Privacy Policy

11. Summary — the short version

This summary is for orientation only. The sections that follow control.

22. Who this policy applies to and what it covers

2.1 Scope

This policy covers:

• The Zaplog app for Android, the Zaplog app for iOS, and the Zaplog web and desktop clients.
• The zaplog.ai website and the app.zaplog.ai web app, where Zaplog’s shared links (invites, posts, profiles, podcast episodes and files) open.
• Our backend services, which store and synchronise your data and run the features described here.
• Our Trust & Safety moderation console, used by authorised Zaplog staff.

It does not cover third-party services you reach through Zaplog — websites you visit in the built-in browser, podcast feeds you subscribe to, news articles you open in Discover, or the Microsoft, GitHub, Canva and Granola accounts you connect to Zappy. Those are governed by their own privacy policies.

2.2 Controller

For users in the EEA, UK and Switzerland, Zaplog Inc. is the data controller for the processing described here, except where this policy says otherwise. Where you post content inside a Room, the Room's moderators exercise independent control over moderation decisions in that Room; Zaplog remains the controller of the underlying platform data.

2.3 Roles you may hold

• Account holder — you have a Zaplog account.
• Room member or moderator — you participate in, or help run, a community.
• Non-user — you do not have an account but your information reaches us because a Zaplog user saved you as a contact or mentioned you. See section 15.

33. Information we collect, feature by feature

3.1 Account creation, onboarding and profile

What we collect

Why. Your phone number authenticates you and lets other people find you. Date of birth enforces our minimum-age rules and Room age gates, and lets Zappy wish you a happy birthday. Gender is used for the ZapFit energy-requirement calculation, for profile display, and by Zappy to use the right grammatical forms. Country determines how codes are routed and sets regional defaults.

Note on your SIM. On Android and iOS we read the country code your SIM and mobile network report, purely to guess the right country for phone-number formatting; on the web we use your browser's locale. We do not read your SIM's stored phone number, and we do not collect device serial numbers, the Android advertising ID or Android ID, or Apple's advertising identifier (IDFA) or identifier for vendors (IDFV).

3.2 Authentication and sessions

• Sign-in method: a mobile phone number plus a six-digit one-time code, delivered by SMS. Codes go only to mobile numbers: VoIP, landline, toll-free and other non-mobile numbers are refused. Each number can receive three codes in 24 hours and is then locked for 24 hours, so we keep a count of the codes sent to each number. There is no password, no email/password login, no Google or Apple sign-in for your account, and no anonymous accounts.
• Code auto-fill: both mobile platforms can fill the code in for you. On Android, the system asks whether Zaplog may read the one text message that carries the code, and Zaplog gets that message and nothing else. On iPhone, the keyboard offers the code from Messages, which Apple handles entirely and which gives Zaplog no access to your messages at all. If you copy the code from the text message or its notification instead, Zaplog reads a six-digit code from your clipboard when you come back to the app, or on Android as soon as you copy it with Zaplog open. It reads only a code copied after it sent one, and on iPhone the system asks you first. The web client never asks for a code: you sign it in by scanning a QR code with your phone.
• Session tokens are issued by our authentication service and stored on your device.
• Signing in on a new phone: while your account is signed in on another phone, the new phone asks for a code that Zaplog shows on the old one. The old phone is told the new phone's name, never the code. If you no longer have the old phone, one code can go to your number by SMS instead, after which the number is locked for 24 hours.
• Account PIN (optional): if you set one, a new phone must enter it before it can take over your account or restore your message history. We store only a salted, keyed hash of the PIN, count failed attempts, and alert your signed-in phone when someone is asked for it.
• Inactive devices: a phone, browser or desktop client that hasn't been opened for 60 days is signed out. We record when each device was last opened for this purpose.
• Linked devices: you can pair a web or desktop client by scanning a QR code that you approve on your phone. We record an installation identifier, platform, device name (the manufacturer and model your operating system reports on Android and iOS, or the browser and platform on the web), last-seen timestamp, primary-device flag and revocation state. Registering a new primary phone revokes all other linked devices.

3.3 Chats — messaging

Zaplog's Chats tab contains one-to-one and group messaging with end-to-end encryption.

Content that is end-to-end encrypted (we store ciphertext only, and cannot read it with the keys held on our servers alone — subject to the escrow disclosure in section 7.4):

• Message text
• Photos, videos, documents and other attachments
• Voice notes and video notes
• Stickers you send, including stickers you create
• Poll questions and options sent in chat
• Live location coordinates shared in a chat
• Contact cards you share
• Call signalling metadata

Data we necessarily hold in readable form so the system can function:

• Sender and recipient account identifiers, and group membership
• Message timestamps and delivery/read state
• Control-message type and target (for example: "this is a delete-for-everyone instruction for message X")
• Disappearing-message timers (expires_in_seconds)
• The storage path of an encrypted attachment object
• A flag indicating content was removed by moderation
• Typing indicators and presence (transient)

Related features and what they mean for your data

3.4 Stories

• Photos and videos you capture or select, plus any text, drawings, stickers or layouts you add in the editor.
• Your audience setting per story: all contacts, all contacts except a list, or only a chosen list.
• View and like records — which accounts viewed or liked your story, and when. Only you see who viewed and liked your stories.
• An expiry timestamp, currently 24 hours from posting.
• Reposts — unless you turn it off in Settings → Privacy, people who can see your story can repost it to their own story. A repost is labelled only “Reposted”, and it disappears when you delete your original. Stories shared with a chosen list can't be reposted.
• Link stories — a link you share to Stories is stored with the preview your phone made of the page.
• Replies — text and voice replies to a story are sent as end-to-end encrypted chat messages.

3.5 Calls — audio, video and screen sharing

• One-to-one and group audio and video calls, and Rooms voice channels, run over a specialist real-time media service.
• Calls are end-to-end encrypted. Each call gets its own key, which travels inside the encrypted chat message that starts the call. The media provider relays audio, video and in-call data (names, reactions, raised hands) that it cannot decode. If the person you call has no registered device, the call connects without end-to-end encryption, and the call screen shows whether a call is encrypted. Rooms voice channels are not end-to-end encrypted.
• We do not record calls, and Zaplog has no call-recording feature.
• On iPhone, calls ring through Apple's CallKit, so they appear in the Phone app's Recents list, which iOS keeps (and may sync to your other Apple devices) under Apple's own settings.
• In-call status — while you are in a call, people inviting others to a call can see that you are busy.
• We store call metadata: participants, direction, start and end time, duration, call type, and outcome (answered, missed, declined).
• Screen sharing uses your platform's own screen-capture mechanism — Android's media projection, iOS's broadcast picker, or your browser's share-screen picker. In every case you choose what to share and the operating system shows you that capture is active. Anything visible on your screen while sharing is transmitted to the other participants.
• Access tokens for the call service are minted by our backend for each session.
• We use the proximity sensor and audio-routing controls during calls; these do not produce data we retain.

3.6 SMS and MMS

Zaplog does not handle SMS or MMS on any platform. The Android app can no longer be set as your default SMS app, and it asks for no SMS or MMS permission; the iPhone app and the web client never could. If you text someone who isn't on Zaplog, Zaplog opens your phone's own messaging app, and that app and your carrier handle the message. Zaplog never reads, stores or uploads it.

