Privacy Policy

1. Controller

The controller responsible for data processing on this website pursuant to Art. 13(1)(a) GDPR is:

2. What Data We Collect

When you use Evolve Performance, we collect the following data:

• Discord account information: User ID, username, and avatar (provided via Discord OAuth2)
• System specifications: CPU, GPU, RAM, motherboard, storage, and cooler details you submit during checkout
• Purchase records: Plan purchased, transaction ID, payment amount, currency, and email address associated with payment
• Support ticket references: Discord channel IDs for your support tickets
• Hardware ID (HWID): A unique identifier derived from your hardware configuration, used for license activation and binding
• Cryptocurrency payment data: If you pay with cryptocurrency, we store the payment amount, cryptocurrency type, and transaction reference for tax and accounting purposes
• Newsletter subscription: If you opt in to our newsletter, we store your email address, a record of your consent (the timestamp, the IP address the opt-in was submitted from, and the version of the consent text you agreed to), and the single-use welcome discount code issued to your account. You opt in explicitly and must confirm via a double opt-in email before you receive anything.

3. Why We Collect This Data

We process your data based on the following legal grounds (GDPR Art. 6):

• Contract fulfillment (Art. 6(1)(b)): Discord OAuth2 authentication, system specs processing, purchase record management, license activation, and support ticket creation
• Contract fulfillment (Art. 6(1)(b)): Avatar storage for user profile display
• Legitimate interest (Art. 6(1)(f)): Fraud prevention via HWID binding (one license per device), purchase record maintenance for accounting and support
• Contract fulfillment (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)): Product analytics via PostHog (EU Cloud). After you log in, events are pseudonymous - keyed to your Discord user ID rather than anonymous. We rely on Art. 6(1)(b) for the events needed to deliver and diagnose the service, and on Art. 6(1)(f) for product-improvement analytics. On the website, PostHog is still only activated once you accept in our consent banner ("Analytics"); you can withdraw consent at any time via the Cookies link in the footer.
• Legitimate interest (Art. 6(1)(f)): Cookieless, self-hosted Umami website analytics. No consent required - see the Umami entry under Third-Party Services.
• Consent (Art. 6(1)(a)): Newsletter delivery. You opt in explicitly and confirm via a double opt-in email before we send anything. You can withdraw your consent at any time using the unsubscribe link in every email, with no effect on any other processing.

4. Third-Party Services

We share data with the following third parties, only as needed to provide our services:

• Creem - Payment processing and affiliate referral tracking. Receives your email and payment details. If you arrive at our site through an affiliate link, Creem sets a cookie on your device to attribute any subsequent purchase to the referring affiliate (180-day duration). The cookie stores only the referral identifier - no personal data is collected beyond the attribution. Creem acts as Merchant of Record and handles tracking, attribution, payouts, and compliance automatically. Registered in Estonia (EU). No third-country transfer.
• Discord - Authentication and support delivery. We access your public profile via OAuth2 and create support tickets in our server. Registered in the US. Transfer safeguard: EU-US Data Privacy Framework.
• Brevo (Sendinblue SAS) - Email service provider for our newsletter, including the double opt-in confirmation email and the welcome email. Receives your email address and the single-use welcome code to be delivered, and processes them only on our instructions under a Data Processing Agreement pursuant to Art. 28 GDPR. Registered in France (EU). No third-country transfer.
• Vercel - Hosting provider. Processes HTTP requests and logs. Serverless functions run in Frankfurt, Germany (fra1). Vercel Speed Insights collects anonymous performance metrics (Core Web Vitals: LCP, INP, CLS) to monitor site performance under legitimate interest (Art. 6(1)(f) GDPR). No cookies, no personal identifiers, no cross-site tracking. No third-country transfer.
• NOWPayments - Cryptocurrency payment processing. Receives payment amount, currency, and order reference. Registered in the Netherlands (EU). No third-country transfer.
• Netcup GmbH - Server hosting provider. Our PostgreSQL database and backend API run on Netcup infrastructure. Stores purchase records, system specifications, license keys, and support ticket references. Registered in Germany. No third-country transfer.
• Umami - Privacy-friendly website analytics (self-hosted on our own Netcup server in Germany). Cookieless and first-party - no consent is required, as it runs under legitimate interest (Art. 6(1)(f) GDPR). Collects anonymous page view data (page URL, referrer, browser, OS, screen size). No personal data, no cookies, no cross-site tracking. Respects the Do Not Track browser signal. All data stays on our server in Germany. No third-country transfer. You can object at any time (Art. 21 GDPR):
• PostHog - Product analytics (PostHog Cloud EU, hosted in Frankfurt, Germany on AWS eu-central-1). On the website, activated only after you allow "Analytics" in our consent banner. Collects page views and specific conversion events (plan interest, checkout step progression, FAQ expansion, download clicks). Before you log in these events are anonymous; once you log in they become pseudonymous, keyed to your Discord user ID so we can deliver and diagnose the service and improve the product. Legal basis: Art. 6(1)(b) GDPR for events needed to deliver and diagnose the service, and Art. 6(1)(f) for product-improvement analytics. Purchase completion events are additionally sent server-side to PostHog, keyed to your Discord ID, so a completed purchase is recorded even if your browser blocks client-side analytics. IP addresses are discarded server-side at the PostHog ingest endpoint (project setting "Discard client IP data"). No autocapture, no heatmaps, and no session replay. Do-Not-Track browser signal is honored. Operated by PostHog Inc. (US) under a Data Processing Agreement per GDPR Art. 28; EU Cloud data stays in Frankfurt. No third-country transfer.
• X Corp. / Twitter International Unlimited Company - X (Twitter) Ads conversion tracking. On the website, activated only after you allow "Marketing" in our consent banner. Twitter International Unlimited Company (Dublin, Ireland) is the EU controller for X Ads. Used to measure our ad campaigns by attributing completed purchases back to ad clicks. Data shared: an ad-click id ("twclid") from the ad-click URL, cookies/identifiers the pixel itself sets, a SHA-256 hashed version of your email address at the time of purchase (never the raw address), the order id, and the purchase value and currency. Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (consent) - revocable at any time via the Cookies link in the footer. Involves a third-country transfer to the US; we have not verified a specific transfer-safeguard mechanism with X for this data flow - contact support@evolveperf.com for details. See X's own privacy policy: x.com/en/privacy.

