Zona Notify Privacy Policy

Terabase is the controller of the personal data described in this policy, and its “data user” under Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486). You can contact us at terabasedevteam@gmail.com. Where alerts your sources send contain personal data about other people that you, or an organisation you use Zona for, control, you are the controller of that data and we process it on your behalf, as “Personal data in your content” in the Terms of Service describes.

This policy covers:

• the Zona apps for iPhone, iPad and Android, including their widgets and Live Status;
• the Zona notification service and its API;
• the Zona command-line tool, agent hooks and MCP server (“PC tools”);
• the website at zonanotify.app and Zona’s other public pages;
• messages you send to our support address.

It does not cover services run by others, such as Apple, Google or a sign-in provider you choose, which handle your data under their own privacy policies.

Before you sign in or continue as a guest on a device, and again after we make a material change to this policy or the Terms of Service, the app asks you to confirm that you have read and agree to the Terms of Service and this policy. For this policy, that confirmation is an acknowledgement that you have read it, not consent to processing: this policy sets out the legal basis for each use of your data, and where we rely on consent we ask for it separately.

• Zona stores what your sources send so that it can show it in your private inbox and notify your devices.
• Alerts are deleted automatically after your plan’s retention period: one day for guest accounts, seven days on Standard and thirty days on Zona Plus. An alert keeps the longest period of any plan you had while it was in your inbox, so a shorter plan, including the end of Zona Plus, never deletes it early. Alerts you pin are the exception: a pinned alert is kept until you unpin it or its pin expiry passes, as explained in “How long we keep data”.
• We do not sell your personal data, show advertising or track you across other companies’ apps or websites, and the app contains no third-party analytics or crash-reporting software: its own crash reports go only to Zona, to fix errors in the app.
• Your data is stored with Supabase in Sydney, Australia, and processed by our providers in the United States and other countries.
• You can delete your account, and the data linked to it, in the app at any time.

Most of the data below comes from you, your sources and your devices. Some comes from Apple, Google, GitHub or Expo when you use their services with Zona.

Account and sign-in

An account identifier and whether the account is a guest account. If you use email, your email address and password; the password is stored by Supabase Auth only in hashed form, and we never see it. If you sign in with Apple, Google or GitHub, the account identifier, email address and profile details that the provider shares with us, such as your name, username and a link to your profile picture, which Supabase Auth stores with that sign-in method and with your account until you delete your account. The sign-in methods linked to your account and when they were added or removed; if you remove a sign-in method, a record of that method (the provider, its account identifier and email address) so that it is not linked again without your action. Your language and time zone, and a display name if you set one. Your sign-in sessions, and a record of account security events such as sign-ins, added or removed sign-in methods, re-authentication, device removal and account deletion.

Sources and source keys

For each source: its name, an optional hostname you enter, the emoji, colour and sound you choose, and when it was created, last used and revoked. For each source key, a one-way hash of the key, its first eight characters after the zona_live_ prefix, which the app shows so that you can tell keys apart, the label you give it, and when the key was created, last used, expires or was revoked. A source key is shown to you in full only once, and Zona does not store the full key.

Alerts and attachments

The content your sources send: the title, body, category, severity, checklist, structured data and up to five images. The source name at the time the alert arrived, when the alert was received, read and pinned, when it expires, any severity or pin expiry you set, and technical fields that stop the same alert from being stored twice. Images are kept in private storage that only your account can reach.

Devices and push notifications

A random installation identifier created by the app; your device’s platform, app version and build number; the push token that Expo, Apple or Google issue for your device; whether delivery to that device is turned on; whether you allowed critical alerts for Zona on that device (on iPhone and iPad, in its notification settings; on Android, for Zona’s Critical alerts channel); and the results of push attempts, such as Expo ticket identifiers, status and error codes. Zona does not collect the name you gave your device, your phone number, contacts, location or advertising identifier.

