Privacy Policy

Last updated 22 October 2026

Z Chat is a messaging, calling and small-tools service. This policy explains what we collect, why, and the choices you have. Contact us at [email protected] for any privacy request.

Z Chat is operated as the Zverse project; the operator's legal details are available on request via [email protected].

What we collect

• Account: your email address (or Apple/Google account identifier), display name and optional profile photo.
• Content you create: messages, images and files you send, and the groups you join.
• Calls: audio/video for calls is transmitted peer-to-peer (or via a relay) and is not recorded by us. Call metadata (who called whom, when) is kept for the call to work.
• Device & safety: a device identifier and basic technical data used for security, abuse prevention and moderation.
• Notifications: a push token so we can notify you, if you allow it.

How we use it

To provide the service (deliver messages, run calls, show your content), to keep it safe (spam and abuse prevention, moderation), to bill optional plans, and to respond to you. We do not sell your personal data and we do not track you across other apps or websites.

Sharing

Your messages are visible to the people in your conversations. We use service providers for hosting, database, authentication, payments and push notifications, who process data only to run the service. We may disclose data if required by law or to protect users.

Who processes your data

These providers handle data on our behalf, each only for the job named. They are not allowed to use it for anything else.

• Supabase — hosts our database and runs sign-in. It stores your account record, profile and message records.
• Cloudflare — sits in front of the service and carries all traffic (encryption, the tunnel to our server, caching). It therefore sees your IP address and request metadata.
• Stripe — takes payments for optional items. It receives your email address, the order details and the card details you type into its checkout; we never see your card number.
• Resend — delivers email from us, such as approval and security notices. It receives the recipient address and the contents of that email.
• Cloudflare TURN — relays call audio and video when a direct connection is not possible. It sees call metadata and your IP address. Calls are not recorded.
• Cloudflare Workers AI — the AI provider behind Z AI, and behind automatic message checks when they are switched on. It receives the text of messages that are checked, and anything you send to Z AI. If the provider changes we will update this page.

Our own server stores the media and attachments you upload. It runs on hardware we control, and only the operator and the administrators of Z Chat can reach it.

How long we keep things

• Account and profile: kept until you delete your account.
• Messages and attachments: messages are rotated. Once the message store approaches 15 GiB, the oldest messages are deleted, and the newest 50,000 messages are always kept. Uploaded files live on our own server alongside that message store.
• Reports and moderation records: kept while a report is open and afterwards as a record of how it was handled.
• Orders and payments: kept for as long as we need them for accounting and tax.
• Backups: kept on a short rolling window, then overwritten. See below.

Backups

We take a daily dump of the database and a daily backup of uploaded files. Both are kept on a short rolling window and are replaced as new ones are taken. They exist to restore the service after a failure, not to look things up day to day. If you delete your account, it can briefly remain inside a backup until that backup ages out; if we ever had to restore from one, a deletion made after it was taken would not be reflected in the restored copy.

Retention & deletion

You can delete your account at any time from Profile → Privacy & security → Safety & account, where you type DELETE to confirm. The same steps, and an email route for people who can no longer sign in, are on the account deletion page.

Deletion removes your account and your personal profile data — display name, photo, username, sign-in credentials, passkeys, push tokens, blocked list and conversation memberships. Messages you already sent are not necessarily removed from other people's conversations, and files already uploaded stay in the message store; both remain subject to the rotation rule above. Some records, such as moderation reports and billing records, may be kept as required by law or to keep the service safe.

Children

Z Chat is not intended for children under 13.

We do not knowingly collect data from anyone under 13, and accounts require you to confirm you are 13 or older when you sign up. If you believe a child under 13 has an account, email [email protected] and we will close it.

Your rights

You can ask us for any of the following, and we will answer within 30 days. If a request is complex and needs longer, we will tell you why.

• Access: a copy of the personal data we hold about you, and an export of your messages and profile data.
• Correction: fix inaccurate data. Most of it you can change yourself in your profile; anything else, ask us.
• Deletion: delete your account and personal profile data, in the app or by email.
• Objection: object to a particular use, such as automated moderation of your messages, or withdraw consent for notifications.

Email [email protected] from the address on your account so we can verify it is you. You can also block users and report content from inside the app at any time.

Your choices

In the app you can manage notifications in your device settings, block users from any message, and report content to our moderators. You can also delete your account at any time.

See also our Terms of Service, our Support page and our home page. Questions about this policy go to [email protected]; anything else goes to [email protected].