Privacy policy

What Evenhand collects, why, who processes it, where it is stored, how long it is kept, and how you, or a person a family cares for, can use your rights.

Last updated 10 November 2026. Policy version 1.

Who we are

Evenhand is an app where a family keeps one shared record of caring for someone, such as a parent: costs and who paid, visits and calls, tasks, appointments, contacts and where the important papers are. It is run by Ahrar Ghayyem, trading as Hoppr Apps, No. 3500, Jalan Teknokrat 3, 63000 Cyberjaya, Selangor, Malaysia ("we"). We are the controller (in Malaysia, the data user) of the personal data described here.

Privacy contact: Ahrar Ghayyem, support@hoppr.online, No. 3500, Jalan Teknokrat 3, 63000 Cyberjaya, Selangor, Malaysia. The privacy contact is responsible for the personal data Evenhand holds and answers questions, requests and complaints about it (in Singapore and the Philippines, our data protection officer; in South Africa, our Information Officer; in India, the person who answers grievances; in Quebec, the person in charge of the protection of personal information).

Records only. Evenhand keeps the records you enter. It doesn't move money, hold money or process payments, and it doesn't give medical, legal or financial advice.

Evenhand is available in every country where Google Play offers it. If the law where you live gives you more rights than this notice describes, you have those rights too.

If a family keeps a record about you

This part is for the person being cared for, and for anyone who acts for them. You don't need the app or an account to use it.

What we hold about you: your name and a short label the family chose (such as "Mum"), and the records the family enters about caring for you: appointments (the type, such as doctor or bank, the date, time and place, and who's going), visits and calls, tasks, costs paid for you or from your own money, contacts such as a clinic or a bank, and where papers such as a will or a power of attorney are kept. We hold no copies of documents. The app asks everyone not to record diagnoses, test results, medicines, or ID and account numbers.
Who sees it: only the members of that family's circle. Owner and Family members see everything in the circle. Helpers (for example a paid carer) see tasks, appointments, the log and contacts, but never money or where documents are.
What the family confirmed: the person who set up the circle confirmed, with a date and this policy's version, that they are an adult family member or authorised helper and that one of these is true: you know about the record and agree to it; they hold written authority to act for you (such as a power of attorney or a court order); or you can't decide for yourself and they act in your interest as your carer. That last choice isn't offered in Brazil, Japan, Mexico, where your own agreement or written authority is needed.
How to ask what's held, or ask for removal: use the request form (no app or account needed), or write to the privacy contact above. We check who you are first, may ask for proof, and reply within 21 days (15 days in Brazil). We tell the person who set up the circle that a request was received; we don't ask their permission, because the right is yours.
What removal does: your name and label are removed from the circle, notes on entries linked to you are removed, and those entries lose the link to you. Tasks and log entries keep their titles, and the family's records of who paid what stay without your details, because the other members need them to stay correct.

Families can show or send you "A note for people being cared for" from the app; it says the same in a page you can keep.