Settings and productivity features

Your preferences, such as message previews, sounds, whether you receive Dev note push notifications, and appearance; quiet-hours schedules and the time zone they use; saved inbox filters; and checklists inside alerts.

Check-ins, repeated alerts and agent sessions

If you add a check-in to a source, Zona stores its name and label, its schedule (how often, or after which daily run, the source should report, the time zone, the grace time and how many misses in a row count), the level and language of the alerts it writes, whether it is paused, each check-in your source sends (when it arrived and whether it reported success, a start or a failure), each missed check-in and each resulting incident. Zona’s servers compare these records with the schedule every minute, and write an alert to your inbox when a check-in is missed, fails or recovers. If you turn on Ring until seen for a source, Zona stores that choice and, for each alert that rings, how many times it has rung and when it stopped. If your AI agent tools send agent updates, Zona stores for each session: a one-way hash of the session identifier the tool uses, the agent’s name, the project folder name unless you install the hooks with --no-project, its state (waiting on you, running, finished or failed), when it started and was last updated, and, only if you install the hooks with --share-question, the agent’s own short message about what it is waiting for, cut to 200 characters. Zona’s tools remove text that looks like a key, token or password from that message before sending it, and Zona’s server checks it again. An alert that a check-in or an agent update wrote is marked as coming from it, and is marked resolved, with the time and the reason, when the check-in recovers or the agent moves on.

Zona Plus purchases

If you buy Zona Plus, Apple sends us signed records of your transactions and renewals, which we check and store, linked to your account: the product, the original and current transaction identifiers and the order identifier, the environment, the purchase, renewal and expiry dates, the price and currency, the App Store country or region (storefront), any offer or free trial used, your subscription status, whether it will renew and to which product, why a subscription ended or is in billing retry, and the date and reason of any refund or revocation, and the other details in Apple’s signed records, such as the renewal price and currency, any price-increase consent, a grace period, the quantity and whether the purchase is shared through Family Sharing; and whether the record reached us from a purchase, from Restore Purchases or from one of Apple’s notices. When you buy, the app gives Apple your Zona account identifier as an app account token, so that Apple’s notices about renewals, refunds and expiry can be matched to your account. The app also reports how the purchase went, such as whether the plans loaded and whether a purchase, verification or restore succeeded, with product identifiers, counts and error codes, and never a receipt, a transaction identifier or payment details. Apple processes the payment; we never receive your payment card details.

Zona Plus given to your account

We may give Zona Plus to an account without a purchase, for example to the operator’s own account, to a tester or during a promotion. If we do, we keep a record of it, linked to your account: when it starts; when it ends, if it has an end date; when we withdrew it, if we did; and a short note of why it was given. The app receives only whether Zona Plus is included with your account and its end date, if it has one; the note stays with us and is never shown in the app.

Live Status on iPhone and iPad

If you use Live Status, its buttons use a Live Status action key that can only mark alerts read, pin, unpin or delete them, only for the sign-in session on that device, and for at most 12 hours. The key is kept, with the service address, the app’s public key, the key’s expiry and your account identifier, in a file in Zona’s own app container on the device, which is excluded from device backups and which only Zona and its own widget and Live Status extensions can open. Our servers keep only a one-way hash of it, with its expiry, the sign-in session it belongs to, and when and how often it was last used, so that it can be limited and revoked. The key is deleted and revoked when the card ends, when you sign out on the device, or when another account signs in.

Your acceptance of these documents

When you agree to the Terms of Service and this policy in the app, the agreement is first kept on your device, as described in “Data stored on your device”. Zona then records it on our server for the account signed in on that device, guest accounts included; if you agree before you have an account, it is recorded when you sign in or continue as a guest. Each server record contains: your account identifier; a one-way hash of that identifier; the versions of the Terms of Service and this policy that you accepted; the time the record was made on our server, which is the time we rely on; the time your device reported for the agreement, which is not stored if it differs from the server time by more than a day; the app language; and the app version and build number, and the platform (iOS, Android or web). Only the first record for each pair of versions is kept: if the same versions are recorded again for your account, nothing new is stored. Accepting new versions creates a new record.

