Privacy & your information
Foreday Consumer Health Data Privacy Notice
Effective 15 October 2026.
This notice explains how Evenstead Software Pty Ltd (“we”, “us” or “our”) handles consumer health data in connection with Foreday where US state consumer health privacy laws apply. It supplements our Privacy Policy.
Foreday is a budgeting app. Health information may appear in transaction descriptions, categories, notes or support messages that you or another budget member provides. You do not need to give us a diagnosis or detailed medical history to use ordinary budgeting features.
Foreday is currently a development service. It does not have a dedicated health profile, health-data import or separate health-data consent control. Please avoid unnecessary health details, especially information about another person. A feature requiring additional consent must have that consent process before it is offered; this notice is not a substitute for consent.
Information covered by this notice
Consumer health data can include information linked to an identifiable person that reveals their physical or mental health. In Foreday, this may include details about health services, treatment or prescribed medication entered in a financial record or support message, together with related descriptions, dates and amounts.
We receive this information from:
- Records you enter or import.
- Messages and attachments you send to support.
- Shared records entered by another budget member.
Please avoid including unnecessary health details about yourself or anyone else. Another member’s ability to enter a shared record does not give them unrestricted authority to consent on your behalf.
How we use this information
We use covered information to provide the specific budgeting or support service requested by the person concerned, including storing and synchronising a record, displaying it to authorised people and responding to a support request.
We process consumer health data on a basis permitted by the applicable law, such as necessity to provide the requested service or valid consent. Where consent is required, we obtain it before collection and obtain separate consent for sharing where required. Acceptance of our general Privacy Policy does not replace that consent.
You can withdraw consent by contacting us. We will explain any effect on a feature that depends on the information.
We do not sell consumer health data or use it for advertising or marketing tracking.
When information is disclosed
The categories of information described above may be processed or disclosed as follows:
Hosting and synchronisation providers. Google Firebase and Google Cloud process records stored in synced budgets, including any health information entered in those records.
Support-email provider. Google Workspace processes support correspondence and attachments, including health information a sender includes.
Problem-report email delivery. Resend processes the text and optional device details in an in-app problem report to deliver it to our support mailbox. It also sends a confirmation to the reporter's verified email address. The confirmation does not repeat the report text. Budget records are not automatically attached to a problem report.
Other budget members. Shared records can be visible to members of the same budget. Only you records are protected from those other members, including the budget owner.
Recipients you choose. Files or messages you export or send may include health information contained in those records.
We apply the legal requirements relevant to each disclosure, including the distinction between contracted processors and other recipients. We may also disclose information to meet a legal requirement to the extent permitted or required by applicable law.
Identifiable health information and real budget content are removed before support reports are copied to Notion or ChatGPT. Customer health records are not included in our source-code repository.
Your rights and requests
Contact Support@EvensteadSoftware.com to request access to covered information, details of relevant recipients, withdrawal of consent or deletion. We verify identity proportionately without requiring you to create a new account.
Requests currently require manual review and action. In-app account deletion is planned for public launch and is not yet available in development builds. Our deletion-request page explains how to contact us now. The cloud budget database and stored support tickets are in Sydney, Australia; Firebase Authentication and Resend process information in the United States, and support and hosting providers may also process information elsewhere as described in our Privacy Policy and Website Privacy Notice.
For covered Washington requests, we respond within 45 days of receipt and explain any permitted extension. If we refuse a request, you can appeal by replying to the decision or emailing us. We provide a written appeal outcome within 45 days and, if the appeal is denied, a route to complain to the Washington Attorney General.
Deletion includes information held by us and steps required of recipients and processors. Any permitted delay for deleting archived or backup copies is limited to six months from authentication of a covered Washington deletion request.
Other applicable laws may provide different or additional rights and deadlines. We apply the relevant requirements and do not unlawfully discriminate against you for exercising a right.
Retention of shared accounting records does not override a mandatory right to delete consumer health data.
Changes to this notice
We update this notice when relevant practices or legal requirements change. We obtain any required consent before collecting or sharing additional categories of consumer health data or using it for additional purposes.
Contact us
Evenstead Software Pty Ltd