5. Desktop Application (Evolve Optimizer)

The desktop application processes the following additional data. Its EULA describes feature-specific risks and processing in more detail. Accepting that agreement is not blanket consent to personal-data processing. Required consent must be obtained separately; legitimate interests under GDPR do not replace consent required by § 25 TDDDG.

• Hardware identifiers: Where available, the TPM public endorsement key, SMBIOS system UUID, motherboard and RAM serial numbers, and a random local device token are hashed on the computer with a fixed salt using SHA-256. Separate hashes and a composite identifier are transmitted for license validation and device recognition, including after Windows reinstalls. These are pseudonymous personal data linked to the account, not anonymous data. Raw values are not sent through this identifier mechanism; a BIOS export may separately contain them. Contractually necessary authentication uses Art. 6(1)(b); proportionate fraud prevention uses Art. 6(1)(f), subject to the right to object.
• System specifications: CPU/GPU models, RAM details, motherboard and firmware details, Windows edition/version/build, storage models/capacities, supported USB cooler model and a specifications hash are transmitted during authentication. Specifications may be added to Discord support tickets and associated with benchmarks. Art. 6(1)(b) applies only to processing objectively necessary for requested delivery or troubleshooting; separate product improvement relies on Art. 6(1)(f) where its requirements are met.
• BIOS/UEFI exports: When you initiate this feature, NVRAM data is sent for preset processing or an ordered manual service. It includes firmware settings and may contain raw hardware identifiers. Support exports may be attached to Discord tickets. Profiles, optimized files and historical archives are retained as described below. Transmission relies on separate consent under Art. 6(1)(a). You may decline or withdraw consent for future processing; this prevents processing your BIOS configuration but does not remove unrelated access.
• Credentials and updates: Local credentials use Windows DPAPI encryption. Authentication information is also transmitted to our servers as needed to validate access; it is not confined to the device. Update checks contact our servers and disclose ordinary connection information such as an IP address.
• Benchmarks and screenshots: We receive selected game executable names, performance metrics, optimization status and relevant hardware specifications. RAM Stability results include duration, errors, cycles, configuration/tool version and automatic or manual confirmation. These records are associated with your license/account. You can also submit a screenshot from a file or clipboard; the image is processed and stored with account, game, before/after stage and submission metadata. Inspect and redact unrelated personal content before sending. Some optimization flows require a qualifying before-benchmark or screenshot; declining both can block that flow. This prerequisite does not itself establish a legal basis for analytics or remove rights concerning functionality already purchased. Necessary result delivery uses Art. 6(1)(b); separate improvement analysis uses Art. 6(1)(f) only where justified, subject to objection and any required consent.
• Diagnostics and applied changes: Logs contain actions, outcomes, timings, errors and script output, potentially including file paths and application names. Diagnostics can cover startup/authentication failures. Separate records identify applied/restored optimizations, times and relevant options; temporarily queued records are sent after sign-in. They support diagnosis and restoration. Art. 6(1)(b) applies only to objectively necessary delivery/troubleshooting; proportionate service-security processing uses Art. 6(1)(f).
• Usage and antivirus detection: Authenticated usage events include app launch, page navigation, optimization progress/errors, restart/benchmark milestones, version/tier and detected third-party antivirus names. They are forwarded to PostHog EU using your Discord ID or a stable license-derived identifier. Product-improvement processing relies on Art. 6(1)(f) only where our interests in identifying faults and improvements are not overridden by your rights. The client has no general in-app analytics switch. You may object on grounds relating to your situation by emailing support@evolveperf.com; we must stop processing unless the statutory grounds for continuing apply. An email requires operational handling and does not itself change client settings. Privacy requests do not remove unrelated purchased functionality.
• Redistribution identifiers: Some game-mod files contain an account-linked token. Its account association and download records support investigation of unauthorized redistribution under Art. 6(1)(f), subject to objection. A matching token alone is not conclusive proof of a breach.
• Evolve Discord status (optional): Switched on once automatically after your first successful optimization. While you play a game from Discord's public game list, your own Discord profile shows that game with "Enhanced by Evolve"; nothing is shown while you are not in a game. A small background helper checks running program names for this and sends an anonymous daily usage ping (a random install ID, the app version, whether the status is on, the number of connected Discord clients and whether a game was running). When a fullscreen program is not a known game, it also sends that program's file name and the product and company name stored in the file, so we can add missing games. It never sends file paths, window titles or content. You can turn this off at any time on the Startup Manager page; it then stays off.

