Privacy

What Everla keeps, who can see it, and what happens to it when you ask. Last revised 9 September 2026.

Everla is a private archive for one family at a time. Everything in an archive belongs to the family that put it there. This page says plainly what we hold, why, where, and how to have it removed.

What we keep

• Your account. Your name and email address, and — if you sign in with Apple or Google — the name and address that service shares with us. Apple may provide a private relay address when you choose Hide My Email. We use them to know who you are and to show your name to your own family. We do not sell them and we do not use them for advertising.
• What the family adds. The photographs, films, scans and documents a member uploads, and the answers the family gives about them: who is in a picture, when it was taken, how people are related, what a film is called. We also keep metadata in uploaded files, including dates and photo GPS coordinates when present, to place memories in time and on the family's map.
• What the archive works out. To place photographs in time and on the right person's page, Everla looks at each picture and film: it finds faces and compares them with faces the family has already named, estimates dates, writes a short caption, and transcribes the speech in home movies. These results are kept with the picture they describe and marked as the archive's guess until the family confirms or corrects them.
• Sign-ins. When each account last opened the archive, so whoever looks after it can see who is using it, and records of account and membership actions to protect access. Clerk also handles IP addresses, approximate sign-in location, device information and a client identifier for authentication and security. The app does not continuously collect your phone's GPS location or use advertising identifiers. There is no advertising or tracking across other companies' apps and websites. The site and the web app count page views with Cloudflare's analytics, which sets no cookie and does not identify you.

Who can see it

• Only members of your family's archive. An archive is opened by invitation, and the person who looks after it decides who is in it and can remove anyone.
• Each family's archive is kept separate from every other family's, in the database and in storage, and nothing in Everla shows one family's material to another.
• Everla's staff do not browse family archives. We access specific records when needed to resolve a reported problem, investigate an abuse report, or fulfill a deletion request.

Where it is, and who helps us process it

Everla runs on servers we rent. Some of the work above is done by other companies on our behalf, under their own privacy terms, and only for the purpose named here:

• Sign-in is handled by Clerk, which stores your account credentials and the sign-in security information described above. Everla never sees your password.
• Storage for photographs, films and documents is Cloudflare R2.
• The database (names, dates, relationships, captions) is hosted by Neon.
• Processing — finding faces, estimating dates, writing captions, transcribing films — runs on Modal. For captions, film titles and transcription, photos, video frames, audio, documents or text can be sent to OpenAI, Anthropic or Google Gemini, depending on the processing task. The app asks for your permission before you send new content or corrections for this processing. You can decline and browse your existing archive, or withdraw permission for future requests in Settings. Withdrawing does not recall content already sent or cancel work already in progress. Browser dictation may send microphone audio to your browser's speech service, such as Apple or Google; we ask permission before starting it.
• Content safety — with the updated permission you give in the app, OpenAI checks new photos and text, and a sample of film frames plus available transcripts, before sharing them with other archive members. These checks can miss harmful content. Flagged items and checks that cannot finish stay private to their contributor while an authorized Everla operator reviews them. Reports are private to the reporter and Everla's review team. Withdrawing permission stops safety checks that have not yet been sent; it cannot recall an earlier provider request. A later permission does not silently restart previously withdrawn checks.
• Public-record searches. When you choose Look now, Everla shows the exact names and search services before asking you to allow that search. Internet Archive receives full-name queries at archive.org and be-api.us.archive.org. If the Library of Congress newspaper search is enabled, it is also named in that confirmation and receives those queries at chroniclingamerica.loc.gov. Only people marked as deceased are included; living or unknown-status relatives, photographs, addresses, family locations and dates are not sent. Search services may retain queries under their own policies. Permission applies to one search, and changed names or services require a new confirmation. Declining sends nothing and leaves existing clippings available. Already-sent queries cannot be recalled. A private run receipt records who permitted the search, when, and its names and recipients; the current run and five previous receipts are kept in your archive's settings.
• The map is drawn from a map file we host ourselves; no map service sees where your family's photographs were taken.

Nothing about your family is shared with anyone else, for any other reason.

Faces

To tell one relative from another, Everla computes a mathematical description of each face it finds and compares it with faces the family has already named. That description is kept only inside your family's archive, is used only to suggest who someone might be, and is deleted with the picture it came from. The family can say "that isn't them" about any suggestion, and the archive remembers the correction.

Your choices

• See and correct. Everything the archive believes about a picture or a person is shown in the app and can be corrected there.
• Set something aside. Import and library controls can hide material from the archive. Setting a file aside is reversible and is not permanent erasure.
• Delete your account. Open Settings → Delete account, or use Delete account on the signed-in screen before joining a family. Confirm the request in the app; no email, telephone call or family administrator's permission is required. We remove your account and the associated personal data you provided, including your uploads and contributions, within 30 days. Shared records need a scoped review to preserve material supplied by other members. Your receipt link shows the deadline and confirms when deletion is complete, and remains available after sign-out. If you are the only member, the archive is deleted too. Deleting an account is permanent, unlike disabling access or setting a picture aside.
• Delete the whole archive. The person who looks after an archive can ask us to delete it entirely — the pictures, the films, the database, the face descriptions, everything — and we will, within 30 days, and confirm when it is done.

Children

Family archives contain pictures of children; that is what family archives are. Accounts are for adults. Everla does not knowingly open an account for anyone under 13, and a parent who wants a child's pictures removed from an archive can ask the person looking after it, or us.

Changes

If this page changes in a way that matters, we will say so in the app before the change takes effect. The date at the top is the date of the last revision.

Write to us

[email protected]