ZAYA Privacy Policy

1. Information we collect

We collect only what we need to run the app.

• Account: first and last name, email address and password. Passwords are handled by Google Firebase Authentication; we never see them.
• Profile (optional): date of birth, gender, height, weight and activity level, and, only if you add them, medical conditions, notes and medications.
• Health logs (optional): blood sugar and weight entries, if you turn on health tracking.
• Your activity: daily bricks and XP; your shared space (name, members, stage, weekly reveals); Arena challenges you create or join (name, activities, stakes, your daily logs and totals); invite codes.
• Notifications: a device token to deliver push notifications. Reminder times are stored on your device.
• Purchases: your subscription status from the App Store or Google Play via RevenueCat. We never receive your card details.
• Support, feedback and reports: what you send us, including your email, device platform, and the reason and details of any report.

2. How we use your information

We use your information to run ZAYA. We do not use advertising trackers and we do not sell your personal information.

• Run daily bricks, your shared world, weekly reveals and Arena challenges
• Show the right information to your partner and challenge participants (see section 3)
• Send the notifications you turn on: the daily brick reminder, the Sunday reveal, and Arena updates when someone in your challenges logs activity (these include their first name and totals)
• Manage subscriptions and free trials
• Answer support requests, fix problems and keep the service secure

3. Who can see what inside ZAYA

ZAYA is built for doing things together, so some information is visible to people you connect with.

Your email, profile details, health logs and medical information are never shown to other users.

4. Service providers

We rely on these providers to run ZAYA. They process data on our behalf.

• Google Firebase: authentication, database and push notifications
• RevenueCat: subscription management
• Apple and Google: app stores, payments and notification delivery

Your information is stored and processed outside Québec and Canada, in the United States (Google Cloud), where it may be accessible to authorities under local law.

We may also disclose information if required by law, or to protect the rights and safety of our users.

5. Data security

Data is encrypted in transit and at rest by our providers. Database access rules limit each person to their own data and to the shared information described in section 3.

6. Your choices and rights

You can access, correct, export or delete your information, and withdraw your consent, at any time.

• Access and correction: Profile → Edit Profile
• Export: Profile → Data Management → Export Data
• Deletion: Profile → Data Management → Delete Account permanently deletes your account and all your data, and removes you from your shared space and every Arena challenge, including your name, totals and logs
• Notifications: Profile → Notifications, or your device settings
• Any other request, or to withdraw consent: contact our privacy officer below

7. Data retention

We keep your information while your account is active. When you delete your account, your personal data is deleted, except where we must keep it for legal or security reasons.

8. Children

ZAYA is not intended for anyone under 16. We do not knowingly collect personal information from children under 16.

9. Changes to this policy

If we change this policy, we will update the date above and, for important changes, notify you in the app.

10. Contact us

Questions or privacy requests? Contact our privacy officer, Mamadou Dia (NovaCodeLabs, Québec): hello@novacodelabs.ca