Zona Notify Privacy Policy

Zona provides a synchronized inbox for alerts sent by sources you configure. Zona stores an accepted alert before requesting eligible push delivery. Push delivery is best effort and does not prove that a notification appeared on a phone.

Zona processes account identifiers and sign-in details; source names, optional hostnames, and one-way hashes of source keys; notification content, categories, timestamps, and optional image attachments; installation identifiers, push-notification identifiers, preferences, delivery results, and service diagnostics.

If you use Zona Plus, Zona also stores the App Store product identifier, original and current transaction identifiers, subscription status, environment, and expiry date. These records are linked to your Zona account so Zona can verify subscriptions and restore purchases. Zona never receives your payment-card details.

Zona uses this data to authenticate accounts, isolate each user’s data, receive and synchronize alerts, attempt push delivery, enforce limits, restore purchases, prevent abuse, respond to support requests, and diagnose or secure the service. Zona does not sell personal data, serve behavioural advertising, or track you across other companies’ apps or websites.

Notification titles, bodies, source labels, and selected routing details pass through Supabase, Expo, and Apple or Google push services. They may appear on a lock screen or to someone with access to your device. Do not send passwords, source keys, personal access tokens, sign-in links, payment details, or unnecessary sensitive information in an alert.

Zona uses Supabase for authentication, database, storage, logs, and server functions; Expo and Apple Push Notification service for iPhone delivery; Firebase Cloud Messaging for Android delivery when configured; Apple for App Store purchases; and the sign-in provider you choose. These providers may process data outside Hong Kong under their own terms and safeguards, subject to applicable law.

Current default inbox retention is one day for guest accounts, seven days for Standard accounts, and thirty days for Zona Plus. The period shown in Settings is authoritative and attachments follow their notification. Rate-limit rows are normally kept for one day. Account, source, device, security, and subscription records are kept only as needed to provide and protect the service, resolve disputes, prevent fraud, or meet legal obligations. Apple retains its own purchase records under Apple’s policies.

You may use the inbox without granting notification permission. In Zona you can revoke sources, delete individual notifications, sign out devices, control lock-screen previews, and permanently delete your Zona account and associated app data. Deleting your Zona account does not cancel an App Store subscription.

You may request access, correction, deletion, restriction, portability, or objection where applicable. Zona may need to verify that a request belongs to the account before acting.

Zona uses TLS, Supabase Auth, row-level security, hashed source keys, payload and rate limits, independent revocation, and bounded retention. No service is perfectly secure. Zona is not directed to children.

Material changes to data collection, purpose, providers, retention, or user rights will require an updated notice and any notice or consent required by law.

Privacy questions or requests: terabasedevteam@gmail.com. Never email a password, complete source key, push token, payment information, or real alert content.