Privacy Policy
Last updated: October 16, 2026
Envolved is a research tool. You give it documents, it indexes them, and it answers questions about them with citations back to the passages it used. This page says what it holds while doing that, where that data goes, and what you can do about it.
What we collect
Your identity, from Google. Signing in uses Google with the scopes openid email profile — all non-sensitive. We receive and store your email address, your name, and Google's
subject identifier for you. We never see your Google password.
The documents you add. Files you upload, and documents fetched on your behalf when you add them by URL or from Wikipedia or OpenAlex. We store the original bytes, the extracted text, and everything derived from it: chunks, embeddings, summaries, an entity graph and wiki pages.
What you ask, and what you are told. Your questions and the answers, so a conversation persists between visits.
The inquiry record. A Space can keep a record of what it is for: its goal (and how it was worded before), what it should and should not gather, the questions still open, and what you have worked out. Each entry says whether you wrote it, accepted it, or the assistant suggested it. It is stored with the Space, is in your export, and is deleted with the Space; you can read, change or remove any entry from the Space. When the Space's "carry this inquiry into new conversations" switch is on, the record is sent with each question in that Space to the AI models named below, as background an answer may not cite. New Spaces carry the record by default. Spaces saved with the switch off keep that setting. You can turn it off or on for a Space or override it for one conversation. The report you see on returning to a Space is assembled from these records and your documents; making it sends nothing to a model.
What things cost. A ledger row per priced operation, against your account, so a wallet balance can be a sum rather than a stored number.
We do not use cookies for tracking or advertising. The one cookie is your session's refresh token: it is
HttpOnly, SameSite=Lax, sent over HTTPS only, and rotated on every use. There is no
analytics, no advertising network, and no third-party tracker on the app.
Where your data goes, and where it physically is
This matters more than usual here, so it is stated plainly rather than as "trusted partners".
| Where | |
|---|---|
| Uploaded files, the database and its backups | Google Cloud Storage, northamerica-northeast1 (Montréal) |
| The application itself | Google Cloud Run, northamerica-northeast1 |
| The AI models that read your documents | Google Gemini Developer API, or Google Vertex AI when configured; voice uses Vertex AI |
| The search index over your documents | Google Discovery Engine, global |
Your documents' contents are sent to Google's models. The model and search services are not confined to Canada. This includes images of your documents' pages and figures, and any image you attach to a question. We chose the Canadian region for storage and compute; that does not imply Canadian processing for the models or search index. The configured Google service's data-processing terms apply.
Third parties you invoke by choice. Adding a document from Wikipedia, OpenAlex or a URL makes a request to that service, which sees our server's address and what was asked for. OpenAlex additionally receives an operator contact address, which is their courtesy convention for identifying API callers. Fetching a paper through OpenAlex may also ask Europe PMC for its open copy, by the paper's DOI; that request carries the DOI and nothing you wrote. A search for papers to add may also ask Crossref, the DOI registry: it receives the search's words, which are drawn from what you asked to find (and any journal name or date range the search was narrowed to), and when we re-check papers for retractions, their DOIs. Each request carries the operator contact address where the deployment has one, as Crossref's etiquette asks, and nothing else. A paper found through Crossref is fetched through OpenAlex.
The watch. When scheduled by the operator, for each unarchived Space with a record you have not marked finished, we periodically re-check the papers in it against OpenAlex and Crossref for retractions. Those requests send OpenAlex the papers' identifiers and Crossref their DOIs (and, where the deployment has one, the operator contact address above), and nothing you wrote. The watch does not search for new work and adds nothing to a Space. Its result appears in the Space's report the next time you open it.
Your Spaces in your own AI assistant, if you connect one. Nothing here happens until you add Envolved to an assistant yourself (for example as a custom connector in Claude, or a server in Claude Code) and approve it on Envolved's own consent page after signing in. From then on, that assistant can use Envolved's tools on your behalf, when you or it decide to while you are using it: list your Spaces with their goals and open questions, search a Space, read one document (up to 40,000 characters of its text), ask a Space a question, ask for sources to add, and add or reject the sources you or it choose, within the limits the Space's curation settings allow; a rejection made there is recorded like one made in Envolved. It cannot delete or share anything. Whatever a tool returns goes to the assistant you connected, and from there to that assistant's provider (for Claude, Anthropic), under the terms you accepted with them, not ours: your Spaces' names, goals and open questions, document titles and text you have it read, and each answer with its quoted passages (each up to 800 characters) and links back to Envolved. What the assistant sends us is handled like anything you type into Envolved: a question it asks is answered in a conversation of that Space, kept with it, charged to your wallet, and sent to the AI models named above.
What we do not do
We do not sell your data, share it for advertising, or use your documents to train any model of our own. We do not read your Spaces except where you explicitly share them.
How long we keep it
Your Spaces, documents and conversations stay until you delete them. Database backups have a seven-day point-in-time window; older backup generations are pruned.
Deleting your account removes every Space and its index, your uploaded files, anything commissioned in them and its audio, your collections, your API keys, your settings and every session, in one request from Account. One thing survives it, and we would rather name it than let you assume otherwise:
- Your transaction ledger, which is append-only: a balance is a sum over it, and we keep the record of what was charged.
If you shared a Space and someone forked it, their copy is theirs: a fork takes its own copy of the files at the moment it is made, so deleting yours removes yours and leaves theirs, which are no longer the same stored objects.
Sharing
A Space is private to you until you create a share link. A share link grants read-only access to anyone holding it — it is not guessable, but it is not a password either, and anyone you send it to can pass it on. Clearing the link revokes it immediately.
Security
Sessions are this deployment's own signed tokens: the access token is held in memory only, the refresh token
is the rotating HttpOnly cookie above, and replaying a rotated token ends the whole session family. API
keys are shown once and stored only as a digest — we cannot recover one for you, only revoke it and issue
another. Per-turn diagnostic traces are off in this deployment, so the contents
of your turns are not retained in a separate debugging store.
We are a small operation running one instance. We do not claim certifications we do not have.
Your choices
- See it. Everything we hold is visible in the app: your Spaces, documents, conversations and your transaction list.
- Export everything, as one JSON file, from Account.
- Delete a Space, which removes it from the index and the database.
- Delete your account, which removes all of it except the transaction ledger named above.
- Revoke an API key at any time, from Account.
- Disconnect an assistant at any time: each one you approved appears in Settings, under API keys, named after it (for example “Claude (MCP)”), and revoking it stops it at once. Its sign-in otherwise lapses after 30 days unused.
- Sign out, which ends the session and its refresh family.
- Ask us anything about your data, at the contact address below.
Children
Envolved is not directed at children and we do not knowingly collect data from anyone under 16.
Changes
If this page changes materially we will say so on it and date it. The date at the top is when it was last checked against what the software actually does — which is the check that matters, and the one most privacy pages never make.