Security, abuse-prevention and diagnostic data

Records we need to run and protect the service: rate-limit records for each source and account; records of device sessions and removed devices; short-lived records of sign-in and re-authentication steps; operational logs from our server functions, such as request identifiers, outcome, status code and duration; and diagnostic events that the app sends to our own service, such as the event name, an error message, the app version and build, the platform and the installation identifier. These logs are designed not to contain alert content, tokens, passwords or email addresses. We also calculate daily usage totals for the service and for each account, such as the number of alerts received, and summaries of errors, which can include up to 160 characters of an error message, are sent to the operator’s own Zona inbox so that problems can be fixed. Zona’s own code does not record your IP address or your device’s or browser’s user agent. Supabase Auth, which runs in Zona’s database, stores the IP address and user agent of each sign-in session while the session exists, and may keep an audit log of sign-in and account events with the IP address and email address involved, which a daily cleanup deletes after one year. Our hosting providers may also record them in their standard logs, as described below.

If the Zona app hits a software error, it keeps a crash report and sends it to Zona once someone is signed in. A report holds the error’s name, message and technical trace; the screen it happened on, whether it closed the app, and how often it repeated; the phone’s model name, model identifier, maker, operating system and version, and whether it is a real device; the app version and build, any over-the-air update it is running, and the app language; and the installation identifier. Before a report is saved on the phone or sent, the app removes anything that looks like a key, token, password or email address, and the query part of every web address, such as the code in a sign-in link; Zona’s servers check again for Zona keys, tokens, email addresses and web-address queries. Zona never reads the name you gave your phone. A report can still hold a fragment of other text the app was handling when the error happened, such as part of an alert, which is one reason only the operator can read reports and they are kept for 30 days. A report made while no one is signed in waits on the phone and is sent under the account that signs in next; a report made under one account and still waiting when another account signs in is deleted, never sent under the other account. Crash reports are linked to your Zona account and are used only to find and fix crashes and errors in the app.

Support messages

If you email us, we receive your email address, your message and anything you attach, through Google’s Gmail service.

Website

zonanotify.app is served by Cloudflare. The site does not set its own cookies and does not use analytics or advertising scripts. Cloudflare processes your IP address and the details of each request to deliver and protect the site. The API documentation remembers the code-sample tab you prefer in your browser’s local storage; that choice is not sent to us. Older copies of our public pages are also served by GitHub Pages and by our Supabase project, which process similar request details.

PC tools

The PC tools run on your computer. They keep your source key in a file in your home folder (~/.zona/token), or read it from the ZONA_SOURCE_TOKEN environment variable, and send only alerts, check-ins and agent updates to Zona’s notification service: the alerts and check-ins that you or your agents ask them to send and, if you install the agent hooks, an update each time a connected AI agent starts or keeps working, finishes or needs your input. An update names the agent and carries the agent’s session identifier, its state and, unless you install the hooks with --no-project, the project folder it worked in; it carries the agent’s own message about what it is waiting for only if you install the hooks with --share-question. The hooks keep a short log of failed sends in ~/.zona/hooks.log and a note of each session’s last state in ~/.zona/agent-sessions, which stay on your computer. The PC tools do not collect other data from your computer and do not report usage to us.