Application detection can therefore disclose antivirus or selected game/application names; it is not all confined to the computer. These features do not record browsing history, keystrokes, private messages or a general history of activity in other applications. Content you submit or show during a requested remote-support session may contain such information. EU hosting does not exclude all processing outside the EEA. International transfers require an applicable adequacy decision or appropriate safeguards; the EU-US Data Privacy Framework applies only to validly certified recipients and covered processing. Contact support@evolveperf.com for transfer details and copies of applicable safeguards.

6. Data Retention

• Rows in the client_logs diagnostic database are scheduled for deletion after seven days. Separate tickets, incident records, submitted files and backups have their own purposes.
• License, hardware, redistribution-identifier and applied-change records are kept as necessary for agreed access, system-state display, restoration, an ongoing support matter or a specific misuse investigation. Account deletion or the end of the relevant service requires an erasure assessment.
• BIOS profiles include historical snapshots and periodic archives; they are not automatically deleted after thirty days. Retention must be limited to the requested BIOS service, restoration or an ongoing support matter, considering whether an earlier configuration is still needed. Archiving does not authorize indefinite retention.
• Linkable analytics, benchmark records and screenshots must be erased or irreversibly anonymized when no longer necessary for the disclosed support, comparison or improvement purpose. An open account alone does not justify indefinite event retention.
• Purchase/accounting records are kept for the applicable statutory periods. Necessary evidence for a specific legal claim may be kept for that purpose, restricted accordingly. These exceptions do not justify keeping unrelated technical records.
• Newsletter data is kept until unsubscribe or consent withdrawal. Necessary consent evidence may be retained to demonstrate lawful processing or address legal claims.

Erasure handling must cover applicable processor copies and archives. Copies temporarily remaining in disaster-recovery backups must not be used for ordinary processing, and erasure must remain effective following restoration. Uninstalling or signing out does not itself delete server records. Contact support@evolveperf.com for erasure or the criteria applying to your records. This revision does not retroactively extend earlier binding retention commitments or authorize previously unlawful retention.

7. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): You can export all data we store about you from your profile page.
• Right to erasure (Art. 17): You can delete all your data from your profile page. This removes your purchase records from our database.
• Right to rectification (Art. 16): You can request correction of inaccurate personal data.
• Right to restriction of processing (Art. 18): You can request restriction of processing under certain conditions.
• Right to data portability (Art. 20): Your data export is provided as a standard JSON file.
• Right to lodge a complaint: You have the right to lodge a complaint with the Hessischer Beauftragter für Datenschutz und Informationsfreiheit.

8. Automated Decision-Making

No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

9. Cookies & Local Storage

We use the following cookies:

• evolve_session - httpOnly session cookie for authentication. Contains a signed token, is not readable by client-side JavaScript, expires after 7 days, and is cleared when you log out.
• evolve_consent - Stores your "Analytics" consent choice (PostHog; allowed or rejected). Expires after 365 days. Required for GDPR compliance - not gated behind consent itself.
• evolve_ad_consent - Stores your consent choice for X (Twitter) ads conversion tracking ("Marketing"), set separately from Analytics under Customize, or together via Accept all / Reject all buttons. Expires after 365 days. Not gated behind consent itself.
• evolve_twclid (local storage) - Only after you allow Marketing: the X ad-click identifier from the link you arrived on, kept for up to 30 days so a purchase can be attributed to that ad. Removed when you reject.
• Affiliate referral cookie - Set by Creem only when you arrive via an affiliate referral link. Stores the referral identifier to attribute your purchase to the referring affiliate. Expires after 180 days. Legal basis: legitimate interest (Art. 6(1)(f)). Not gated behind consent as it serves a contractual attribution purpose, not behavioral profiling.
• evolve_ref - First-party cookie set only when you arrive via a creator link (e.g. evolveperf.com/<creator>). Stores the creator's short name so the page can greet you accordingly and so we can see which creator referred a new account. Expires after 60 days. Legal basis: legitimate interest (Art. 6(1)(f)). Not gated behind consent, as it only stores the referral and is not used for behavioral profiling.

We also use browser localStorage to cache minimal display data (plan names, dates) for faster page loads - this data never leaves your device and is cleared on logout. Apart from the cookies the X pixel sets once you allow Marketing, no third-party tracking cookies are used.

10. Contact

For any privacy-related questions or to exercise your rights, contact us at: support@evolveperf.com or through our Discord server.