Privacy policy
Your data is yours, not ours. This policy says what everydeck collects and why, how long we keep it, where it lives, and what rights you have. We never sell your data.
everydeck is run by XAVR LLC, a Wyoming limited liability company, 30 N Gould St # 70950, Sheridan, WY 82801, USA (“we”, “us”). Contact: support@everydeck.ai.
Who this policy covers
This policy covers people who visit everydeck.ai and people who have an everydeck account: owners and their team members (“you”). For this data we are the controller.
It does not cover data about the users of the apps you connect to everydeck. We process that data for you, under your instructions, as your processor. Those terms are in our Data Processing Agreement. If you use an app that is connected to everydeck and have questions about your data, ask the company that runs that app.
What we collect and why
We collect only what we need to run everydeck.
Your account
When you sign up we ask for your name, email address and a password, or you sign in with Google or GitHub. Sign-in runs on Supabase Auth. If you turn on a second factor, we store that it is on, not your authenticator. We store your email, name and role in each team you belong to, your settings (for example your time zone and which mails you want), and team invitations you send or receive.
Sign-ins and security
When a new session signs in, we read the browser, operating system and IP address of that session from our sign-in service so we can show your active sessions and email you about a sign-in from a new device. We keep a record that a session was seen and which browser and system you used before. We do not look up your location. Our servers log each request with its IP address for security and debugging, and count failed attempts per IP address to slow down attacks.
Mails
We send mails about your account and your apps: invitations, sign-in and security notices, case digests, weekly summaries, setup progress and exports. Most mails can be turned off with one click in the footer or in your settings; security and account mails cannot. Our mails contain no tracking pixels and no remote images. We keep a record of which mail went to which address.
What you connect
When you connect GitHub, Supabase or Vercel, we store the access we need for that connection. Access tokens are encrypted with a key that is kept outside the database. Our GitHub App reads pull requests, checks, deployments and workflow runs; it cannot read your source code or write to your repositories.
Cookies and analytics
everydeck uses no cookies and no advertising trackers.
On this website (everydeck.ai) we count visits with Cloudflare Web Analytics. It sets no cookies, stores nothing in your browser and does not fingerprint visitors by IP address or browser. We see only totals: which pages were viewed, which sites sent visitors, their countries and how fast pages loaded. Query strings in addresses are not recorded. Your browser loads the counting script from Cloudflare, so Cloudflare receives your IP address with that request, as with any request on the web. Source: Cloudflare Web Analytics and its FAQ, checked November 5, 2026. The app (app.everydeck.ai) and the docs (docs.everydeck.ai) do not use it.
The app keeps your session and a few preferences (for example the last app you opened) in your browser’s local storage. They are cleared when you sign out or switch accounts.
When you write to us
When you email us, we keep the conversation so we can help you if you write again.
The data from your apps
everydeck shows you the people, data, payments, errors and jobs of the apps you connect. You decide what everydeck reads, and you can change that in Settings › Data and privacy. In short:
- Our SDK sends events, errors and page views. Pages are sent as route patterns, never with query strings. Emails and tokens are removed from error messages, and we remove them a second time before anything is stored.
- The read bridge reads only the tables and columns you approved. Email addresses, phone numbers and IP addresses stay in your app. Messages between your users are never stored; they are read live only when someone on your team opens a conversation and gives a reason, and that opening is logged.
- During setup, our check tool sends the names of your tables and columns and short, redacted excerpts of your code. It never sends rows from your database or keys.
- If the setup review is turned on, those names and excerpts are sent once to an AI model provider (Anthropic or OpenAI) to check the setup. We keep only counts and the suggestions, never the text. This review is currently turned off.
The details, and what we may and may not do with this data, are in the DPA.
When we access or share your information
To run everydeck. We use a small number of service providers, listed on our subprocessors page. We share with them only what they need for their part.
At your direction. When you connect a service such as GitHub or Supabase, data moves between that service and everydeck as you set it up.
No one at everydeck looks at your content except to help you with a support request you make (we will ask first), to fix an error that stopped an automated process, to protect everydeck and its users from abuse or attacks, or when the law requires it. everydeck has no feature that lets us sign in as you.
When the law requires it. We are a US company and our infrastructure is in the US. We share data with authorities only when compelled by valid legal process, and we will tell affected customers first unless we are not allowed to.
If XAVR LLC is ever acquired or merges, we will tell you before your information moves to a different privacy policy.
Your rights
Wherever you live, you can ask to know, access, correct, export or delete your personal information, to restrict or object to how we process it, and to not be subject to purely automated decisions with significant effects. You also have the right to complain to a data protection authority.
Much of this you can do yourself: change your name and settings in your account, download everything in your team with “Download everything”, delete an app, delete your team, or delete your own account. For anything else, email support@everydeck.ai. We may need to confirm it is you before we act. Exercising your rights never changes the price or service you get.
How we secure your data
Data is encrypted in transit with TLS. Access tokens and keys for your connections are encrypted with AES-256-GCM. Each team’s data is separated in the database by row-level security, and team members only see what their role allows. Changes and sensitive actions are written to an audit log.
Retention and deletion
We keep information as long as we need it for the purpose we collected it, or as long as the law requires. Specific periods:
- Events, page views and other raw data from your apps: 30 days on the Free plan.
- Audit log and protocol of actions: 90 days.
- Exports: the download is deleted after 24 hours.
- When you delete your team or your account, you have 24 hours to undo it. After that, the data is deleted from our database. Database backups keep it for up to 7 more days and are not used for anything else.
- When you delete a person’s data in an app, we keep a deletion marker so that new data about that person is blocked. Email, phone and names in it are stored only as one-way hashes.
Other account data (for example your profile and team membership) is kept while your account exists.
Where your data is
everydeck runs in the United States (US East, Virginia). If you are outside the US, your information will be transferred to and stored in the US. For data covered by the EU or UK GDPR, our DPA includes the Standard Contractual Clauses.
Changes and questions
We may update this policy when everydeck or the law changes. When we make a significant change, we will update the date at the top and tell account owners by email. Questions about this policy, your data or your rights: support@everydeck.ai.
Adapted from the 37signals policies, licensed under CC BY 4.0. We shortened and rewrote them for everydeck.