To work quickly and offline, the app keeps some data on your device: your sign-in session, in the device’s secure storage; while you confirm an email address you add, a short-lived record of that step (the email address and a transaction identifier) and, if you chose a password, the password, both in the device’s secure storage (in a web browser, its local storage) for up to ten minutes, deleted when the confirmation finishes or is cancelled, or at your next sign-in attempt if it expired; caches of recent inbox pages, sources, preferences, service settings and Dev notes; your language, appearance and other in-app choices; which Dev notes you have read; the day you last dismissed the overnight check-in summary; whether Zona has already asked you about critical alerts and, on Android, whether you turned them on in Zona; actions waiting to be sent; crash reports waiting to be sent (at most 20, none older than seven days); the installation identifier; your agreement to the Terms of Service and this policy (the versions, when you agreed and the app language), with a note of the accounts it has been recorded for, or, if you decline them while signed in, a note of that account and whether our server has stopped sending alerts to the device; and, when you use them, the content shown on Home Screen widgets and the Live Status card. This data stays on your device and is removed when you delete the app, except what the app keeps in the device’s secure storage, such as the sign-in session: on iPhone and iPad the system can keep it after the app is deleted, so reinstalling Zona on the same device can sign you back in. Signing out before you delete the app removes it. Except for the Live Status file described above, your device’s system may include this data in your device backups. Signing out or deleting your account removes the agreement from the device, so the next person to use the app there is asked to agree.

We use personal data only for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the legal basis for each purpose is shown in brackets.

• To create and secure your account, sign you in and keep each account’s data separate (contract).
• To receive, store, synchronise, show, pin, filter, export and delete alerts, and to send push notifications (contract).
• To watch your check-ins and write an alert when one is missed, fails or recovers, to repeat a push notification you asked Zona to repeat, and to show your agent sessions (contract).
• To provide Zona Plus: to verify, restore, renew, expire, refund or revoke subscriptions, and to give Zona Plus to an account without a purchase and end it (contract; legal obligation for records we must keep).
• To enforce rate and plan limits, and to prevent abuse, fraud and security incidents that could harm users, our providers or Terabase (legitimate interests in running a secure and reliable service).
• To diagnose problems, find and fix crashes and errors in the app, and improve reliability, using logs, diagnostic events, crash reports and daily usage totals (legitimate interests in operating and improving Zona).
• To record your acceptance of the Terms of Service and this policy, and to keep a limited record after your account is deleted (legitimate interests in being able to show what was agreed and to establish, exercise or defend legal claims).
• To answer your support requests and to tell you about your account, security or changes to Zona, including in Dev notes, our announcements about the service (contract; legitimate interests).
• To comply with the law, respond to lawful requests from public authorities, and establish, exercise or defend legal claims (legal obligation; legitimate interests).
• To show push notifications, which your device sends only if you allow notifications in its settings; you can withdraw that permission at any time (consent, given through your device’s permission prompt).

We do not use your data for any other purpose that is incompatible with these, unless we tell you first and, where the law requires, ask for your consent.

When Message previews is on, each push notification that Zona sends through Expo’s push service and Apple Push Notification service (on iPhone and iPad) or Firebase Cloud Messaging (on Android) contains the alert’s title and body, the source name, the alert and source identifiers and the severity. Your device may show them on the lock screen, where anyone who can see the device can read them. When you turn Message previews off in Settings, each push notification carries only a generic message with those identifiers and the severity, and the full alert stays in your inbox. You can also control previews in your device’s notification settings.

If you turn on Ring until seen for a source (Zona Plus), the push notification for an alert at the level you chose is sent again every few minutes, up to the number of times you chose and for at most 30 minutes, until you open, pin or delete the alert on any device or it is resolved; each repeat carries the same content as the first push and replaces it on your device, and repeats follow your quiet hours. A push for an alert that a check-in or an agent update wrote also carries the identifier Zona gave that check-in or agent session, so that the next push about it replaces the last one on your device. If you allow critical alerts for Zona on a device, push notifications for alerts marked critical ask that device to play a sound even when it is on silent or in Do Not Disturb, where the device allows it; you can turn critical alerts off in your device’s settings at any time.