If you had made Zaplog your default SMS app on Android, your texts are still in Android's own message store, where they always were. Choose another messaging app in Android Settings if your phone hasn't already.

The only text messages that reach Zaplog are the sign-in codes we send you: on Android, if you allow it, the system gives Zaplog the one message that carries your code so it can fill it in (see section 3.2).

3.7 Contacts and contact discovery

Reading your contacts. With your permission, Zaplog reads your device contact list to show you names and photos next to phone numbers, and to let you start chats and calls.

We ask first. Discovery runs only after you tap Allow on its own question, “Find your contacts on Zaplog?”, which says what is sent and what it is used for. Giving Zaplog Contacts access doesn't count as agreeing: the question comes afterwards, once there is an address book to send — after the permission prompts when you first open the app, when you open New chat, or when you turn on Settings → Privacy → Find contacts on Zaplog. If you tap Don't Allow, Zaplog still reads your contacts on your phone to show names and let you pick someone, but it doesn't send us your address book. When you type or tap a single number, Zaplog still checks that one number with us. If you were using Zaplog with Contacts access before we added this question, discovery stays on. While discovery is on, Zaplog checks again when you open New chat and about once a day, so new contacts show up. To stop it at any time, turn off Settings → Privacy → Find contacts on Zaplog, or turn off Contacts access for Zaplog in your phone's settings.

We are aware that the privacy-preserving standard here is hashed or private-set-intersection matching, and moving to it is on our roadmap. Until then:

• We use these numbers only to compute matches and to power the contacts you see in Zaplog.
• We do not sell them, use them for advertising, or share them with any third party for that third party's own purposes.
• If you decline the Contacts permission, Zaplog still works — you can start chats by entering a phone number directly.
• To stop address books being harvested, one lookup checks at most 1,000 numbers and an account at most 10,000 different numbers a day. For that count we keep a hash of each number you looked up, until the next day you run discovery.
• When a number matches an account, we record that you were shown that person's number. Together with messages you exchange, that decides whether you can see their number later. It also makes that person one of your contacts in Zaplog, so they are included wherever you choose your contacts: stories you share with your contacts, and any Privacy setting set to My contacts, such as who can see your profile photo or last seen.

Saved contacts. When you save a contact inside Zaplog, we store the contact's name and phone number on our servers, associated with your account, so it syncs across your devices. This is stored in readable form. Contacts you save may include people who are not Zaplog users — see section 15.

Writing contacts. With your permission, Zaplog can add a contact to your device address book when you choose to save someone.

3.8 Rooms (ZapRooms) — communities

Rooms is a public and private community platform. Content you post in a Room is not end-to-end encrypted, and depending on the Room's settings may be visible to anyone.

Content and activity we collect

• Posts — text, links, images, polls and AMA posts (which may include a selfie), titles, bodies, flairs, and scheduled-post timing.
• Profile posts — posts on your own Rooms profile. Anyone can see them, including people outside the Rooms you're in, and people who follow you may see them in their Home feed.
• Follows — who you follow and who follows you.
• Comments and replies, including nested threads.
• Votes and Boost points — your upvotes and downvotes, and the Boost point totals derived from them.
• Awards you give and receive.
• Flairs — post flairs and user flairs, which may be assigned by you or by moderators, and may follow you across Rooms.
• Channels — text, chat, voice and stage channels, including chat messages posted in Room channels (these are not end-to-end encrypted). In voice and stage channels we record who joins, who is speaking or has been invited to speak on a stage, and moderator actions such as server mutes and moves.
• Voice captions and recaps — if a Room's moderators turn on captions in a voice channel, each speaker's phone turns their own speech into text with the phone's speech recognition and shows it to the people in the channel; nothing is stored. If they also turn on recaps, those captions are sent to us and kept until our AI provider writes a summary of the conversation into the channel's chat. Then they are deleted, and never kept longer than a day.
• Room direct messages and modmail.
• Membership and role data — which Rooms you joined, your roles, your custom permissions, your join date, and whether you follow a Room.
• Presence — heartbeats used to show live online counts in a Room.
• Saved posts, subscriptions and unread/mention state.
• Invite links you create or use, in the form app.zaplog.ai/rooms/join/<code>.
• Translation — if you tap Translate on a post or comment, its text is sent to our AI provider.

Moderation and Trust & Safety data

Running a community platform requires records. We collect and retain:

• Reports you file about content, Rooms, profiles or people in Chats, and reports filed about you. A report from a one-to-one chat includes the last 5 messages the reported person sent you in it (see section 7.3).
• Moderation queue entries, removal reasons, and the moderation log.
• Appeals you submit and their outcomes.
• Moderator notes about members, watch-lists, warnings, timed mutes and bans (both Room-level and platform-level).
• Automated moderation signals: banned-word and pattern matches, link and invite policy hits, mention-spam and capitalisation triggers, attachment-policy hits, crowd-control actions, minimum-account-age checks, ban-evasion indicators, and AI rule verdicts and content-safety scores where a Room uses them.
• Records of actions taken by Room moderation bots, which a Room's moderators configure. Most bot rules are fixed: word lists, patterns, limits and similar. Moderators can also add two kinds of rule that use our AI provider: rules written in plain English, which an AI model checks content against, and category rules, which have our AI provider's content-safety service score text or images for hate, self-harm, sexual content and violence. Content is sent for these checks only in Rooms whose moderators turned such rules on, and it is not used to train models.
• Support notices — posts, comments and messages in Rooms are scored for signs of self-harm by our AI provider's content-safety service. If one scores high, its author gets a private notice with helpline information, and the Room's moderators get an alert with an excerpt so they can help. It never removes anything, and the score is kept with the moderation record. A Room's moderators can turn it off.
• Platform notices and account restriction records.

Age gating. A Room's owner sets its minimum age to either 13 — Zaplog's own minimum, and the default — or 18 for an adults-only Room. We use your stored date of birth to evaluate eligibility. Creating a Room requires you to be 18 or older, and this check fails closed — if we cannot confirm your age, you cannot create a Room. Private Rooms are for adults whatever their minimum age is set to: you must be 18 or older to join one, and if we cannot confirm your age, you cannot join. When a public Room becomes private, members who are under 18, or whose age we cannot confirm, are removed and told why.

Moderators. If you are a moderator, other moderators and Zaplog staff can see the moderation actions you take. Moderation logs are retained for accountability and appeals.

3.9 Pod (ZapPodcasts)

• Subscriptions and library — the shows you follow, synced to your account.
• Playback state — episode progress, continue-listening position, queue, playback speed, sleep-timer state.
• Downloads — episodes stored on your device for offline listening.
• Search queries you enter in the podcast catalogue.
• Transcripts — where a show provides them, we fetch and parse transcript files.
• Now listening (Social Podcast) — while an episode is playing, we store which episode and show it is, and people who open your profile or a chat with you see it in place of your online status. It clears shortly after you pause. It is on by default. Turning off Social Podcast in your profile stops it and deletes the record, and people you have blocked or who can't see your status never see it.

Third parties. Catalogue search and show metadata come from a third-party podcast catalogue provider. Episode audio, artwork and transcripts are fetched directly from the podcast's own feed and hosting provider. When your device downloads or streams an episode, the podcast's host receives your IP address and user-agent, and may count it as a download. Some podcast hosts use analytics-prefix services in their audio URLs. Zaplog does not send your identity to these hosts.

