This policy is published under the Washington My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (NRS 603A.400 to 603A.550, including the notice requirement at NRS 603A.495). It covers only the limited information we hold that could identify your health status, which we call consumer health data on this page. One document serves both states. Everything else about how My Evening handles data is in our Privacy Policy.
1. Who We Are
My Evening is operated by Ivan Sokalskyi, trading as My Evening, a sole trader (jednoosobowa działalność gospodarcza) registered in Poland, ul. Edwarda Abramowskiego 45, 51-663 Wrocław, Poland. NIP 8982299245 · REGON 526716694.
For anything on this page, including any of the rights in section 5, write to privacy_myevening@rongan.me or to the postal address above.
2. The Consumer Health Data We Collect, Where It Comes From, and Why
There are two. In both cases the source is you: you type it, you say it, or you tap it in the app. The one exception is Apple Health, described in the second entry, and that happens only if you ask for it.
What you write or say in your journal
What it is. Your gratitude entries and tomorrow's plan are free text. Most of what people write is not about health at all, but free text can be, and when an entry describes how you slept, how you felt, or a health event in your life, that entry is consumer health data.
Where it comes from. You, in the app: typed, or dictated with your microphone if you choose to speak instead of type.
Why we collect it, and how it is used. To deliver the features you asked for: saving your entry, showing you your own history, turning speech into text, and suggesting which of the people already in your list you were thanking. The two features that carry it off your device run only after you agree to them when you set the app up, by tapping Agree and continue beneath a statement of what is sent and where, and you can turn them off at any time in Settings under AI features. We do not use it to train any model of our own.
Where it is kept. On your device and in your own iCloud. We do not currently store it on our servers. Two features do send parts of it off your device in order to work, and we would rather you knew exactly how far it travels:
- When you save a gratitude entry, up to the first 1,000 characters of that entry, together with the names and nicknames already in your people list, pass through our servers to our AI processing provider so it can suggest who you were thanking. The provider keeps each request for at least 30 days, and during that period we may review it to work out why a suggestion was wrong.
- When you dictate, your microphone audio streams through our servers to our speech-to-text provider and comes back as text. Dictation is optional; typing keeps your voice on your device.
The bedtime you set
What it is. The time you tell the app you go to bed.
Where it comes from. You set it during setup. If, and only if, you grant permission, the app reads your recent sleep from Apple Health once, on your device, to pre-fill a suggested time you can accept or change. The Apple Health records themselves stay on your device and are not sent to us. But because the bedtime you end up with may have started as an Apple Health reading, we treat it as consumer health data.
Why we collect it, and how it is used. It schedules your evening reminder and decides when your evening window opens and closes.
Where it is kept. On your device and in your own iCloud. A 15-minute slot of it (not the exact minute, not a date, not an Apple Health record) is included in the usage summary our servers receive after each completed evening, so we can tell how often people finish before, inside, or after their own window. That summary is keyed to a random identifier created the first time the app is opened on a device; it is deliberately not sent with, or stored beside, your account identifier, but it is a persistent identifier and we therefore describe it as pseudonymous.
3. Who We Disclose It To
We disclose consumer health data only to service providers that process it on our instructions, under a written contract, and that may not use it for their own purposes. There are three categories:
- An AI processing provider: receives the text described in section 2 in order to suggest who you were thanking.
- A speech-to-text provider: receives your microphone audio, while you are dictating, in order to turn it into text.
- A cloud hosting provider: runs the servers the other two are reached through.
The current providers are named, dated and kept up to date on our Sub-processors page, together with each one's location, contracting entity and transfer mechanism. If you ask us for the list under section 5, we will name them to you directly. We have no affiliates.
Our position on "sharing", stated openly. Washington's definition of "share" at RCW 19.373.010(26)(b) excludes disclosure to a processor that processes consumer health data on the regulated entity's behalf. Every disclosure described above is to such a processor, so our position is that we do not "share" consumer health data as the Act defines it. We record that position here rather than leaving it unstated, because it is the reason this policy does not describe a sharing-consent process.
4. We Do Not Sell Consumer Health Data
We do not sell consumer health data, for money or for anything else of value, and we have never sold it. A sale would require a signed, dated, one-year, revocable authorization from you under RCW 19.373.070, which we have not sought.
5. Your Rights, and How to Exercise Them
If you are a Washington or Nevada resident, you may ask us to:
- Confirm and give you access. Tell you whether we collect, share or sell your consumer health data, and give you access to it, including a copy.
- Name the third parties. Give you a list of all third parties with whom we have shared your consumer health data, with a way to contact each one.
- Withdraw your consent. Withdraw consent to our collecting or sharing your consumer health data.
- Delete it. Have your consumer health data deleted.
How to ask. Email privacy_myevening@rongan.me, or write to the postal address in section 1. There is no form to fill in and you do not have to give a reason.
How we check it is you. We hold no name, no email address and no password for you: there is no account to log into. So that we answer the right person, open the app and go to Settings → Support ID, tap to copy the identifier shown there, and include it in your message. If you cannot reach the app, tell us and we will work out another way; we will not ask you for more personal information than the request needs, and anything you send us for verification is used only for that.
How long we take. We answer within 45 days of receiving your request. Where it is reasonably necessary, we may take one further 45-day extension; if we do, we will tell you within the first 45 days, and why.
What deletion means here. If you ask us to delete, we delete your consumer health data from our records and from all of our systems, including any archived or backed-up systems. We also notify every service provider and third party we disclosed it to, and direct them to delete it as well; they are required to honour that within 30 days of our notice. We confirm to you when it is done. Deleting your account in the app (Settings → Delete Account) does the same thing for the data held under your account identifier, and clearing your data in the app also gives the device a new per-installation identifier, so nothing further is attached to the old one.
One limit we would rather state than hide. The usage summaries that carry the 15-minute bedtime slot described in section 2 are keyed to a per-installation identifier the app does not display, so we may be unable to locate one person's rows on request; where that happens we will tell you so plainly, and those records age out on their own. Withdrawing your consent to the two AI features is in your own hands: turn them off in Settings under AI features and dictation and person suggestions stop at once, while typing keeps working. Dictation alone you can also stop by typing instead of speaking, and then no audio leaves your device.
If we say no. If we decline a request, we will tell you why within the same 45 days, and you may appeal by replying to the same address with the word "appeal". We will review the appeal and give you a written answer, with our reasons, within 45 days of receiving it. If we still say no, you can complain to the Washington State Attorney General at atg.wa.gov/file-complaint, or to the Nevada Attorney General at ag.nv.gov. You can complain to either office at any time; you do not have to come to us first.
6. Changes to This Policy
RCW 19.373.020(2) prohibits us from collecting, using or sharing any category of consumer health data not disclosed above without first disclosing it here and obtaining your affirmative consent. When this policy changes we update the effective date at the top of the page, and the change applies from that date forward.