Zona also sends Dev notes: short announcements from Terabase about the service, such as new features, planned maintenance or an outage, to every account. A Dev note appears at the top of your inbox and in Settings, never as an alert in your inbox, and arrives as a push notification that contains the note’s title and text and a note identifier, and no alert, source or account data; with Message previews off, it carries only a generic message. Dev notes are not advertising. A Dev note push is not sent while your account’s quiet hours apply or when you have turned push notifications off, and you can turn Dev note push notifications off in Settings under Dev notes. Which Dev notes you have read is kept only on your device.

Do not send passwords, API keys, source keys, sign-in links, payment details or other sensitive information in alerts. As a safety net, the app hides text that looks like a common credential, such as an access token, an API key or a password in a link, before alert text is copied, shared, exported, or shown on a Home Screen widget, the Live Status card or an in-app banner. It recognises common formats only, it does not change the push notifications your device displays, and the inbox shows alerts as they were sent.

• We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.
• We do not show advertising or build advertising profiles.
• We do not track you across other companies’ apps or websites, and we do not use your device’s advertising identifier.
• The app contains no third-party analytics, advertising or crash-reporting software; its own crash reports, described above, go only to Zona. If you have agreed in your device’s settings to share analytics or crash data with app developers, Apple, or Google on Android, may give us crash reports and aggregated app statistics under their own terms.
• We do not look at the content of your alerts except where you ask us to, for example in a support request, where it is needed to investigate a security or abuse problem, or where the law requires it.

We share personal data only with the recipients below, and only as needed for the purposes in this policy. Our service providers process data on our behalf under their own data processing terms.

• Supabase (database, sign-in, file storage, server functions, real-time sync and scheduled jobs, hosted in Sydney, Australia): all the account, source, alert, image, device, Zona Plus, acceptance, crash-report and diagnostic data described above. Supabase Auth also sends sign-in and account emails, through Supabase’s email service or an email delivery provider configured for it.
• Expo (push delivery and app updates, United States): push tokens and the content of push notifications; and, when the app checks for updates as it starts, technical details such as the platform, the app’s runtime version, the update channel and an update identifier created on your device, together with your IP address.
• Apple (App Store, TestFlight, Apple Push Notification service and Sign in with Apple): push notification content for iPhone and iPad; Zona Plus purchase data and the app account token; and, if you sign in with Apple, the account identifier, email address and any name Apple shares with us.
• Google (Firebase Cloud Messaging on Android, Google sign-in, and Gmail for our support mailbox): push notification content for Android devices; the account identifier, email address and profile details, such as your name and a link to your profile picture, that Google shares if you sign in with Google; and the emails you send us.
• GitHub (GitHub sign-in and older copies of our public pages): the account identifier, email address and profile details, such as your name, username and a link to your profile picture, that GitHub shares if you sign in with GitHub, and request details when you visit pages it hosts.
• Cloudflare (serves zonanotify.app): your IP address and request details when you visit the website.

We may also disclose personal data where the law or a valid legal request requires it; to protect the rights, safety or property of our users, Terabase or others; to investigate fraud or security problems; or with your consent. If Zona is transferred to a new operator, for example a company set up to run it, your data may be transferred as part of that; we will tell you in advance, and the new operator must honour this policy for the data it receives.

Terabase operates from Hong Kong. Zona’s database, sign-in and file storage are hosted by Supabase in Sydney, Australia (its ap-southeast-2 region). Expo, Apple, Google, GitHub and Cloudflare process data in the United States and in other countries where they or their subprocessors operate. Your personal data is therefore transferred to, and processed in, places outside Hong Kong and outside the country where you live, whose data protection laws may differ from yours.

Where the law requires it, we rely on safeguards for these transfers, such as our providers’ data processing terms and, where they apply, the Standard Contractual Clauses approved by the European Commission and their United Kingdom equivalent. For users in Hong Kong, this is our notice under the Personal Data (Privacy) Ordinance that your personal data will be transferred to, and processed by, the recipients and in the places described in this policy.