3.10 Zaplog AI

The Zaplog tab is an AI answer engine.

What we collect and transmit

• Your prompts, including follow-up questions.
• Attachments you add — images (sent to the model as encoded image data), and documents including PDFs and Office files, from which we extract text.
• Voice input — captured with your microphone and converted to text by your platform's speech recognition (Android's recogniser, Apple's Speech framework — on your iPhone where it supports that, otherwise by Apple — or your browser's speech API) before being sent as a prompt.
• Voice mode (Zaplog Pro) — a spoken conversation. When the live connection is available, your voice is streamed to our voice service, where our AI provider's speech service turns it into text, and the answers are spoken back by that same service. Otherwise your device recognises your speech and the answers' text is sent to the speech service to be spoken. The conversation's transcript is saved in the chat.
• Usage counts — how many answers, Deep Research reports and images you use each day, to apply the free and Pro allowances.
• Generated output — answers, generated images, artifacts, and PDF reports you export.
• Web search activity — in normal search and Deep Research mode, we derive queries from your prompt and send them to search providers, then fetch and extract the text of result pages.

Where it goes. Prompts and attachments are sent to our AI model provider, which hosts every model Zaplog uses. Search queries go to independent search providers.

Storage. Zaplog AI conversations are stored on our servers in readable form — the session title, the full message history, timestamps and pinned state — so they sync across your devices. Attachments are stored in private storage. These are not end-to-end encrypted. You can delete a session at any time.

Read-aloud. Outside voice mode, answers are read aloud by your platform's own text-to-speech — Android's engine, Apple's speech synthesiser, or your browser's — and no audio is sent to us.

3.11 Zappy — the assistant in your Chats

Zappy is an AI assistant that appears as a conversation in your Chats tab and can act across the whole app on your instruction. It is the most far-reaching feature in Zaplog and deserves its own disclosure.

What Zappy can access when you ask it to

What this means for your data. When you give Zappy an instruction, the content it needs to answer — chat excerpts, email bodies, file text, note contents, health figures, planner entries — is sent to our AI provider as part of the prompt. Zappy only reads what a given instruction requires; it does not continuously scan your data.

Switches. Six switches in Zappy → Connectors — Chats, Rooms, Pod, Fit, Cloud and Organized — decide which parts of Zaplog Zappy may read or act on. They are on by default. Turning one off stops Zappy reaching that area at all.

Links. When you send Zappy a link, such as a YouTube or TikTok video, Zappy fetches that page. For a TikTok post, its cover image may be analysed by our AI provider.

Voice messages. If you send Zappy a voice message, your platform’s own speech recognition turns it into words, as it does for a voice-note transcript — Android’s recogniser, or Apple’s Speech framework, on your iPhone where it supports that and otherwise by Apple. Zappy works from the words, which go to our AI provider like a typed message; the recording itself is not sent to our AI provider.

Weather, places and travel times. If you ask Zappy about the weather or about places near you without naming a place, your phone finds where it is and turns that into a town or neighbourhood name, using Android's or Apple's location service. Only that name is sent to us and on to our weather and search providers, and distances to the places found are worked out on your phone. If you ask how long it will take to get somewhere, your phone sends the start and end points of the trip to our map provider to get a route with current traffic. All of this needs location permission, and Zappy reads your location only while Zaplog is open on your screen. If Zaplog doesn't have permission, Zappy shows a Share your location button, and your phone asks you.

Trips, events, jobs and prices. When you ask Zappy to plan a trip, find events or jobs, or watch the price of a flight or a product, the places, dates and words of the search go to our search provider, with the country of your phone number (never the number itself) so results and prices are local. A price watch is checked from your phone up to twice a day, and Zappy tells you only when the price falls below the one you set.

Calendar reminders. If you turn on a meeting-brief reminder, Zappy reads your upcoming events from your phone's calendar and, if you connected Microsoft, from Outlook, including their times, locations and attendees. Before a meeting it may read your recent chats with the people attending, to brief you. What each reminder needs goes to our AI provider.

Messages from Zaplog. Zaplog staff can send an announcement that appears as a message from Zappy, to everyone or only to free or Pro accounts. These are written by people and are not based on your data.

Memories. Zappy can remember facts you tell it. These are stored as memories associated with your account and injected into its context on later turns. You can ask Zappy to forget something, or clear memories in settings.

Your profile. Zappy is told your birthday, age and gender from your Zaplog profile, so it can use the right grammatical forms in languages that need them and wish you a happy birthday on the day, and the country of your phone number (worked out on your phone, never the number itself), so it can give visa advice and local results without asking where you are from. They go to our AI provider with your Zappy requests. They are left out when Zappy answers an @zappy question in a chat other people can see.

Automations. You can ask Zappy to act on a schedule or a trigger. We store the automation definition and use device alarms and background workers to run it, which may produce proactive messages from Zappy. On iPhone, our server also keeps the times your next automations are due, and nothing else about them, so it can wake Zaplog with a silent notification.

You can ask Zappy to tell you when someone says a word or phrase in a chat. Incoming messages are checked on your phone after they are decrypted, and only a message that matches is given to Zappy, and so to our AI provider, to tell you about it. Zappy also notices changes you keep asking it to make at about the same time of day, such as logging water, and may offer to automate them. It works this out on your phone.

Trust settings. Every action that changes something is gated behind a confirmation step. You can pre-approve a limited, hand-picked set of low-risk actions on your own data. "Trusted people" is a list you control of the only people Zappy may message on your behalf.

Connectors. Connecting Microsoft, Canva or Granola uses that company's own sign-in (OAuth); connecting GitHub uses GitHub's device sign-in, or a token you paste. We never see your password for any of them. The resulting tokens stay on your device, encrypted with a key held in its hardware-backed keystore, and are not uploaded to us. When Zappy works with one of these services, your phone sends it what your request needs, such as a design brief or a file you asked Zappy to put in a design. You can disconnect a connector at any time in Zappy settings, and revoke Zaplog's access in that service's own account settings. Google connections made before September 24, 2026 are revoked with Google and deleted the next time you sign in.

Storage. Zappy's transcript, memories, automations and attachments are encrypted on your device before upload using your account archive key. Our servers hold ciphertext for these.

3.12 Fit (ZapFit) — nutrition and health

ZapFit processes health data. In several jurisdictions this is special-category or consumer health data with heightened protection. See section 13.

Profile and plan

• Date of birth, biological sex, height, current and goal weight, unit system.
• Dietary pattern (for example vegetarian, vegan, keto), allergies, and foods you avoid.
• Free-form onboarding answers, which may include your motivations, obstacles, training habits, sleep, stress and weigh-in rhythm, and step goal.
• Derived calorie and macronutrient targets.

Logs

• Food entries with nutrient breakdowns, water logs, exercise logs, fasting sessions, custom foods and recipes.
• Weight logs, and body measurements: body-fat percentage and neck, chest, waist, hip, arm and thigh circumference.
• Goals, adaptive-review outcomes and reminders.

Meal scanning

• Photos you take of meals, nutrition labels and barcodes.
• Meal photos and label photos are uploaded to private storage and sent to our AI provider for analysis. Your plain-language corrections are sent too, so the estimate can be refined. Unless you turn off remembering scan corrections, each analysis also sends up to 15 of your most recent custom foods, so estimates match foods you've corrected before.
• Barcodes are looked up against a public food-product database directly from your device; generic-food nutrition comes from a public nutrition database via our servers.

