Privacy Policy

1.The website (zerosay.com)

Visiting the site creates no account, sets no cookies and loads nothing from third parties. Fonts, images and scripts are served from our own server.

An address that is never confirmed stays as a pending row for at most 30 days and is then deleted. Every email we send contains an unsubscribe link that works with one click and needs no login.

2.The Zero Say app

Zero Say is built as a zero-knowledge system. Your encryption keys are generated on your device and never sent to us. Messages are encrypted for the recipient’s devices before they leave yours. Our servers relay sealed envelopes and cannot open them. This section describes the little that remains.

What we deliberately do not collect

• No phone number, no email address, no real name.
• No upload of your address book. Discovery works by handle or QR code.
• No message content. We could not read it if we wanted to.
• No analytics, advertising identifiers, or third-party SDKs of any kind.
• No location data.
• No record of who talks to whom. Sending a message requires no proof of who you are: the app presents a token anyone holding the recipient's contact card can compute, and nothing that identifies the sender, so the envelope tells us where it is going and never where it came from. There is no fallback path that would name the sender.

What the app does to hold even less

• Images are stripped of their metadata (GPS position, camera serial, timestamps) before they are encrypted, so that data never reaches the recipient either.
• Messages are padded to fixed sizes and sending is slightly delayed, so their length and timing say less about you.
• The app pins our server's certificate, and the server also runs as a Tor onion service. Reach it that way and there is no IP address for us to see, to log, or to be compelled to hand over: the connection never touches the public internet on its way to us. On a direct connection we do receive your IP address, and it is kept only in the 14-day server log described above.
• Crash reporting is switched off in the build. There is no setting to turn it on, and the app contacts no server other than ours: no analytics, no fonts or scripts from anyone else, and no link previews, because fetching one would tell that website what arrived in your chat.
• Nothing readable is left on your device. The local database is encrypted, deleted rows are overwritten rather than left in free pages, browser caches are cleared when you lock the app and when you quit, and on macOS the folder is excluded from Spotlight and from backups. An optional mode keeps the database in memory only and removes the profile when you quit.
• The app reads no hardware identifier of any kind and sends no device fingerprint: no serial number, no MAC address, no screen size, no locale, no time zone. Every copy identifies itself on the wire with the same fixed word.

Your keys and your responsibility

Because we never hold your keys, we cannot reset them, recover them or decrypt anything on your behalf. If you lose every device and your recovery phrase, your message history is gone. That is not a bug; it is the design.

3.Who else touches the data

We use a small number of service providers, all bound by data-processing agreements under Art. 28 GDPR:

We do not sell, rent or share personal data with anyone else. We do not use data brokers. We do not run ads.

4.International transfers

Our own servers are in the EU. The only personal data that can leave the EU is email delivery through Resend’s EU region. Where a provider is established outside the EU we rely on an adequacy decision (the EU-US Data Privacy Framework) or Standard Contractual Clauses.

5.Your rights

Under the GDPR you can ask us to:

• tell you what personal data we hold about you (access, Art. 15);
• correct it (rectification, Art. 16);
• delete it (erasure, Art. 17): in the app this is the “Delete account” button in Settings, which works immediately and needs no email to us;
• restrict or object to processing (Art. 18 and 21);
• receive a copy in a machine-readable format (portability, Art. 20);
• withdraw consent at any time, for example by using the unsubscribe link in any email (Art. 7(3)).

Write to hello@zerosay.com. We answer within 30 days. Because the app does not collect identifying data, we may need you to prove control of an account by signing a challenge from within the app before we act on a request about it.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy.se, or to the supervisory authority where you live.

6.Children

Zero Say is not directed at children under 13, and under Swedish law a child must be 13 to consent to an information-society service on their own. If you believe a child under 13 has created an account, email us and we will delete it.

7.Security

• End-to-end encryption with per-message keys and forward secrecy in the app.
• TLS on every connection to our servers; HSTS on the website.
• Servers hardened and patched automatically; SSH by key only; disk encryption at rest.
• Minimal data by design: the best protection for data is not to have it.
• Security researchers: email hello@zerosay.com with “security” in the subject. We will not take legal action against good-faith research.

8.Creator channels: what we know and what the relay knows

When you pay for a creator channel on zerosay.com, Stripe handles the payment and knows your card, your billing address and your email. zerosay.com stores the Stripe identifiers of that payment, your email (to send the code and any refund notice) and a hash of the join code. The relay (api.zerosay.com) stores which Zero Say account id belongs to which channel and until when it is paid, and nothing about the payment. The join code is the only bridge between the two, and it is deleted the moment it is used: afterwards there is no stored record that joins a card or an email to a Zero Say account id.

A creator sees the account ids and public keys of their members, which they need to encrypt posts, and nothing from the payment side. Payment records are kept for seven years under Swedish bookkeeping law; the relay forgets a membership when the account is deleted.

9.Requests from authorities

We comply with valid legal orders under Swedish law. Because of the design described above, the most we can provide about an account is its random identifier, its public keys, the handle it chose if it chose one, the date it was created, and any undelivered ciphertext envelopes waiting for it. We cannot provide message content, contact lists, phone numbers or names, because we do not have them, and we cannot say who sent a message to that account, because delivery never tells us. We will publish a transparency summary at least once a year.

10.Changes to this policy

When we change this policy we update the version and date at the top and describe the change in the log below. If a change reduces your privacy in any way we will announce it inside the app before it takes effect. We will never quietly widen what we collect.

Change log

Contact

Wasted Penguinz AB
267 75 Ekeby, Sweden
Org. nr 559447-4859
hello@zerosay.com