Privacy Policy

1. Account Information

Zovia accounts are anonymous by default. When you open any Zovia app for the first time and tap "I'm new," we generate a real account with no email and no password. We collect:

• • **Anonymous device credential:** A randomly generated identifier stored in your device's secure keychain. Used to authenticate API requests from your phone.
• • **Display name:** Auto-generated at sign-up (e.g., "Sleepy Marmot"). Editable at any time.
• • **Recovery code hash:** We store a one-way hash of the 28-character recovery code you saw once at sign-up. Used to verify the code if you ever need to sign in on a brand-new device. We do not store the code itself.
• • **Passkey public key (optional):** If you enable a passkey, we store the public half on our server. The private half lives in your device's Secure Enclave or StrongBox and never leaves it.
• • **Optional email address:** You can add an email later from the Profile screen for notifications or recovery messages. Email is never required and is never used as the sign-in identifier.
• • **Pairing tokens (temporary):** Short-lived 8-character codes generated when you pair a new device via QR scan. Expire after 5 minutes.

2. App Data You Create

The content you create varies by app:

• • **Zistil:** Inventory items (names, categories, quantities, expiration dates), item photos, purchase details, insurance policies, serial numbers, notes, voice search queries (transcribed via Google Cloud Speech Recognition API), scanned receipts and barcodes (processed via Google Cloud Vision API)
• • **Zots:** Counter names, current counts, counter history (who incremented/decremented and when), scheduler names, scheduled times, completion records, notes
• • **Zyve:** Activity titles, descriptions, start/end times, activity types (task/meeting/event/reminder/busy block), location names and GPS coordinates (when you add locations), Google Place IDs, attendee assignments, completion status
• • **Zuzzle:** Game progress, puzzle solutions, completion times, best scores, stars earned, daily challenge completions, hints used
• • **Zupply:** Grocery list items (names, categories, quantities), scanned receipts (images processed via Google Cloud Vision API for text extraction, then parsed by Google Gemini AI for intelligent line-item recognition), receipt line items, store visits and nearby store detection (via Google Places API when you grant location permission), price history, purchase matching data
• • **Zynq:** Check-in status (active, paused, escalated), activity timestamps (when you last used your phone), "I'm Good" confirmations, optional location data (only when you choose to share it with check-ins), alert history, pause settings
• • **Zarden:** Plant names, species and nicknames, plant photos (identification, health checks, treatments, propagation), where each plant lives in your home, pot size, care log history (watering, fertilizing, check-ins) with timestamps, journal notes, custom notes, your growing zone, and light-meter brightness readings (measured on your device, and the camera frames used to measure them are never uploaded or saved)
• • **Spaces (all apps):** Shared space names, member email addresses (if the member has added one), member roles, permissions, invite tokens

3. Location Data

**Zyve, Zistil, Zupply, Zynq, and Zarden collect location data** when you use location-based features:

• • **Zyve:** GPS coordinates of locations you add to activities, Google Place IDs, location names/addresses, your current location (when you enable smart reminders for travel time calculations)
• • **Zistil:** Your current location (optional, for contextual reminders and weather information)
• • **Zynq:** Your current location (optional, only when you choose to include location with "I'm Good" check-ins as a Premium feature). Location is never collected automatically or in the background.
• • **Zupply:** Your current location (optional, for detecting nearby grocery stores when you use Store Mode). Location is sent to Google Places API to find stores near you. Location is only collected when you actively use Store Mode, never in the background.
• • **Zarden:** Your approximate location, used to detect your USDA growing zone (once, then cached) and to look up local weather, recent rainfall, and air quality that shape your care advice. Weather lookups happen only while you are using the app, never in the background. You can update or remove your zone at any time in settings.
• • **We do NOT:** Track your location continuously, store location history, use background location tracking, or monitor your movements.
• • **Other apps:** Zots and Zuzzle do NOT collect any location data.

4. Photo Data

**Zistil, Zupply, and Zarden collect photos** for receipt scanning, documentation, and plant care:

• • **Zistil item photos:** Photos you attach to an item. Free includes one photo per item; Premium and Gold include unlimited photos per item.
• • **Zistil receipt photos:** Scanned receipts and purchase documentation
• • **Zupply receipt photos:** Receipt images for OCR scanning (processed via Google Cloud Vision API to extract line items and prices)
• • **Zarden plant photos:** Identification and health-check photos, sent through our secure cloud functions to Google Gemini AI for species recognition and health analysis. Check-in, treatment, and propagation photos are saved to your plant timeline. Plant photos are never analyzed for facial recognition and are never shared with advertisers.
• • **Zarden on-device safety check:** Before any photo leaves your phone, Zarden checks on the device that it looks like a plant and not a person, so an unintended photo is declined before it is ever uploaded.
• • **Storage:** Photos are compressed and stored in Firebase Storage
• • **Other apps:** Zots, Zyve, Zynq, and Zuzzle do not use photos for app content. Like every Zovia app, they can open your camera to scan a device-pairing QR code, and your photo library if you choose a profile picture. Images used that way are used only for that purpose.