Platform health integrations

ZapFit can read from your device's health store with your explicit permission — Health Connect on Android and Apple Health on iPhone. The web client has no health-store access. On both we read and write:

Important: weight and exercise records imported from your health store are stored as ZapFit entries on our servers. Steps, active calories and sleep are shown on your dashboard and are not stored with us. If you do not want scale or wearable data leaving your device, do not grant health-store permission — the rest of ZapFit works without it.

We will never use health-store data for advertising, and we will never sell it. Google Play's Health Connect policy and Apple's HealthKit rules both require this, and we commit to it independently on every platform.

Storage. ZapFit data is stored on our servers in readable form. It is not end-to-end encrypted.

Export. ZapFit is the one module with a built-in data export — you can export your ZapFit data across 18 data tables, up to five times per day.

3.13 Cloud (ZapCloud)

• Files and folders you upload, including file names, sizes, types, folder structure, timestamps and version history.
• Camera and photo backup — if you enable it, ZapCloud uploads photos and videos from selected albums (on Android by default Camera, Pictures and DCIM; on iPhone, the library you give Zaplog access to — all photos, or the ones you select). You control whether videos are included, whether uploads may use cellular data, image quality, and HEIC conversion.
• Photo details — for photos and videos we read and store the date taken and the details in the file: dimensions, duration, camera make and model, exposure settings and, if the file contains it, the location where it was taken. They power the Photos timeline and the info panel, and you can edit the date.
• Free up space — if you choose, Zaplog deletes photos from your phone that are already in ZapCloud, after your phone asks you to confirm.
• Document scanning — pages captured with your camera and converted to PDF or JPEG.
• On-device analysis for search — we run optical character recognition and image labelling on your device to make your files searchable by their text and contents. The extracted text and labels are stored with the file so search works across your devices.
• Thumbnails generated for previews.
• Share links you create: their optional password (stored only as a hash), expiry, open limit and how many times each was opened, and whether it was revoked. A share link opens a public page at app.zaplog.ai.
• Sharing with people — records of files and folders you share with other Zaplog accounts. The person you share with gets a notification that you shared something with them.
• Duplicate detection using content hashes.
• Trash — deleted items and their storage objects, kept for 30 days.
• Offline files and storage-analyzer results.

Encryption. ZapCloud content is encrypted in transit and at rest. It is not end-to-end encrypted — Zaplog can technically access it, and does so only for the purposes in section 5.

Not a backup service. ZapCloud is a sync and storage feature, not a guaranteed backup. Keep your own copies of anything irreplaceable.

3.14 Notes

• Note titles and bodies, folders, and pinning, sorting and search state.
• Attachments — photos, drawings and scanned documents.
• Voice recordings and their transcripts. On Android and iPhone, transcription runs on your device, using Android's speech recogniser or Apple's Speech framework. The web has no on-device recogniser, so when you tap Transcribe there (and agree the first time), the recording is sent to our AI provider's speech service to be transcribed.
• AI summarisation and writing tools — if you tap these, the note or transcript text is sent to our AI provider.
• Reminders you set, and widget and share-target activity.

Notes sync to your account and are not end-to-end encrypted.

3.15 Web browser

Zaplog includes a full web browser.

• History, bookmarks and bookmark folders, per-site preferences, and reader-mode state — these sync to your account and are not end-to-end encrypted.
• Downloads and open tabs stay on your device and do not sync.
• Private (incognito) tabs use a separate browser profile. Private browsing is excluded from sync entirely — it is not recorded in history and is not uploaded to us.
• Search suggestions — as you type, we may query suggestion endpoints operated by independent search engines. Those providers receive your partial query and your IP address.
• Tracker blocking — we ship a blocklist that is applied on your device.
• AI page assist — if you invoke it, the page's text is sent to our AI provider.
• Websites you visit set their own cookies and receive your IP address and user-agent directly. Zaplog is not a party to that.

3.16 Organized — the day planner

Organized contains some of the most sensitive data in the app.

• Tasks and time blocks, including titles, notes, scheduled times and durations, recurring rules and per-occurrence overrides.
• Routines and focus sessions — rounds, breaks, ambient-sound choice, streaks and history.
• Energy budget entries.
• Week reviews.
• Mood check-ins — your selected mood and any free-text note.
• Menstrual cycle logs — period start and end dates, used to predict cycle phase.
• Device calendar import — with your permission, we read events from your device calendar to show them alongside your plan.
• Reminders import (iPhone) — with your permission, Organized imports your Apple Reminders into your plan, where they sync like your other Organized items.
• AI planning — if you describe your day by typing, dictating or photographing it, that description (and image) is sent to our AI provider, which proposes blocks you accept or discard.
• Alarms, notifications and widget state.

3.17 Discover — the news reader

• Topics you personalise, articles you save (synced to your account), and reading activity within the reader.
• Headlines and article metadata come from a third-party news aggregator. Our servers fetch and cache them, so the aggregator sees our servers, not your device. Opening an article takes you to the publisher's site, which receives your IP address directly.

3.18 Notifications

• We store a push token issued by your platform's push notification service — the mobile push service on Android and iOS, and the browser's web-push service on the web client — so we can deliver notifications to your device.
• We store your notification preferences, including per-chat, per-Room and per-module settings.
• Push notification content is generated by our backend. For end-to-end encrypted chats, the push carries the message only in its encrypted form, which your device decrypts to show a preview (or fetches, if it didn't fit). The push also carries, in readable form, the sender's name and, for groups, the group's name and picture, so your phone can show who wrote. On iPhone, the preview is decrypted on your phone by Zaplog's notification extension, and nothing is decrypted if you turn message previews off.
• On iPhone, notifications travel through Google's Firebase Cloud Messaging to Apple's push service, and incoming calls use Apple's VoIP push.
• Besides messages and calls, we send security alerts (for example, when a new phone asks to sign in to your account), notifications when someone shares a ZapCloud file with you, and messages from Zappy.

3.19 Device, technical and usage information

• Installation identifier — a random identifier the app generates itself. It is not derived from, and not tied to, any platform identifier: not the Android ID or Android advertising ID, and not Apple's IDFA or identifier for vendors.
• Device name derived from the manufacturer and model your operating system reports, or the browser and platform on the web, shown to you in Linked Devices.
• Platform and app version.
• Last-seen timestamp and online-seconds total — cumulative foreground time, which drives the Levels / StarLevel progression feature.
• IP address and connection metadata, received by our servers and our providers as an inherent part of internet communication.
• Encryption device records — a per-installation device identifier, registration identifier, public identity key and device name, used to route encrypted messages to the right devices.
• Rate-limit counters per operation, used to prevent abuse.
• Crash reports — if Zaplog crashes or stops responding on your Android phone or iPhone, the app saves a report and sends it to us the next time you are signed in: what went wrong and where in Zaplog’s code, the app and operating-system versions, your device model and when it happened, linked to your account. Sign-in tokens and email addresses are removed before it is sent. Zaplog makes these reports itself, with no third-party crash-reporting SDK, and uses them only to find and fix bugs.
• Handset key — a random secret the Android and iPhone apps create and keep in your phone’s secure storage (Google’s Block Store on Android, the Keychain on iPhone), so it can outlast reinstalling the app. Signing out deletes it. We keep two hashes of it, never the key: one tied to your account, so a reinstalled app signs in as the phone you already use, and one that is not tied to any account, which shows our Trust & Safety team when two accounts have been used on the same phone. We use that second one only to find accounts made to get around a ban (section 3.13 of the Community Guidelines). It is not derived from, or linked to, any platform identifier.