What we collect

Account: your email address (you sign in with a one-time code sent to it), your display name, the country your phone is set to when you sign in, and that you confirmed you are 18 or older. Your settings: which notifications and emails you get, your time zone and your weekly digest day. Your signed-in sessions are stored only as hashes.
Circles: each circle's name and currency, and each member's display name and role (Owner, Family or Helper), including people added by name who haven't joined yet. Invites are stored as a role, an expiry and hashes of the link and code; the code is also kept encrypted with a key only the invite link opens, so the invite page can show it. We never ask for or store the invited person's email or phone number: you share invites yourself, and we send no invite emails.
The circle's confirmation (see "What the family confirmed" above): who confirmed, when, which choice, the policy version and their country.
Records the family enters: the people cared for (a name and a label); costs (amount, currency, description, category, date, who paid, how it is split, whether it came from the person's own money, a note) and settle-up records, with their edit history; log entries (visit, call, errand and the like, who did it, when, a note); tasks and appointments (as described above), and who took them on or marked them done; contacts (name, kind, phone, email, address, notes); and where documents are kept (kind, title, location, who holds them, when someone last checked, notes).
Your phone: a random identifier for each installation, which the app sends with every sync. We store it only when the phone registers for push notifications (when you allow notifications), and then also its push token, the platform, language, time zone and app build, and when it last synced.
Notifications and emails we send: which kind went to whom and when, and whether an email was delivered, bounced or marked as spam (our email provider tells us). Emails carry the circle's name, who did something and short facts like an amount or a date, never titles or notes; pushes carry only a generic line such as "A cost or settle-up involves you". You get at most 10 notification emails a day; the rest wait for your weekly summary, which comes on the weekday you signed up.
Crash reports, off by default: only if you turn on "Send crash reports" in More › Privacy and about. Then, when the app crashes or hits an error, a report with the error and stack trace, the app version, the device model and operating system version, and a random installation identifier. Reports never include your email address or anything you entered. Turning the switch off stops them and deletes reports not yet sent.
Technical data: our servers log each request with your IP address, the time, the kind of request, the result and your account's internal id if you are signed in. Logs never include what you entered, and never record invite, email-preference or request-form addresses. To stop abuse we keep short-lived counters keyed by your IP address or a hash of your email address. To make sync reliable, the server keeps the answer to each change you send for 7 days, so a retried request isn't applied twice.
Requests from people cared for: who is asking (the person or someone acting for them), their name and reply email, how to find the circle, what they ask for, and their country.
The iPhone waitlist: if you leave your email on an invite page to hear when the iPhone app is out, we keep only that email, a hash of the invite link, the version of the consent text you ticked and the time: no name, circle or IP address. We send one email when the iPhone app is out and then delete the address, at the latest 12 months after you left it.

Exports are made on your phone. "Download my data" and a circle's export are built on your phone and saved or shared where you choose; we don't keep a copy.

No analytics, no ads, no sale. The app has no analytics or advertising tools and sends no usage events. To learn whether Evenhand works for families, and to watch the number of users per country for the law of each country, we count from our own database: numbers only, with no names, content or identifiers. We show no ads, we don't sell or rent your data or share it for advertising, and Evenhand uses no technology to locate or profile you.

Why, and on what basis

To provide Evenhand (your account, sign-in, sync between the circle's phones, notifications and emails about the circle, the weekly digest, and account deletion): necessary to perform our contract with you (the terms). You can turn each kind of notification and email off in More › Notifications, or with the link in any email.
The records about the person cared for: we treat them as sensitive, because an appointment can show the care someone receives. We hold them for the family on the basis the circle's Owner confirmed (their agreement, written authority, or acting in their interest as their carer, where that is allowed), which the app records per circle with a date and policy version.
To keep Evenhand secure and working (logs, abuse counters, backups) and to count how it is used (numbers only, as above): our legitimate interest in a reliable, secure service that works for families.
To find and fix crashes (crash reports): your consent, which you give by turning on "Send crash reports". You can withdraw it at any time with the same switch.
To meet legal obligations, such as answering a lawful request or keeping records we must keep.

Under Malaysia's Personal Data Protection Act 2010, we process your data with your consent, which you give by signing in and using Evenhand (and, for crash reports, by turning them on), or where it is necessary for our contract with you. You can withdraw your consent by turning off crash reports, turning off notifications or deleting your account.

In the European Economic Area, the United Kingdom and Switzerland, our legal bases are the ones named in the list above: our contract with you, our legitimate interests, your consent and legal obligations. For the records about the person cared for, which can reveal health information, we rely on that person's explicit consent (given by them, or by someone with authority to give it for them), or, where they can't consent, on the care exemptions those laws allow.

Your email address is needed only to sign in. Everything else you add is up to you. We send no marketing email.

Where it is stored

Our server and its backups are in Indonesia, with our hosting provider Hostinger. Resend and Google may process data in the United States and other countries. So your data is processed outside the country where you live. While it is there, it is subject to that country's laws, and its courts, law enforcement and national security authorities may be able to obtain it.

We send it there because that is necessary to provide Evenhand to you, and our providers may use it only to provide their service to us. If we move our server to another country, we will update this section before the move.

