Evernote is a productivity platform that providers users with note, tasks, and scheduling capabilities. The privacy policy indicates that Evernote monitors communications between Evernote users and will block delivery of messages or material if it violates Evernote’s Terms of Service or User Guidelines. The Privacy Policy clearly states that Evernote may collect the user's information, including email addresses, billing addresses and other payment information, usage data, location information, IP addresses, and device information. The Region-Specific Privacy Policy aptly discloses the categories of information disclosed to third parties, and the privacy policy does provide methods for users to opt out of certain ad targeting and retargeting services. The Security Overview Policy says that Evernote integrates current security practices and encrypts user data both in transit and in storage. Lastly, the terms disclose that Evernote is not directed to minors, however, that any use by minors should only be done with the guidance, supervision, and consent of their parents, guardians, and/or school officials.
Evernote can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Service used for this evaluation can be found on Evernote’s website, iOS App Store, and the Google Play Store. Additionally, other policies used for this evaluation include: Security Overview, Cookie Information, Region Specific Information, User Guidelines, Glossary, and Evernote's 3 Laws of Data Protection. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.
Safety
The Privacy Policy clearly states that there are features of Evernote that allow users to publish and share information publicly, and that users determine whether to post personal or otherwise sensitive information publicly. The terms do not disclose whether Evernote has any system in place for filtering or deleting all personal information from user’s postings before they are made publicly available. The Privacy Policy discloses that Evernote may monitor email communications and will block delivery of communications, or unshare problematic material that violates Evernote’s Terms of Service or User Guidelines.
Privacy
While the Privacy Policy does provide a specific reason as to "why we may collect" information from Evernote's users, the Privacy Policy does not clearly state that the collection of information is limited only to data that are specifically required for the product. The Privacy Policy clearly discloses that Evernote collects usage data, including log Internet and other electronic network information on how the user and others access and use Evernote. However, the terms fail to disclose whether Evernote obtains any method of opt-in consent from a user, before any information is collected. The Privacy Policy specifically indicates that if a user logs-in to Evernote with a third-party account-login platform, i.e., Google Connect, that the third-party account-login platform may have access to all of the user’s data, and furthermore that the third-party account-login platform may share user information with Evernote.
The Privacy Policy discloses that personal information is shared with third party service providers to process services on behalf of Evernote, and furthermore that personal information is shared to third parties for the purposes of analytics, product development, and marketing. However, the Privacy Policy states that Evernote does not share personal information to third parties for their own advertising purposes and that Evernote does not sell personal information. The Privacy Policy fails to disclose whether Evernote will notify users in the event of merger, acquisition, or bankruptcy of Evernote, and whether Evernote will provide users with the right to delete their information in consideration of such an event. While the terms do not state whether users are subject to traditional or contextual advertising, the Privacy Policy discloses that users are subject to targeted advertising.
Security
The Security Overview policy states: "The security team runs an in-house Incident Response (“IR”) program and provides guidance to Evernote employees on how to report suspicious activity. Our security team continually evaluates new tools to increase the coverage and depth of these assessments." Furthermore, the Security Overview policy provides that "We drive a security program that includes the following focus areas: product security, infrastructure controls (physical and logical)." The Privacy Policy discloses that Evernote requires its service providers to agree to strict data protection requirements, to keep up with Evernote’s privacy policy standards and Evernote’s obligations. The Privacy Policy indicates that Evernote will verify a user’s identity with additional personal information before processing a user’s privacy request.
Compliance
The Privacy Policy provides clear instructions on how users and/or an authorized agent can access, modify, or delete personal information. However, the Privacy Policy states that data is stored by Evernote until the user deletes it, and even after deletion, user data may be stored in Evernote's back-up systems for up to one year. The terms disclose that Evernote is not directed to minors, and that Evernote does not knowingly collect personal information from minors, without parental consent. Furthermore, the Privacy Policy states that any use of Evernote by minors should only be done with the guidance, supervision, and consent of their parents, guardians, and/or school personnel. The Privacy Policy does provide that if Evernote learns it has inadvertently obtained children’s personal information without parental consent, that Evernote will promptly delete it.
Every privacy rating includes an overall score. A higher score (up to 100%) means the product provides more transparent privacy policies with better practices to protect user data. The score is best used is as an indicator of how much additional work a person will need to do to make an informed decision about a product.