• Alerts and their images: your plan’s retention period, counted from when the alert was received: one day for guest accounts, seven days on Standard and thirty days on Zona Plus. Each alert keeps the period of the plan your account was on when it arrived, or the longer period of any plan you had while it was in your inbox: upgrading extends alerts already in your inbox, while a shorter plan, including the end of Zona Plus for any reason (cancelled, expired, refunded or revoked), applies only to alerts that arrive afterwards, so no alert is deleted earlier than the date it already had. An hourly cleanup deletes alerts whose period has passed. Exception: an alert you pin in the app is kept, with its images, until you unpin it or its pin expiry passes. A pin expiry is at most 365 days ahead, and a pin without an expiry lasts until you unpin it. The number of pinned alerts is limited by plan (currently 20 on Standard and 100 on Zona Plus), and on a guest account a pin ends with the alert’s normal retention. When a pin ends, normal retention applies again, and the next cleanup deletes the alert if its period has passed. Deleting your account removes pinned alerts too. An alert’s images are removed from storage when the alert is deleted, or by the hourly cleanup shortly afterwards.
• Push delivery records: deleted with the alert they belong to. The record of a Dev note push is deleted 30 days after it was made.
• Rate-limit records: one day for each source and two days for each account.
• Check-ins: a check-in’s settings are kept until you delete it, its source or your account. The record of each check-in, missed check-in and incident is kept for your plan’s alert retention period, and at most the 500 most recent for each check-in; the alerts a check-in writes are kept like other alerts. Records used to limit how often a source may check in are kept for one day.
• Repeated alerts and agent sessions: the record of how often an alert rang is deleted with the alert. An agent session is deleted seven days after its last update, or earlier when you remove it from the board, when its source is deleted or when you delete your account. Records used to limit how often a source may send agent updates are kept for one day.
• Sources and source-key hashes: while the source is active. A revoked source is deleted 30 days after it was revoked, once no stored alert refers to it. All sources are deleted with your account.
• Push registrations: while the device is registered. Signing out on a device deletes its registration, and so does declining the Terms of Service in the app there, until you agree and the app registers the device again. A registration that has been turned off, for example when you remove the device from your account, when another account signs in on it or when its push token stops working, is deleted seven days later.
• Devices, sessions and settings: installation and session records, preferences, saved filters, quiet hours, your profile and usage counters are kept while your account exists.
• Moving a guest account into your account: the account and sign-in session identifiers of both accounts, the dates and the number of items moved are kept while your account exists.
• Live Status action keys: a key works for at most 12 hours; its hash is deleted when your account next creates a key or when you delete your account.
• Sign-in sessions and the sign-in audit log: Supabase Auth keeps each sign-in session, with its IP address and user agent, until you sign out on that device or delete your account; sessions do not expire on their own; its audit log entries, where kept, are deleted one year after the event.
• Sign-in and re-authentication steps: these records expire within 10 minutes and are deleted by the hourly cleanup once they expire, or one day after they are used.
• Removed sign-in methods: the record that stops a removed sign-in method from being linked again is kept until you add that method again or delete your account.
• Account security events: deleted when you delete your account, and in any case one year after they happened.
• App and server diagnostic logs: 30 days. Error summaries in the operator’s Zona inbox are kept like the operator’s other alerts: at most 30 days, unless the operator pins one while fixing the error.
• Crash reports: Crash reports are deleted thirty days after Zona receives them, or earlier with your account. A report the app is still keeping on your device is deleted there once it has been sent, or after seven days if it cannot be sent.
• Daily usage totals: 400 days; your account’s totals are deleted with your account. Records of the operator’s daily reports are kept for 90 days.
• Zona Plus records: while your account exists, so that we can verify and restore your subscription, answer billing questions and handle disputes; deleted with your account. An App Store notice that does not match any Zona account is kept without a link to any account, with its type, product, environment, dates, transaction identifiers and the renewal details Apple sent, without the app account token, so that each notice is processed only once and as a business record, and a daily cleanup deletes it seven years after it arrived. A transaction record that is not linked to any Zona account, for example a renewal that Apple reports after you deleted your account without cancelling your subscription, is kept without any account identifier or app account token, so that billing questions can be answered and because Hong Kong tax law requires business records to be kept for seven years, and a daily cleanup deletes it seven years after Apple last sent it. Apple keeps its own records under its own policies.
• Zona Plus given to your account: the record, including one that has ended or that we withdrew, is kept while your account exists, as the record of what we gave, and is deleted with your account.
• Acceptance records: while your account exists. When your account is deleted, each record is pseudonymised: your account identifier is replaced by a one-way hash of it, kept with the versions, the times, the app language, and the app version, build number and platform. We can match the hash to your former account identifier, which the deletion record keeps, only to show what was agreed. A daily cleanup deletes such a record six years after your account was deleted, however long ago the acceptance was, because the terms you accepted applied until then.
• Deletion records: the record that your account was deleted is kept for six years after the deletion and then deleted, as “Deleting your account” describes.
• Support emails: as long as needed to answer you and deal with any follow-up.
• Provider logs and backups: Supabase, Cloudflare and our other providers keep their own logs and backups, including Supabase Auth’s records of sign-in activity, for the limited periods their services set. Deleted data leaves them as they expire.
• Guest accounts left behind: if you sign out of a guest account, or delete the app, without deleting the account, its alerts still expire after one day, but its sources, settings and sign-in session, with the IP address and user agent the session recorded, stay until the account is deleted, because we cannot tell a guest account that has been left behind from one that is simply not in use. We may delete it once it has gone unused for 12 months, as “Unused accounts” below describes. Delete a guest account in Settings → Delete account and data before you leave it.
• Unused accounts: the Terms of Service allow us to delete an account, with its data, that has not been opened in the app and has received no alerts for 12 months: a guest account without notice, because we have no way to reach it, and a recoverable account only after we have emailed the address linked to it at least 30 days before. This is a permission, not a retention period: we do not promise to delete unused accounts, and until an account is deleted its data is kept as this section describes.

