to tell people apart.
A photo is sent as it is. Numbers written on it are not hidden.
We remove where, when and on what device it was taken first.
Claude also gets your programmes, your team's names, and your glossary and rules.
Report drafts get the figures, the report's title and the funder's name.
Drafts and the “What changed” sentences also get your organisation's and programmes' names.
Neither gets a message, a record or the name of someone you help.
We check Claude's answers, report drafts too, and hide any ID number or email again.
The shared sample's made-up records were read by simple rules, not by Claude.
In your own sample copy, what you add and any report draft go to Claude.

Names

Each person you help appears as a code and initials, like P-0042RK.

Your messages and files keep names as your team wrote them.
Contributors, admins and owners see those names when they check records.
Volunteers you add as viewers see the records but not the original messages.
Summaries name people by code. A name nobody recorded as a person can still appear.
Phone and ID numbers, emails and addresses are taken out of every summary.
On a person's page, only owners and admins can show their name.
Each look is written to the audit log.
A report never lists the people you help, by name or by code.
It shows a photo or quote only if you tick that you have consent.
An export leaves names out. An owner or admin can ask for them, and that is logged.

Logs

Our server logs keep ids, counts, timings, error types, error messages and stack traces.
A failed database query is logged with its SQL, without the values in it.
Fields holding message text, quotes, names, emails or tokens are blanked before writing.
The audit log records sensitive actions, like showing a name, deleting or exporting.
It names people by code only. Owners and admins can read it.
Each record's page shows its own history, with any reason your team typed.
Viewers see only that a reason was given, not what it says.

Deleting

Deleting, by kind
You delete	What goes
A source	You choose whether to keep what it brought in, or delete all of it.
A person	Their records. Messages that name them stay until you delete their source.
The organisation	Its data and files. Only an owner can do this.

Each of these waits 10 seconds, so you can undo it. Then your numbers are counted again.
You can set a retention period in Settings. It is off until you do.
With it on, older messages and files go each night at 3am Singapore time. The numbers stay.
An uploaded chat or spreadsheet is one file. It stays until all of it is older than your setting.
Our database host's backups can hold deleted data until they expire.
A deleted organisation leaves a short note: its name, address, date and which accounts belonged. It tells those people it was deleted, and no one else.

Hosting

Your data is stored by Supabase, in Singapore.
The app and its background jobs run on Railway, also in Singapore.
What we send to Claude, text and photos, is processed by Anthropic.
We're still confirming how long Anthropic keeps it, and where it's processed.

The law

We built Evidently with Singapore's Personal Data Protection Act in mind. No lawyer has checked it.
Evidently is new. It has no security certification or independent audit yet.
Settings has a notice you can adapt for the people you serve.
To ask about your data, email williamyang0013@gmail.com.

Stored

Stored data, and why
What	Why
The messages, rows, emails, events and documents we read	So every number can show where it came from
Files and photos	So your team can open the original
Records of who was helped, how and when, with the words they came from	They are what we count
Each person's code, initials and the ways your team writes their name	So each person is counted once
Each person's name, as your team first wrote it	So an owner or admin can look someone up
Your staff and volunteers' names	So they are never counted as people served
Sign-ins for the accounts you connect	So we can keep reading on schedule
Members' email addresses, names and roles	To sign you in and decide what you can do

Files are kept private. A link to one stops working after 5 minutes. A shared report's photos and PDF are the exception. Anyone with its link can open them until it expires or you turn it off.

Encryption

Supabase, our database host, encrypts everything we store on its disks.

We also encrypt each person's saved name, and the sign-ins of accounts you connect.

We use AES-256-GCM, with a key held by our app server, not the database.

We don't add our own encryption to message text or files.

We don't encrypt names inside messages, or the spellings we match people by.

Claude

Claude, an AI model made by Anthropic, reads your messages and files to find records.

Before any text is sent, we hide phone, NRIC, FIN and passport numbers.

Emails, bank account numbers, postal codes and street addresses are hidden too.

This works by matching patterns, so an unusual format can slip through.

Claude still sees names, because it needs them to tell people apart.

A photo is sent as it is. Numbers written on it are not hidden.

We remove where, when and on what device it was taken first.

Claude also gets your programmes, your team's names, and your glossary and rules.

Report drafts get the figures, the report's title and the funder's name.

Drafts and the “What changed” sentences also get your organisation's and programmes' names.

Neither gets a message, a record or the name of someone you help.

We check Claude's answers, report drafts too, and hide any ID number or email again.

The shared sample's made-up records were read by simple rules, not by Claude.

In your own sample copy, what you add and any report draft go to Claude.

Names

Each person you help appears as a code and initials, like P-0042RK.

Your messages and files keep names as your team wrote them.

Contributors, admins and owners see those names when they check records.

Volunteers you add as viewers see the records but not the original messages.

Summaries name people by code. A name nobody recorded as a person can still appear.

Phone and ID numbers, emails and addresses are taken out of every summary.

On a person's page, only owners and admins can show their name.

Each look is written to the audit log.

A report never lists the people you help, by name or by code.

It shows a photo or quote only if you tick that you have consent.

An export leaves names out. An owner or admin can ask for them, and that is logged.

Logs

Our server logs keep ids, counts, timings, error types, error messages and stack traces.

A failed database query is logged with its SQL, without the values in it.

Fields holding message text, quotes, names, emails or tokens are blanked before writing.

The audit log records sensitive actions, like showing a name, deleting or exporting.

It names people by code only. Owners and admins can read it.

Each record's page shows its own history, with any reason your team typed.

Viewers see only that a reason was given, not what it says.

Deleting

Deleting, by kind
You delete	What goes
A source	You choose whether to keep what it brought in, or delete all of it.
A person	Their records. Messages that name them stay until you delete their source.
The organisation	Its data and files. Only an owner can do this.

Each of these waits 10 seconds, so you can undo it. Then your numbers are counted again.

You can set a retention period in Settings. It is off until you do.

With it on, older messages and files go each night at 3am Singapore time. The numbers stay.

An uploaded chat or spreadsheet is one file. It stays until all of it is older than your setting.

Our database host's backups can hold deleted data until they expire.

A deleted organisation leaves a short note: its name, address, date and which accounts belonged. It tells those people it was deleted, and no one else.