Privacy policy

What we collect

• Account details: your name, username, email address and password (stored only as a secure hash). If you sign in with Google or GitHub we receive your name, email and profile picture from them.
• What you post: posts, comments, likes, follows, profile details, photos, the messages you send in chats and your reactions to them. Messages you schedule are stored on our servers until they are sent or you cancel them.
• Calls: who called whom, when, and how long the call lasted. Audio and video travel through our own media server and are never recorded.
• Technical data: your IP address and browser details on each sign-in session, so you can stay signed in and we can protect accounts. Photo location data (EXIF/GPS) is removed when you upload.
• Safety records: reports you send, accounts you block and moderation decisions about your content.

Why we use it

• To run the service: show your posts, deliver messages and connect calls.
• To keep people safe: review reports, find spam and abuse, and enforce our terms.
• To send account emails such as verification and password resets.

AI features

AI requests are sent to OpenRouter, which forwards them to the provider of the model we use (currently deepseek/deepseek-v4-flash-0731). Those companies process the text to produce a response under their own terms.

AI only sees text when you use a feature like “Write with AI” or “Catch me up”, or when new public posts and comments are checked for abuse. Private messages are only sent to AI when someone in that chat asks for a summary.

Who we share it with

What you post publicly is visible to anyone. Messages are visible to the people in that chat. Admins can see content that is reported to them. Beyond that, we share data only with services that help us run ZubTalk: our hosting provider, our email delivery provider, the push service that delivers notifications to your device, KLIPY for GIF search, and OpenRouter for AI features. We share data with authorities only when the law requires it.

Push notifications

If you turn on notifications, your browser or phone gives us an address at its push service (run by Google, Apple, Mozilla or Microsoft, depending on the device). Notifications sent to a web browser are encrypted for your device before they leave our servers, so the push service can't read them. Notifications sent to the Android app go through Google's Firebase Cloud Messaging and are not encrypted in that way, so Google's service handles what they contain, such as a sender's name, a preview of the message, or a caller's name and a link to their photo. You can hide names and message text from notifications, or turn them off, in Settings › Notifications.

The mobile app

• Camera and microphone: used for calls. During a call they keep working if you leave the app, and Android shows a notification while they do.
• Photos: the app only receives the photos you choose to send or use as your profile picture.
• Notifications: used for messages, activity and incoming calls, including showing an incoming call on your lock screen.
• Stored on your phone: a copy of your conversations and recent messages is kept on your device so the app opens quickly, and it is removed when you sign out.

GIFs

GIF search is provided by KLIPY. When you search for or send a GIF, your search text and an anonymous ID that doesn't include your name or email go directly from your device to KLIPY. GIFs load directly from KLIPY, for you and for the people you send them to, so KLIPY can see the IP address of each device that loads one.

Cookies

We use one essential cookie to keep you signed in, plus a short-lived one that holds an invite code while you sign up. We don't use advertising or tracking cookies.

How long we keep it

We keep your data while your account exists. Things you delete disappear right away and are erased from our database within 30 days. "Delete for me" is different: it only hides a message from you, and the message stays for everyone else in the chat until its sender deletes it. When you delete your account, your profile, posts, comments, messages and uploads are deleted immediately. Encrypted backups roll over within 30 days.

Your choices and rights

• Download a copy of your data or delete your account in Settings › Account.
• Edit your profile at any time, and block or report anyone.
• Depending on where you live, you may have more rights, such as objecting to processing or complaining to a data protection authority.

Children

ZubTalk is not for children under 13, and we don't knowingly collect their data.

Contact

Questions or requests about your data: [email protected]. If we change this policy in a meaningful way, we'll tell you in the app.