We do not collect the Android advertising ID or Android ID, Apple's IDFA or identifier for vendors, the IMEI, MAC address or SIM serial number, and we do not fingerprint your device or your browser. The iPhone app shows Apple's App Tracking Transparency prompt, but whatever you answer, Zaplog does not read Apple's advertising identifier and does not track you across other companies' apps or websites.

3.20 Support, Trust & Safety and staff access

• Support correspondence you send to support@zaplog.ai or through in-app help, and Trust & Safety modmail.
• Staff console records — our internal moderation tooling keeps staff authentication and session records, an append-only audit log of every staff action, and staff notes about accounts under review.
• Ban evasion checks — when Trust & Safety looks at an account, they can see other accounts that have used the same phone (from the handset key above) or signed in from the same IP address in the last 30 days. An address shared by many accounts, such as a mobile network’s, is left out. They use this only to find accounts made to get around a ban.

Access is restricted to authorised personnel, requires a one-time authenticator code or a passkey plus network-level restrictions, and every action is logged.

3.21 Payments and subscriptions

Zaplog is free to use. Zaplog Pro is an optional paid subscription that unlocks the features identified as Pro inside the app, and ZapCloud 100 GB is an optional storage plan for accounts without Pro. If you never subscribe, nothing in this subsection applies to you.

How you can pay, by platform

Zaplog never receives your full card number. Card, bank and wallet details are entered directly with Stripe, Google or Apple and are held by them. We could not disclose your card number if we were asked to, because we do not have it.

What we store about your subscription

• Your subscription status — one of active, canceled, grace (a renewal failed and the store is retrying), paused (a Play-specific pause), or expired.
• Whether you pay monthly or yearly and, if you switch to yearly, when the switch takes effect.
• Which store or processor the subscription came through.
• The date your current paid period ends, and whether it is set to cancel at the end of that period.
• Processor references — a customer and subscription identifier from Stripe, or a purchase token and order identifier from Google Play, or the equivalent from Apple. These let us match a payment to your account and provide support.
• The last raw status the store reported, kept for support investigations.
• For App Store purchases, the app attaches your Zaplog account ID (a random identifier, not your phone number) to the purchase, so Apple's signed receipts can be matched to your account.
• When you use Pay Direct from the app, the app gives app.zaplog.ai a one-time ticket, which the page swaps for a billing-only cookie that lasts up to a day. It cannot open your chats or anything else in your account.
• If Zaplog staff give your account Pro or extra storage, we record who gave it and when.

What we store about payment events

We keep a log of the billing notifications the stores and Stripe send us — the event type, its identifier, when it arrived, and its contents. This is how a payment, cancellation, refund or failed renewal actually reaches your account, and it is also our record if a payment is later disputed.

What we never store: your full card number, CVC, bank account number, or any credential that could be used to make a payment.

What the processors receive

• Stripe receives your payment details, billing name, billing address and country where required for tax, your email if you provide one at checkout, your IP address, and an identifier that lets us match the payment to your Zaplog account. Stripe acts as an independent controller for its own fraud-prevention and regulatory obligations, and its handling of your data is governed by its own privacy policy.
• Google and Apple process store purchases entirely within their own systems. We receive confirmation that a purchase exists and its current state. We do not receive your payment details, and in most cases we do not receive your store account email.

Refunds, disputes and chargebacks. If you dispute a charge with your bank, we receive notice of the dispute from Stripe and may submit evidence in response — your subscription record, the billing events log, and the account activity that shows the service was provided. We do this to answer the dispute, and we do not use it for any other purpose. How disputes are handled commercially is set out in section 17 of the Terms of Service.

Tax and accounting. We keep transaction records for as long as tax, accounting and anti-fraud law requires — typically seven years — even after you cancel or delete your account. This is a legal obligation and it survives a deletion request. See section 11.

Advertising. We do not use payment or subscription data for advertising, and we do not sell it. Whether you subscribe has no effect on how your content is treated, and Pro does not change the privacy protections described anywhere else in this policy.

3.22 Cookies, local storage and similar technologies

This subsection is mainly about the web client and zaplog.ai. The Android and iOS apps do not use cookies for their own operation; they store the equivalent data in the app's own storage on your device.

On app.zaplog.ai the strictly necessary cookies are: a device cookie that keeps the web client linked to your phone, a short-lived pairing cookie used while you scan the sign-in QR code, and — only while you use Pay Direct — a billing cookie. All are HttpOnly, so scripts on the page cannot read them.

We also use browser local storage and equivalent technologies to hold your session and cached content so the web client works offline and loads quickly. The web client's end-to-end encryption keys are kept in your browser's IndexedDB, sealed with a key the browser will not export.

Your choices. You can clear or block cookies and site data in your browser settings; blocking strictly necessary cookies will sign you out and break the web client. Where the law requires a consent banner for non-essential cookies, we show one and honour your choice, and you can change it at any time from the footer of zaplog.ai.

Do Not Track and Global Privacy Control — see Appendix B.

Inside Zaplog's built-in browser, websites you visit set their own cookies. Those are the websites' cookies, not ours, and private tabs use a separate profile that is cleared when you close them.

44. Device permissions and why we ask for them

When you first open the Android or iPhone app, Zaplog lists the permissions it uses and what each one is for, then asks for them one after another: notifications, contacts, camera, microphone, photos, location while you're using the app, and calendar. On Android you can tap Not now, and nothing is asked; on iPhone you can say no to each of Apple's prompts. Allowing Contacts sends nothing by itself: Zaplog then asks you separately before it sends your contacts' phone numbers to find who is on Zaplog (see section 3.7). A feature that needs a permission you didn't give asks for it when you use it, and everything else below, such as Health, is asked for only by the feature that uses it. You can decline any of them and continue using the rest of Zaplog, and you can revoke any of them later in your device settings.

Permission models differ by platform, so this section is split three ways.

4.1 Android permissions

Permissions we deliberately do not request: all-files storage access, Bluetooth, call log, phone dialling, account list, or full package visibility.

To review or revoke: Android Settings → Apps → Zaplog → Permissions. Health permissions are managed separately in Health Connect.

4.2 iOS permissions

iOS asks for fewer, broader permissions than Android, and several Android features have no iOS equivalent.

Not available on iOS: all-files device storage access and exact-alarm scheduling. Reminders and timers on iOS use the system notification scheduler, which Apple controls.

To review or revoke: iOS Settings → Zaplog, or Settings → Privacy & Security. Health permissions are managed in the Health app.

4.3 Web and desktop client

The web client asks the browser, not the operating system, and only when you use the feature:

The web client has no access to your contacts, your device photo library, your calendar, your health data, your SMS, or your file system beyond files you explicitly choose to upload or download. Signing in to the web client requires approving a pairing code on your phone, and you can revoke it at any time from Settings → Linked devices.

To review or revoke: your browser's site-settings panel for zaplog.ai.