You can delete your account at any time in Settings → Delete account and data. For a recoverable account, Zona first asks you to confirm that it is you. Deletion stops your source keys, then removes your alerts and their images, sources and key hashes, check-ins and their records, Ring until seen settings, agent sessions, devices, push registrations and Dev note push records, sessions, preferences, quiet-hours schedules, saved filters, profile, usage counters and daily totals, diagnostic logs and crash reports, Zona Plus records, including Zona Plus given to your account, Live Status keys, account security events and removed-sign-in-method records, and finally your Supabase Auth account, with its email address, password and sign-in methods.

After your account is deleted, we keep only:

• your acceptance records, with the one-way hash in place of your account identifier, until six years after your account is deleted;
• a minimal record of the deletion, kept so that the deletion can be completed and shown to have happened: your former account identifiers, the status and dates of the account and of the deletion request, how many items were removed, and the records of any guest account moved into your account, which are deleted six years after the deletion, together with the acceptance records they could be matched with; and an event recording that the deletion was completed, which is deleted after one year. None of this contains your email address, alerts or other content, and none of it is linked to any sign-in method;
• records Apple sends about your subscription after the deletion, for example a renewal if you did not cancel it with Apple, which we keep without any Zona account identifier for seven years, as “How long we keep data” describes;
• entries in Supabase Auth’s audit log until they are one year old, data in provider logs and backups until they expire, and anything the law requires us to keep.

Deleting your Zona account does not cancel a Zona Plus subscription; cancel it with Apple. Deleting the app without deleting your account does not delete your data.

We protect personal data with measures suited to the service, including: encryption in transit (TLS) for every connection, and encryption at rest by our hosting provider; row-level security, so that each account can reach only its own data; source keys and Live Status keys never stored in full (only a one-way hash, and for a source key a short prefix); private storage for images; limits on payload size, request rate and retention; independent revocation of each source and key; confirmation of your identity before sensitive account changes; and access to production systems limited to the operator. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your devices and keys secure, and report any vulnerability to terabasedevteam@gmail.com.

