Privacy Policy
Last updated: 2026-07-27 • ZIX DEV Inc
**Effective date:** 2026-07-27 · **Controller:** ZIX DEV Inc, 100 ZIX Way, Suite 400, San Francisco, CA 94107, USA · **Contact:**
The Short Version (Summary)
- We collect only the data required to deliver Base App.
- In free small-tool modes, your inputs remain on your device.
- For authenticated accounts, session data is stored securely with our backend providers.
- Payment processing is handled by Stripe and RevenueCat — **we never store your full card number**.
- You can access, export, or request deletion of your data at any time by contacting .
- We do not sell your personal information.
1. What We Collect and Why
| Data Category | Purpose | Lawful Basis (GDPR/UK) |
|---|---|---|
| Account Identifiers (Email, OAuth ID) | Create and secure your user account | Contract |
| Session & Device Identifiers | Authenticate sessions and maintain security | Legitimate Interest / Contract |
| Product Preferences & Inputs | Provide application features and preferences | Contract |
| Subscription & Entitlement Status | Manage paid features and billing status | Contract |
2. Subprocessors & Data Handling
We use trusted third-party providers to support Base App:
- **Backend & Auth:** Appwrite (cloud database and session authentication)
- **Payment Processors:** RevenueCat & Stripe (payment card processing and subscription management)
- **Hosting & CDN:** Cloudflare Pages (edge content delivery and DDoS protection)
Card details are held exclusively by payment processors under PCI-DSS compliance. We store no full credit card numbers.
3. Cookies, Analytics & Tracking
Base App uses strictly necessary technical storage required for security and session management. We do not use persistent cross-site tracking cookies.
We honor Global Privacy Control (GPC) signals and "Do Not Track" browser headers.
4. Retention & Your Rights
We retain personal data only as long as necessary to fulfill the processing purposes described above, or as required by statutory record-keeping obligations.
Your Rights: - **Access & Portability:** Request a copy of your personal data in a structured machine-readable format. - **Rectification:** Correct inaccurate or incomplete data. - **Deletion (Right to be Forgotten):** Request permanent deletion of your account and personal data. - **Objection:** Object to processing based on legitimate interests.
To exercise any of these rights, contact our privacy team at . We respond to all requests within statutory timeframes (30 days for GDPR; 45 days for CCPA).
5. Children's Privacy
Base App is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact for prompt removal.
6. International Data Transfers
Data may be processed in the United States and other locations where our subprocessor edge nodes operate. We rely on standard contractual clauses (SCCs) and adequacy decisions to safeguard international data transfers.
7. Changes to This Policy
We may update this Privacy Policy periodically. We will post updates on this page with a revised effective date.