55. How we use your information

We use personal information only for the purposes below.

1. Providing the Services — authenticating you, delivering messages and calls, syncing your files, notes, planner and library across devices, playing podcasts, running searches, and generating AI responses you asked for.
2. Personalising your experience — showing your contacts, your Rooms, your recommended topics in Discover, your ZapFit targets derived from your own figures, and your planner.
3. Safety, moderation and integrity — detecting and acting on spam, harassment, illegal content, ban evasion and abuse; operating reports, appeals, mutes, bans and Room automod; enforcing rate limits and age gates.
4. Security — verifying devices, managing encryption keys, detecting unauthorised access, and protecting against fraud.
5. Taking payment — processing subscriptions, applying and removing entitlements, handling renewals, cancellations, refunds and disputed charges, preventing payment fraud, and keeping the tax and accounting records the law requires.
6. Support — answering your questions and investigating problems you report.
7. Reliability and improvement — diagnosing failures and improving features. We do this without third-party analytics SDKs; where we use aggregate operational data we do not use it to build profiles of you.
8. Legal compliance — responding to lawful requests, enforcing our Terms, and establishing or defending legal claims.
9. Communicating with you — service messages such as verification codes, security alerts and material changes to this policy, and announcements that arrive as messages from Zappy.
10. Applying plans and allowances — working out your storage use and your daily AI allowances, and what your plan includes.

What we do not do: we do not use your information for advertising, we do not sell it, we do not use your private content to train AI models, and we do not use Health Connect or other health data for any purpose beyond the ZapFit and Organized features you use.

66. Legal bases for processing (EEA, UK, Switzerland)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR.

Where we rely on consent, you can withdraw it at any time — by revoking the permission in Android Settings, iOS Settings or your browser's site settings, by disconnecting a connector, or by turning the feature off. Withdrawal does not affect processing carried out before withdrawal.

Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they do not override them. You may object at any time — see section 12.

77. Encryption and security

7.1 End-to-end encryption in Chats

Zaplog Chats uses the Signal protocol — X3DH and PQXDH key agreement with the Double Ratchet, including post-quantum key encapsulation. Message bodies are encrypted with a per-message content key using AES-256-GCM, and that key is delivered separately to each of the recipient's registered devices. Attachments are encrypted with AES-CTR and authenticated with HMAC-SHA256 so they can be streamed and seeked without decrypting the whole file. Calls are encrypted end to end with a key made for each call, delivered inside the Signal-protocol message that starts the call. The web client is its own Signal device and keeps its keys in your browser, sealed with a key the browser will not export.

7.2 What end-to-end encryption covers

Chat message bodies and attachments, voice and video notes, stickers, live location shared in chat, call audio and video, call signalling metadata, and Zappy's transcript, memories, automations and attachments (which are sealed on your device under your account archive key).

7.3 What it does not cover

ZapCloud files, Notes, Organized items including mood and cycle logs, browser history and bookmarks, ZapFit data and meal photos, Zaplog AI conversations and attachments, Stories, all Rooms content including Room channel chat, your profile, and your saved contacts.

These are protected by encryption in transit and encryption at rest, and by record-level access controls that restrict each record to its owner. But Zaplog is technically capable of accessing them, and does so only for the purposes in section 5 — principally support you request, Trust & Safety enforcement, and legal compliance.

When you report someone in Chats. If you report a person from your one-to-one chat with them, or from their profile, your device sends the last 5 messages they sent you in that chat with the report, so our Trust & Safety team can see what was said. Those messages reach us readable and are kept with the report as a moderation record (section 11). Nothing else from the chat is sent, reporting a group sends no messages, and the person you report is not told.

7.4 Key escrow — an honest disclosure

If you set an Account PIN, the escrowed key is released to a new phone only after the PIN is entered.

If you want a strictly no-escrow guarantee, Zaplog is not currently the right tool for that specific threat model.

7.5 Device-side protections

• App Lock and Locked chats use your device biometric — Android's biometric prompt, or Face ID and Touch ID on iOS. In both cases the operating system tells Zaplog only whether the check passed. Your fingerprint or face data never leaves your device and is never available to Zaplog.
• Screen guard keeps Zaplog out of screenshots and screen recordings — on Android with the secure-window flag, and on iPhone by drawing the app through a protected layer that iOS leaves out of screenshots, recordings and mirrored screens. The iPhone app also hides its content in the app switcher.
• Local storage: on Android, the app's local database is encrypted with a key sealed by the Android Keystore, and Zaplog's data is excluded from device backups and transfers. On iPhone it is protected by iOS Data Protection.
• Sensitive local secrets, including OAuth tokens for Zappy connectors and your archive key, are wrapped with a key held in your device's hardware-backed secure store — the Android Keystore, or the iOS Keychain backed by the Secure Enclave.
• Deleting your account, disabling screen guard, and changing or turning off an Account PIN require biometric confirmation.

7.6 Server-side protections

• All traffic between the app and our servers is encrypted in transit.
• Record-level access controls are our primary access boundary — each record is readable only by the accounts entitled to it.
• Staff access to our moderation tooling requires a one-time authenticator code or a passkey, plus network-level restrictions and lockouts, and every action is written to an append-only audit log.
• Access tokens for real-time calling are short-lived and issued per session.

No system is perfectly secure. We cannot guarantee absolute security, and we ask you to protect your device with a lock screen and to keep the app updated.

7.7 Breach notification

If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where the GDPR requires it, and notify affected users without undue delay where required by that or other applicable law.

88. How we share information

We share personal information only in the circumstances below.

8.1 With other users, because that is the point

• Chats — your messages, name, photo, presence and read receipts are visible to your correspondents.
• Stories — visible to the audience you choose, and you can see who viewed and liked them.
• Rooms — your posts, comments, votes (in aggregate), flairs, awards and Room profile are visible according to the Room's settings. Public Rooms may be visible to anyone. Posts on your Rooms profile are public.
• Calls — participants see your name, photo, and whatever your camera or shared screen shows.
• Contact discovery — people who have your number in their address book may see that you are on Zaplog.
• ZapCloud share links — anyone with the link (subject to any password or access limit you set) can access the shared file.

You control much of this in Privacy settings, including who can see your profile photo, last seen and status, and whether you are searchable by username.

8.2 With Room moderators

Moderators of a Room you participate in can see your content in that Room, your Room membership and roles, reports about you, and moderation history within their Room. They cannot see your private chats, your files, your health data or your planner.

8.3 With service providers

We share the minimum necessary with the categories of provider described in section 9. They act on our instructions under contract, and are not permitted to use your information for their own purposes.

8.4 For legal reasons

We may disclose information if we believe in good faith that it is reasonably necessary to:

• comply with a valid law, regulation, legal process or enforceable governmental request;
• enforce our Terms of Service, including investigation of potential violations;
• detect, prevent or address fraud, security or technical issues; or
• protect against harm to the rights, property or safety of Zaplog, our users or the public, including in an emergency involving a risk of death or serious physical injury.

Where we are legally permitted to do so, we will make reasonable efforts to notify you of a legal request for your information before disclosing it, unless we are prohibited from doing so, the request relates to an emergency, or notice would be counterproductive.

8.5 Business transfers

If Zaplog is involved in a merger, acquisition, financing, reorganisation or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy, and the receiving entity will be bound by commitments at least as protective as those here.