When data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, our providers protect it with the standard contractual clauses approved for that purpose (or the EU-US Data Privacy Framework, where the provider is certified under it).

How long we keep it

Account and records: until you, or the circle's Owner, delete them.
Deleted entries: hidden at once. Deleted costs and settle-ups stay in the circle's history, marked as deleted, so the money record keeps adding up. Other deleted entries are removed after 91 days (the delay lets every phone in the circle catch up).
A member who leaves or is removed: their entries stay in the circle with their name and "(left)".
A deleted account: your profile, phones and settings are deleted at once. Your entries stay in the circles as "Former member". A circle only you were in is deleted. A circle you own with others starts closing (read-only for 14 days so everyone can export, then deleted), unless you first make someone else Owner.
An archived circle: kept, read-only, until its Owner deletes it, with a yearly reminder email to the Owner.
A deleted circle: at once if no one else is in it; otherwise after 14 days of closing.
Backups: nightly, kept on the server for 7 days; a copy kept anywhere else is encrypted first. Deleted data leaves every backup within 35 days.
Sign-in codes: work for 10 minutes and are deleted within 24 hours.
Server logs: 30 days. Abuse counters: 48 hours.
Push tokens: until you sign out, delete your account, or the push service tells us the token no longer works.
Requests from people cared for: the requester's contact details, 90 days after we finish; the record that we handled the request, two years.
The iPhone waitlist: until we send the one iPhone email, at the latest 12 months.
Crash reports: 90 days, at Crashlytics.
Usage counts: kept, because they contain no personal data.

Your rights

Depending on where you live, you can ask to access, correct or delete your data, to receive a copy (including sent to another service where that is possible), to restrict or object to how we use it, to withdraw consent, and to complain to your data protection authority (for example the Personal Data Protection Commissioner in Malaysia, the Personal Data Protection Commission in Singapore, the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information in Quebec, the Office of the Australian Information Commissioner, the Privacy Commissioner in New Zealand, the National Privacy Commission in the Philippines, the Information Regulator in South Africa, the Data Protection Board of India, or the Data Protection Authority of Sri Lanka; in the European Economic Area, the United Kingdom and Switzerland, the supervisory authority where you live or work; anywhere else, your local data protection authority). Most of it you can do in the app:

A copy of your data: More › Account › Download my data.
Correct: edit any entry, or your name in More › Account.
Delete: More › Account › Delete account; or without the app, on our deletion page.
Notifications and emails: More › Notifications, or the link at the bottom of any email.
Withdraw consent to crash reports: turn off "Send crash reports" in More › Privacy and about.

For anything else, write to the privacy contact, from your account's address if it is about your account, so we know the request is yours. We reply within 21 days (15 days in Brazil). If you are the person a family cares for, or act for them, you can ask us too. If someone stored your details as a contact, write to the privacy contact above and we will tell you what is held and remove it.

Adults only

You must be 18 or older to use Evenhand, and it isn't designed for children. If we learn that a child has an account, we delete it, and we always do so for a child under 13.

Security and breaches

All connections use HTTPS. Sign-in codes, sessions and invite links are stored only as hashes, and a backup copy kept off the server is encrypted first. Access to the server is limited to the people who run Evenhand. Your records are not end-to-end encrypted: the server can read them so that it can check, sync and count them.

We keep a record of every breach. If a breach puts personal data at risk, we notify the regulator within 72 hours where the law requires it, and the people affected as soon as practicable; we reach a person cared for through their circle's Owner.

Changes and contact

This is policy version 1; the confirmation each circle records names the version it was given under. If we change this policy in a way that matters, we will say so in the app or by email before the change applies. Questions: the privacy contact, Ahrar Ghayyem, support@hoppr.online, No. 3500, Jalan Teknokrat 3, 63000 Cyberjaya, Selangor, Malaysia; or write to Ahrar Ghayyem, trading as Hoppr Apps, No. 3500, Jalan Teknokrat 3, 63000 Cyberjaya, Selangor, Malaysia.