If a security incident affects your personal data, we will investigate it, take steps to contain it, and, without undue delay, notify you and the relevant regulators where the law requires. In Hong Kong we follow the guidance of the Privacy Commissioner for Personal Data on data breach notification.

• Use Zona without allowing push notifications; the inbox still works.
• Turn Message previews off in Settings, or change the notification settings on your device.
• Turn Dev note push notifications off in Settings under Dev notes.
• Rename or revoke a source, or revoke a single source key, at any time.
• Pin, unpin or delete individual alerts, and export an alert as text or JSON from its screen.
• Sign out on a device, or remove a device from your account.
• Pause or delete a check-in, turn Ring until seen on or off for each source, and remove an agent session from the board, in the app.
• Install the agent hooks without the project folder name (--no-project), and without the agent’s message (the default; --share-question adds it); allow or turn off critical alerts for Zona in your device’s settings.
• Delete your account in Settings → Delete account and data.

Your rights depend on where you live. You can exercise many of them directly in the app; for anything else, email us.

Hong Kong

Under the Personal Data (Privacy) Ordinance (Cap. 486), you may ask whether we hold personal data about you, request a copy of it (a data access request) and ask us to correct it (a data correction request). We will respond within 40 days. We may charge a fee for a data access request, which will not be excessive, as the Ordinance allows.

European Economic Area, United Kingdom and Switzerland

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, including processing based on our legitimate interests, to data portability, and to withdraw your consent at any time without affecting processing that took place before. You also have the right to complain to the data protection authority where you live or work, or where you believe a breach took place. We will respond within one month, which the law allows us to extend in some cases.

California

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to our handling of your personal information, you have the right to know what personal information we collect, use and disclose, to access it, to have it deleted or corrected, and not to be discriminated against for exercising these rights. We collect identifiers, commercial information (Zona Plus purchase records, including price, currency and storefront, and records of Zona Plus given to your account), internet or other electronic network activity (security and diagnostic records, including crash reports) and the content you send, from the sources and for the purposes described in this policy, and we disclose them to the service providers listed above for business purposes. We do not sell or share personal information, and we do not use or disclose sensitive personal information to infer characteristics about you. You may use an authorised agent to make a request.

Other places

If you live elsewhere, you may have similar rights under your local law, and we will honour them as that law requires.

How to make a request

Email terabasedevteam@gmail.com, preferably from the address linked to your account, and tell us which account your request is about. Before acting, we will check that the request comes from the account holder, for example by asking you to confirm details that only the account holder would know or to take a step in the app. We cannot verify a guest account by email, so use the app’s own tools for a guest account. We may refuse a request that is manifestly unfounded or excessive, or where the law allows us to, and we will tell you why.

Zona does not ask for or record your age. If you are a parent or guardian and believe that your child has given us personal data that you want deleted, contact us. Once we can identify the account and are satisfied that the request comes from your child, or from you as their parent or guardian, we will delete it. Your child can also delete the account at any time in Settings → Delete account and data.

Zona does not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. It applies technical limits automatically and in the same way to every account on the same plan, such as rate limits, size limits, plan limits and retention periods.

We may update this policy. Each version has a version date and an effective date. If we make a material change, for example to what we collect, why we use it, who receives it or how long we keep it, we will tell you before it takes effect, in the app, by email to an address linked to your account or on zonanotify.app; the app will ask you to confirm the new policy when you next use a version of it that includes the change; and we will give any other notice, or ask for any consent, that the law requires. Other changes take effect when we publish them.

For questions, requests or complaints about privacy, contact Terabase, Hong Kong, at terabasedevteam@gmail.com. Never email passwords, complete source keys, push tokens, payment details or real alert content.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong, or to the data protection authority where you live.