8.6 With your direction

When you connect Microsoft, GitHub, Canva or Granola to Zappy, share a file, post to a public Room, or open a link, information moves at your direction.

8.7 What we never do

We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not disclose your content to data brokers. We do not provide your private content to third parties for their own marketing.

99. Who receives your information

We do not publish the names of the vendors behind our infrastructure. What matters for your privacy is what kind of company receives your information, what they get, and what they are allowed to do with it — so this section sets that out by category. Every provider below is bound by a written contract that limits them to acting on our instructions and forbids them from using your information for their own purposes.

If you are exercising a right under the GDPR, UK GDPR or a US state privacy law and need the specific identity of a recipient, ask us at support@zaplog.ai and we will provide it.

What no one on this list may do: use your information for their own products, sell it, combine it with data from other customers to profile you, or use it for advertising. None of these providers is an advertising, analytics, attribution or data-broker company, because Zaplog uses none of those.

One exception on roles. Our payment processor and the app stores act as independent controllers for their own fraud-prevention, regulatory and tax obligations, not purely on our instructions. That is inherent to processing a payment, and your relationship with them is governed by their own privacy policies as well as this one.

If we add a category of recipient, or materially change what an existing category receives, we will update this section and — where the law requires it — notify you or ask for your consent.

1010. International data transfers

Zaplog Inc. is based in the United States, and our infrastructure and providers operate in the United States and other countries. If you use Zaplog from outside the United States, your information will be transferred to and processed in the United States and potentially elsewhere, where data protection laws may differ from those in your country.

Where we transfer personal data out of the EEA, the UK or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum, incorporated into our agreements with providers; and
• supplementary technical measures, including encryption in transit and at rest, and end-to-end encryption for the categories listed in section 7.2.

You can request a copy of the relevant transfer safeguards by writing to support@zaplog.ai.

1111. How long we keep information

11.1 Account deletion in detail

Go to Settings → Account → Delete account. You must type DELETE and confirm with your biometric.

No longer have the app? Email support@zaplog.ai with the subject “Delete my Zaplog account” and the phone number on your account, including the country code. We check that the account is yours by sending a one-time code by text message to that number. Once you send the code back, we schedule the deletion exactly as the app does and email you to confirm. We answer every request within 30 days. The steps are also at zaplog.ai/delete-account.

• A 30-day grace period begins. All your sessions are revoked.
• Signing in again during those 30 days cancels the deletion.
• After 30 days, a scheduled process purges your account data.
• Rooms posts and comments are retained and re-attributed to an anonymous deleted-account placeholder, so threads other people participated in are not destroyed.
• Rooms you created transfer ownership; groups you administered pass to another admin.
• Messages already delivered to other people's devices cannot be reached by us. The app tells you this before you confirm.
• Transaction and tax records are retained for the period in the table above. Deleting your account does not cancel a subscription bought through a store — cancel it in Google Play or the App Store as well, or it will keep renewing.

1212. Your privacy rights and how to exercise them

12.1 Rights available to everyone, in the app

12.2 Rights under the GDPR and UK GDPR

If you are in the EEA, the UK or Switzerland you have the right to: access your personal data and receive a copy; rectify inaccurate data; erase your data; restrict processing; object to processing based on legitimate interests; data portability; withdraw consent at any time; and not be subject to a decision based solely on automated processing with legal or similarly significant effects.

You also have the right to lodge a complaint with your supervisory authority. A list of EEA authorities is at edpb.europa.eu; in the UK, the Information Commissioner's Office at ico.org.uk.

12.3 Rights under California law (CCPA / CPRA)

California residents have the right to know what personal information we collect, use, disclose and retain; to delete it; to correct it; to opt out of sale or sharing; to limit the use of sensitive personal information; and to non-discrimination for exercising these rights.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is no opt-out to offer. We use sensitive personal information — which for us includes precise geolocation when you share it, health data, and the contents of your communications — only to provide the features you asked for and for security and safety, which are permitted purposes that do not trigger the right to limit.

Categories of personal information we have collected in the last 12 months, using the CCPA's own categories: identifiers; customer records; characteristics of protected classifications (age, sex); commercial information (subscription and transaction records for Zaplog Pro); internet or network activity; geolocation; sensory data (audio, photographic, video); professional information (none); education information (none); inferences (limited to feature personalisation); and sensitive personal information as described above.

12.4 Rights under other US state laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws have rights to access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and certain profiling. We do not conduct targeted advertising, sale, or profiling with legal or similarly significant effects.

Where state law provides an appeal right, you may appeal a denied request by replying to our decision; we will respond within the period your state's law requires.

12.5 Rights elsewhere

We extend access, correction, deletion and portability rights to all users regardless of location, including under Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and similar laws.

12.6 How to make a request

Email support@zaplog.ai from the email address on your account, or from within the app so we can associate the request with your account. Tell us what you want and which jurisdiction you are in.

• We will verify your identity, usually by sending a code to your registered phone number. We ask for this because your phone number is your account.
• We respond within 30 days (GDPR) or 45 days (US state laws), extendable once where the law permits, and we will tell you if we need the extension.
• Requests are free unless they are manifestly unfounded or excessive.
• One limit on erasure: we cannot delete transaction and tax records within their statutory retention period. We will delete everything else and tell you precisely what was retained and why.
• You may use an authorised agent; we will ask for proof of authorisation and may still verify your identity directly.

1313. Health and consumer health data

ZapFit and parts of Organized process information that several laws treat with heightened protection, including GDPR Article 9 special-category data, the Washington My Health My Data Act, Nevada SB 370, and similar state consumer-health-data laws.

What we treat as health data

• Everything in ZapFit: your biological sex, date of birth, height, weight, body measurements, body-fat percentage, dietary pattern, allergies, avoided foods, food and water logs, exercise logs, fasting sessions, and your onboarding answers about sleep, stress, motivations and obstacles.
• Health-store records from Health Connect or Apple Health: steps, active calories, sleep sessions, weight and exercise.
• Meal photos and nutrition-label photos.
• Organized mood check-ins.
• Organized menstrual-cycle logs, including period start and end dates and derived cycle-phase predictions.

Our commitments

1. We collect this data only because you chose to use these features, and we ask for your explicit consent — through the feature itself and, for platform health data, through the separate health permission flow that Android (Health Connect) and iOS (the Health app) each run outside Zaplog.
2. We use it only to operate the feature you are using: computing your targets, showing your trends, predicting your cycle phase, and generating the analysis you requested. This holds on every platform.
3. We never use health data for advertising or marketing, and we never sell it. Google Play's Health Connect policy requires this; we commit to it independently and it applies to all health data in Zaplog, not just Health Connect data.
4. We do not share health data with any third party except our infrastructure provider (which stores it) and our AI provider (which analyses a meal photo or planning description at your request).
5. You can delete any health entry, delete your ZapFit profile, or export your ZapFit data at any time.
6. Revoking the permission — in Health Connect on Android, or the Health app on iOS — stops all further reads immediately. Records already imported remain until you delete them.

Washington My Health My Data Act notice. If you are a Washington resident, you have the right to confirm whether we collect, share or sell your consumer health data, to obtain a list of third parties with whom we share it, to withdraw consent, and to have it deleted. We do not sell consumer health data, and we do not require a valid authorisation for sale because no sale occurs. To exercise these rights, email support@zaplog.ai with "MHMD request" in the subject line.