5. Usage and Technical Data

To improve our apps and fix bugs, we collect:

• • **Device information:** Device model, operating system version, app version, timezone
• • **Performance data:** App crash reports, error logs (via Firebase Analytics)
• • **Feature usage:** Which screens you view, which features you use (we track that you used a feature, not what specific data you entered)
• • **Game events (Zuzzle):** Level starts, completions, failures, hint usage, session duration
• • **Metered credit usage:** How much of a metered resource you have used in the current period, for the apps that meter one (for example Zupply OCR scans, Zyve smart reminders, ComingUp document scans, Zarden plant scans, Zistil AI scans)
• • **We do NOT track:** Your browsing outside our apps, your behavior for advertising purposes, or sell any usage data to third parties.

6. Payment Information

When you make a purchase (subscription or one-time), payment is processed entirely by Apple App Store or Google Play Store. We receive only:

• • **Purchase confirmation:** That you purchased a specific tier or product
• • **Transaction ID:** A unique identifier from Apple/Google for verification
• • **Purchase date:** When the purchase was made
• • **Subscription status:** For apps with subscriptions (Zynq, Zupply, Zyve, Zarden, Zots, Zistil), whether your subscription is active, expired, or canceled
• • **We NEVER see:** Your credit card numbers, billing addresses, or any payment method details. All payments are processed by Apple or Google.
• • **Subscription apps:** Zynq, Zupply, and Zarden offer auto-renewable monthly and yearly subscriptions, as well as lifetime (one-time) purchase options. Zots offers auto-renewable monthly and yearly subscriptions. Zyve and Zistil offer auto-renewable annual subscriptions, and Zyve adds one-time add-on packs that never expire. Subscriptions auto-renew until canceled at least 24 hours before the current period ends.
• • **One-time purchase apps:** Zuzzle offers one-time purchases only, with no recurring charges.
• • **Legacy purchases:** If you bought a one-time unlock in an app that has since moved to subscriptions, that purchase continues to work and you are never charged again.

Cloud Storage

Your data is stored securely on **Back4App** (Parse Server), a trusted cloud hosting provider. All data is:

• • **Encrypted in transit** (HTTPS/TLS 1.2+)
• • **Encrypted at rest** (AES-256 encryption)
• • **Backed up regularly** to prevent data loss
• • **Access-controlled** using role-based permissions (you can only access your own data and Spaces you're a member of)
• • Photos (Zistil) are stored in Firebase Storage with the same encryption standards.

Local Storage

For offline-first functionality, data is cached locally on your device using secure device storage (iOS Keychain, Android EncryptedSharedPreferences). This local data syncs with the cloud when you're online and is deleted if you uninstall the app.

Security Measures

We implement industry-standard security practices:

• • Server-side user identity verification (prevents spoofing of user IDs)
• • Session token expiration and automatic rotation
• • Role-based access control for Spaces (owner/member permissions)
• • Private/public data separation (mark items as private to hide from space members)
• • Regular security audits and dependency updates

Access Your Data

You can view all your data within each app:

• • **Zistil:** Export inventory to CSV or PDF with photos (Settings → Export)
• • **Other apps:** View all data in-app. Automated export features are not yet implemented. Contact hello@zovia.studio to request a data export.

Correct Your Data

You can edit or delete any data you create directly in the app at any time. Changes sync immediately across all your devices.

Delete Your App Data

You can delete data for a specific app while keeping your Zovia account and other apps:

• • In-app: Profile or Settings → Reset [App Name]
• • Confirm deletion
• • Your data is deleted immediately (purchase history is preserved so you can restore your tier if you reinstall)

Delete Your Entire Account

To permanently delete your Zovia account and ALL data across all apps, you can do it directly in the app. No email required.

• • Open any Zovia app and go to Profile, then Privacy Dashboard
• • Tap "Delete Entire Zovia Account"
• • Confirm with Face ID, Touch ID, or your device passcode
• • Type DELETE to confirm intent, then tap Confirm
• • Your data is removed immediately from production servers
• • When you delete your entire account, all your data (items, counters, activities, game progress, photos, spaces) is permanently removed. Purchase records are anonymized and retained only for fraud prevention. Your recovery code and passkey are invalidated. This deletion is permanent and cannot be undone.
• • See our [Data Deletion](/data-deletion) page for detailed instructions.

Opt Out of Notifications

You can disable push notifications in your device settings (iOS: Settings → Notifications → [App Name]) or within each app (Settings → Notifications). You can also disable specific notification types (expiration alerts, smart reminders, completion notifications) individually.

Opt Out of Analytics

**Note:** Analytics opt-out is planned but not yet implemented. Currently, all apps collect anonymous usage analytics via Firebase Analytics. We do not collect personally identifiable information in analytics events.