Who we are
Zonefy is operated by ACACIA INNOVATIONS TECHNOLOGY FZE, a company registered in the United Arab Emirates. In this policy, "we" and "us" refer to ACACIA INNOVATIONS TECHNOLOGY FZE.
What we collect
To make Zonefy work, we collect a limited set of data:
- Location data. The area you view or search and, with device permission, approximate or precise device location. This supports maps, reports and nearby alerts. Proximity alerts also use location when the app is in the background, after you enable them. Optional location uploads require Location Sharing; proximity uploads require their separate setting too. Area-alert uploads can include accuracy and movement speed.
- Optional diagnostics. With Data Collection enabled: device model, operating system and app version, carrier and SIM carrier details, signal strength, connection type, app-service latency, diagnostic events and speed-test results. Uploaded coordinates require Location Sharing too. We do not collect Android ID or advertising IDs in this release.
- Account information. Email, authentication identifiers, name, profile image and optional phone number. Your date of birth is checked for adult eligibility; the signup date of birth may also be saved to your account profile for age-compliance review. WorkOS and Supabase process authentication; social sign-in providers also process the information needed to sign you in.
- Reports and social features. Report text, selected photos and videos, location and time; events, invitations, circle memberships and messages you submit. Public contributions can be seen by other users.
- Contacts. If you separately approve contact syncing, contact names and phone numbers are uploaded to invite people and identify app contacts. Declining does not prevent basic app use. Invitations may also include an email address you enter yourself.
- Support and notifications. Support messages, attachments and request records; push-notification tokens and delivery information. Website deletion requests require an email verification code generated by WorkOS and delivered through Hostinger before submission. Supabase stores short-lived verification records with hashed codes and submission proofs; the deletion queue receives your email and selected scope only after verification and explicit submission. We use keyed hashes of the submitted email and request IP as abuse-prevention signals; these are not proof of identity. Essential service providers may process IP addresses and request logs.
How we use it
If you purchase a subscription through Google Play, Google processes payment details. Zonefy receives and stores the purchase token, order identifier, product, subscription status and expiry to verify access. We use an obfuscated account identifier to link the purchase to your account. We do not receive your payment-card details.
We use this data to provide safety and network information, to aggregate community reports into shared maps, to check adult eligibility, to improve the app, to send notifications you have chosen to receive, and to enforce our Terms of Service. Scores and community information may be incomplete or out of date and do not guarantee safety. We do not sell your personal data. We do not show ads.
Community data
Reports, media and event details are community contributions and may include exact locations, timestamps and profile information. Do not include private information about yourself or others that you do not want shared. Network contributions support community maps and scores; do not assume that source records are anonymous. Private support conversations are intended for you and authorized Zonefy operators.
Who we share data with
- Service providers. Supabase hosts account records, database content and media; WorkOS processes authentication; Hostinger delivers transactional emails from our support address and processes recipient addresses, email content and delivery information; Mapbox processes map and geocoding requests; Firebase provides push delivery. Mapbox may also collect de-identified location and usage telemetry; use the map's attribution information control to opt out. Sightengine receives images or video frames submitted for content moderation. Selected media may be checked before publication, and blocked content may be retained for moderation review. Service requests disclose IP addresses to the receiving provider. Map and area lookups can disclose the requested coordinates even when optional diagnostic uploads are off.
- Location names and connection tests. OpenStreetMap's Nominatim service receives coordinates to look up place names. Cloudflare receives requests and test traffic for speed and connection tests. Reliability tests contact the public WhatsApp, Facebook and Instagram web endpoints, which receive IP addresses and request information. These are connection-latency probes, not access to your accounts, messages or activity in those apps. Disabling optional Zonefy diagnostic uploads does not prevent requests needed for a lookup or connection test you use.
- Legal reasons. When required by law or to protect the rights and safety of users.
- Business transfers. If Zonefy is acquired or merged, your data may transfer to the new owner under this same policy.
Using this website
Your browser requests pages and images from our website host, which receives your IP address and request information. These pages load fonts from Google Fonts; Google receives the corresponding font requests and IP address. The deletion form sends your account email to our Supabase verification service and, for a matching account, to WorkOS to generate a six-digit code. Our backend sends the code through Hostinger from support@zonefy.app. Hostinger stores a copy in our support mailbox’s Sent folder. Our backend delivery ledger records event identifiers, status and attempts, without email addresses, message bodies or codes; entries older than 30 days are removed when further email events are processed. Codes expire after 10 minutes. Successful verification grants a separate submission proof valid for 10 minutes; it does not sign you into the app or submit a deletion request. Verification records older than one day and intake rate-limit hashes older than seven days are removed when further code requests are processed; raw IP addresses are not stored in this intake ledger. A deletion request enters the admin queue only when you explicitly submit it after verification. Email links instead open your email application; a request is sent only when you send the email. Enter verification codes only in the verification field; do not include passwords or codes in request descriptions or support email.
Your rights
You can access, correct, delete, or export your personal data. Optional location sharing, proximity monitoring, notifications and diagnostic contributions can be disabled in the app. Turning these off stops the corresponding future optional collection; it does not retract reports you chose to publish. Use Profile > Privacy & Data to request deletion, or follow the account and data deletion instructions without reinstalling the app. For privacy requests, email privacy@zonefy.app.
Data retention
Account data, contributions, contacts and support records are retained while needed to provide and protect the service. Area-alert last-known location records expire when no longer refreshed; the configured cleanup removes records older than 25 hours. Optional settings do not automatically erase historical contributions. Verified account-deletion requests are handled within 30 days. Deletion covers authentication accounts, associated database records and uploaded files. Records legally required for fraud prevention, security or legal obligations may be retained only for that purpose; we will explain any applicable exception when handling the request.
Security
We use HTTPS and service access controls to protect data. Public community content remains visible as described above. No system can guarantee absolute security; report suspected unauthorized access to privacy@zonefy.app.
Children
This release of Zonefy is for adults aged 18 and over. We do not permit minors to create accounts or use community features. Our child-safety standards prohibit child sexual abuse and exploitation. Report suspected underage accounts or child-safety concerns through in-app Help & Support or privacy@zonefy.app.
International transfers
Zonefy operates globally. Your data may be processed in the United Arab Emirates or in other countries where our service providers operate.
Changes to this policy
We may update this policy from time to time. When we make significant changes, we will notify you in the app or by email.
Contact
For privacy questions, email privacy@zonefy.app.