Not medical advice. ZapFit and Organized are wellness tools. Calorie estimates from a photo are estimates. Cycle predictions are estimates and must not be relied on for contraception or family planning. Nothing in Zaplog is medical advice, diagnosis or treatment. Talk to a qualified clinician about your health.

1414. Children and teenagers

14.1 Minimum age

You must be at least 13 years old to use Zaplog. In the European Economic Area, the United Kingdom and any other country where the digital-consent age is higher, you must be at least 16, or the age your country specifies. Creating a Room requires you to be 18 or older.

We ask for your date of birth at onboarding and enforce a minimum of 13 at the database level. Your date of birth is write-once and cannot be edited in the app.

14.2 Protections for accounts under 18

• Accounts belonging to users under 18 are not username-searchable by default.
• Room age gates — 13 or 18 — are enforced against your stored date of birth, so an 18+ Room is closed to you.
• Under-18 users cannot create Rooms.
• Under-18 users cannot join private Rooms, and are removed from a Room that becomes private.

14.3 We do not knowingly collect from children under 13

Zaplog is not directed to children under 13 and we do not knowingly collect personal information from them, consistent with the US Children's Online Privacy Protection Act (COPPA) and equivalent laws elsewhere. If we learn that we have, we will delete the account and its data promptly.

If you are a parent or guardian and believe your child under 13 has created an account, email support@zaplog.ai with the phone number on the account. We will verify the request and delete the account and its data. You may also ask us to stop any further collection.

14.4 A note on age verification

Age is currently self-declared. We do not run documentary or biometric age verification. We enforce the age you declare, and we act on credible reports that a user is below the minimum age.

1515. Information about people who do not use Zaplog

If you use Zaplog, some information about people who are not Zaplog users may reach us:

• Contact discovery, if you agree to it, sends the phone numbers in your address book to our servers so we can identify which are registered. Numbers that do not match an account are used only to compute that result and to enforce the daily lookup limit, for which we keep a hash of each number until the user's next day of lookups.
• Saved contacts — when you save a contact in Zaplog, that person's name and phone number are stored on our servers so they sync to your devices.
• Content you post — a non-user's name, image or information may appear in a message, Room post or file you upload.

You are responsible for having a lawful basis to share other people's information with us. In some jurisdictions, uploading an address book requires the consent of the people in it.

If you are not a Zaplog user and want to know whether we hold information about you, or want it deleted, email support@zaplog.ai. We will need enough information — normally the phone number in question — to locate any records, and we will confirm what we hold and honour deletion where we are not legally required to retain it.

1616. Advertising, selling and sharing — what we do not do

Being explicit, because this is unusual enough to be worth stating:

• Zaplog contains no advertising. There is no ad SDK, no ad mediation, no sponsored content system.
• Zaplog contains no third-party analytics SDK of any kind.
• Zaplog contains no attribution, install-measurement or marketing-metrics SDK.
• Zaplog contains no third-party crash-reporting SDK.
• Zaplog contains no social-network SDK.
• We do not sell personal information for money or other valuable consideration.
• We do not share personal information for cross-context behavioural advertising.
• We do not use your private content to train AI models — not ours, and not our provider's.
• We do not use Health Connect or Apple Health data, or any health data, for advertising.
• We do not use payment or subscription data for advertising, and subscribing to Zaplog Pro does not change how any of your data is handled.

If any of this changes, we will update this policy and give you advance notice, and where the law requires consent we will ask for it before the change takes effect.

1717. Automated decision-making and profiling

We use automated systems in a few places:

• Automated moderation in Rooms — banned-word and pattern matching, link and spam rules, rate limits, crowd control and ban-evasion signals. These can automatically remove content, queue it for human review, mute, or restrict an account.
• AI checks in Rooms — plain-English rules and content-safety scores that a Room's moderators turn on, which can remove, hold or flag content like any other rule, and self-harm support notices, which only offer help and alert moderators.
• Rate limiting and abuse prevention across the platform.
• AI-generated outputs — answers, meal estimates, plan proposals and summaries.

Human review. Moderation actions with meaningful consequences — removals, bans and restrictions — can be appealed, and appeals are reviewed by a person. Room-level actions are appealed to the Room's moderators; platform-level actions are appealed to Zaplog's Trust & Safety team via modmail or support@zaplog.ai.

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing without the ability to obtain human review.

1818. Changes to this policy

We may update this policy as Zaplog changes. When we do:

• We revise the "Last updated" date and increment the version.
• For material changes — a new category of data, a new purpose, a new class of recipient, or a change that reduces your rights — we will notify you in the app and, where we have your email address, by email, at least 30 days before the change takes effect, unless the change is required to take effect sooner by law.
• Where a change requires your consent under applicable law, we will ask for it before the change applies to you.
• Previous versions are available on request at support@zaplog.ai.

Continuing to use Zaplog after a change takes effect means you accept the updated policy. If you do not accept it, you can delete your account.

1919. How to contact us

Privacy questions, rights requests, and anything else in this policy: support@zaplog.ai

Postal: Zaplog Inc. 33 N La Salle St Chicago, IL 60602 United States

EEA and UK representatives: if we are required to appoint an Article 27 representative, their details will be published here.

Data Protection Officer: if we are required to appoint one, their contact details will be published here. In the meantime, privacy matters are handled directly at support@zaplog.ai.

We aim to respond to every privacy enquiry within five business days, and to formal rights requests within the statutory period.

Appendix A — Google Play Data Safety mapping

This appendix summarises what Zaplog declares in the Google Play Data safety section. It is a summary; the body of this policy controls.

Payment note: in-app purchases are processed by Google Play on Android and by the App Store on iOS. Payments on the web are processed by Stripe. Zaplog never receives or stores card numbers.

Security practices declared: data is encrypted in transit; certain data is end-to-end encrypted; you can request data deletion; the app follows the Play Families policy where applicable; the app has committed to Play's Health Connect data-use restrictions.

Appendix B — Region-specific disclosures

B.1 California — "Shine the Light"

California Civil Code § 1798.83 allows California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

B.2 California — Do Not Track

Zaplog's built-in browser does not respond to "Do Not Track" signals, because there is no consistent industry standard for them; it applies an on-device tracker blocklist instead. Zaplog itself does not track you across third-party websites on any platform, and our web client sets no analytics or advertising cookies.

B.3 Nevada

Nevada residents may submit a request to opt out of the sale of certain personal information. We do not sell personal information. You may still submit a request to support@zaplog.ai.

B.4 Colorado, Connecticut and other universal-opt-out states

We honour universal opt-out mechanisms such as Global Privacy Control where they apply. Because we do not sell or share personal information for targeted advertising, such a signal does not change how we process your data.

B.5 European Economic Area, UK and Switzerland

See sections 6, 10 and 12.2.

B.6 Brazil (LGPD)

Brazilian users have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Contact support@zaplog.ai.

B.7 Canada (PIPEDA / Law 25)

Canadian users may access and correct their personal information and may complain to the Office of the Privacy Commissioner of Canada. Quebec residents have additional rights of portability and de-indexing under Law 25.

B.8 Australia

Australian users may access and correct personal information under the Australian Privacy Principles, and may complain to the Office of the Australian Information Commissioner.