🔒 Privacy Policy

Privacy Policy

This Privacy Policy explains how Ervun (“Ervun”, “we”, “us”, or “our”), a service operated by LeyLance, a sole proprietorship based in Ontario, Canada, handles information in connection with the Ervun mobile app (the “App”), the Ervun Windows agent (the “Agent”), and our website at ervun.com (together, the “Service”).

Ervun is a zero-knowledge, consent-based anti-theft and remote-control system for devices you own or are explicitly authorized to control. Privacy isn’t a feature we added — it’s how the product is built.

1. Our zero-knowledge model

Ervun acts as an encrypted relay between your phone (the controller) and your enrolled devices. The heavy lifting — key derivation, encryption, and command signing — happens on your devices, not on our servers.

CANNOT SEE We cannot access: your passphrase; your encryption keys (stored only wrapped/encrypted); the contents of your vault (e.g. screenshots and webcam captures); or the files you transfer. These are encrypted on your device with keys only you hold, and reach us solely as ciphertext.

CAN SEE To operate the relay, we do process: your account email; your device names and technical metadata; which commands you issue and their timing/status; and messages you send through device chat (device chat is protected in transit but is not end-to-end encrypted — treat it as operational messaging and don’t put secrets there).

Not covert. Ervun is designed for devices you own or are explicitly authorized to control. The Ervun agent is installed with your consent and is identifiable on the device it runs on — Ervun is not, and must not be used as, covert surveillance or “stalkerware” (see our Terms of Service).

2. Information we collect

a. Information you provide

• Account email address — used to create and sign in to your owner account. Your login credential is a key derived from your passphrase on your device; we never receive the passphrase itself.
• Device names and labels you choose when enrolling a device.
• Support communications — if you email us, we receive your message and contact details.

b. Encrypted content (ciphertext only)

• Vault items (encrypted captures such as screenshots and webcam photos) and their metadata.
• Transferred files, uploaded as encrypted chunks. Files pushed to a device are deleted from our storage after delivery.
• Wrapped private keys — your account and owner keys, stored only in passphrase-encrypted form.

We store these as encrypted blobs and cannot decrypt them.

c. Device and usage data

• Device records: a device identifier, a hardware fingerprint (used to prevent an enrollment being cloned to another machine), the device’s public key (used as an encrypted push target), operating-system information, and online/idle/offline status with last-seen timestamps.
• Enrollment codes you generate to add a device.
• Commands you issue (for example lock, locate, capture, transfer, or wipe), including the command type, timing, schedule, and result/acknowledgement status. Destructive commands carry a signature created on your device.
• Device chat messages exchanged between your controller and a device.

d. Technical and security data

• IP address, used transiently for rate-limiting and abuse prevention during registration and device enrollment. Rate-limit records are automatically purged (typically within a day).
• Security and audit logs of sensitive events (e.g. administrative actions), retained for a limited period.

e. Subscription data

• If you buy Ervun Premium, our subscription provider RevenueCat and the relevant app store process the purchase. We receive your entitlement status (e.g. active/expired and renewal date) tied to a pseudonymous identifier matching your account. We never receive your payment card or bank details — those are handled by Apple or Google.

3. How we use information

• To provide the Service — authenticate you, enroll and manage devices, relay signed commands, deliver encrypted captures and file transfers, and pass device chat messages.
• To operate subscriptions and unlock Premium features.
• To keep the Service secure — enforce rate limits, detect and prevent abuse, and (where you request it) revoke a lost or stolen device.
• To provide support and respond to your requests.
• To comply with legal obligations and enforce our Terms of Service.

4. Legal bases (EEA/UK users)

Where the EU/UK GDPR applies, we rely on: performance of a contract (to provide the Service you sign up for); legitimate interests (securing the Service and preventing abuse); consent (where required, e.g. optional communications); and legal obligation (to comply with applicable law).

5. How information is shared

We do not sell or share your personal information — including as the terms “sell” and “share” are defined under the California CCPA/CPRA. We share information only with service providers (“sub-processors”) that help us run Ervun, and only as needed:

Provider	Purpose
Supabase	Cloud hosting of our database, authentication, encrypted storage, and backend functions.
RevenueCat	Subscription management and entitlement analytics.
Apple App Store / Google Play	App distribution and payment processing for subscriptions.

We may also disclose information if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (with notice where required).

6. Where data is stored

Our infrastructure is hosted in the United States. If you access Ervun from outside the United States, your information will be transferred to and processed there. Where required, we rely on appropriate safeguards for international transfers, such as the European Commission’s Standard Contractual Clauses and, for UK personal data, the UK International Data Transfer Agreement (IDTA) or Addendum. Note that your encrypted content remains ciphertext wherever it is stored.

7. Data retention

• Account data and enrolled devices — kept while your account is active; removed when you delete them or close your account.
• Encrypted vault items — kept until you delete them or close your account.
• Transferred files — deleted from our storage after delivery to the target device.
• Enrollment codes, rate-limit records, and one-time security tokens — short-lived and automatically purged (typically within days).
• Security/audit logs — retained for a limited period (up to around one year) then purged.

8. Your rights and choices

Depending on where you live (for example under the GDPR or the CCPA), you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You also have the right not to receive discriminatory treatment for exercising these rights.

You can exercise many of these directly in the App (edit device names, delete vault items and files, de-enroll or revoke devices). For anything else, contact support@ervun.com and we will respond as required by law.

EEA / UK users. You also have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk), although we’d appreciate the chance to resolve your concern first.

California users. You have the right to know, access, delete, and correct your personal information and to not receive discriminatory treatment for exercising your rights. As noted above, we do not sell or share your personal information, so no “Do Not Sell or Share My Personal Information” action is required.

Canada. Ervun is operated from Canada, and our handling of personal information is subject to Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). You may access and request correction of your personal information, and you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) about an unresolved concern.

9. Account deletion

You can permanently delete your entire account and its associated data at any time, directly in the App: Settings → Delete my account. This removes your account, enrolled devices, captures, transfers, and messages. You can also request deletion by emailing support@ervun.com from your account email address, or via ervun.com/delete-account. We delete your account and associated records except where we are required to retain limited information to comply with law or prevent abuse.

10. Security

Security is central to Ervun. We use client-side encryption, wrapped key storage, per-device access isolation, cryptographically signed destructive commands, and encryption in transit (TLS). If you report a device as lost or stolen, you can revoke it, which immediately blocks its access. No system can be guaranteed 100% secure, and you are responsible for safeguarding your passphrase and your devices.

11. Children’s privacy

Ervun is not directed to children. You must be at least 16 years old (or the age of digital consent in your country, and in any case at least 13) to use the Service. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact support@ervun.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the App or by email. Your continued use of the Service after an update means you accept the revised policy.

13. Contact us

Questions, requests, or privacy concerns? Contact us at:

LeyLance — Ervun
Email: support@ervun.com
Postal address: Oshawa, Ontario L1L 0W3, Canada

---

See also our Terms of Service.