Privacy Policy

1. Who we are and scope

Zaylek operates the Zaylek app and is responsible for the personal information described in this Policy. Contact: Zaylek@gmail.com. This Policy applies worldwide to our account, voice-room, community, messaging, virtual-gift, purchase, and support features, subject to applicable local law.

This HTML document itself contains no scripts, analytics, cookies, or remote fonts. If it is later hosted online, the hosting provider may receive ordinary request information such as IP addresses. Our User Agreement describes service rules.

2. Information we process

We do not request access to your contacts, precise GPS location, health records, or entire photo library for these features. We do not receive your payment-card number or Apple ID password.

3. Permissions and local storage

• Microphone: used for audio-device checks and speaking in voice rooms after permission. You can mute or leave the room and revoke microphone permission in system settings. Denying permission limits speaking, not ordinary text browsing.
• Photos: the app processes images you select for supported uploads, such as avatars, posts, or report evidence. It does not upload your whole library. The current upload pipeline re-encodes images to remove embedded EXIF/GPS metadata.
• Notifications: permission is requested when you enable supported notifications. Current iOS message reminders are local notifications triggered by received messaging events and use generic text; background or offline delivery is not guaranteed. You can change the app preference and system permission.
• Remember me and secure storage: when enabled, email and password are stored in iOS Keychain for autofill and persistent sign-in. Authentication tokens are also securely stored. You may disable Remember me through the sign-in flow. Secure storage may survive app removal under operating-system behavior.
• App-local storage: device identifiers, search history, cached images and session data may be stored on the device. The current device identifier is stored locally rather than in Keychain and may be regenerated after app deletion/reinstallation; backup restoration and platform behavior can affect this. Uninstalling is not an account-deletion request.

The current client transports live voice for room communication; it does not implement an audio-recording or recording-playback feature. Live transport is still processing of voice data. Other participants may independently capture content, so avoid sharing sensitive information in rooms.

4. Public information and private records

Other users can see public profile information, published posts and comments, selected interview topics, and room-visit display information used by Recent Rooms. That room information may identify a room you visited and when the visit was recorded. Published room tags and room details are also available through supported room features.

Occupation extensions, discussion browsing history, favorites, helpful selections, notification preferences, achievement records, room reviews/statistics, and private room configuration are stored in account-scoped service records where implemented. “Private” here means access is restricted in the service; it does not mean the operator or necessary service providers cannot process the data. Room totals or other derived information may appear in the relevant feature.

Private-room passwords and connection credentials are not included in the public room-history display record. Direct messages are delivered to their recipients and handled by the messaging service; we do not claim end-to-end encryption. A recipient can retain or share a message independently. Blocking and reporting have the scope supported by their respective features and do not automatically erase past interactions.

5. Purposes and legal bases

Where a legal basis is required, we process information as follows:

• Contract: to provide requested account access, profiles, live rooms, messages, discussions, saved records, and verified purchases.
• Consent: for permission-dependent or other optional processing where required. You can withdraw consent or change device permissions; withdrawal does not invalidate earlier lawful processing.
• Legitimate interests: where recognized by applicable law, to secure accounts, maintain reliability, prevent abuse, and answer support requests, taking account of your rights and expectations.
• Legal obligations: to respond to valid legal requests and retain necessary accounting, dispute, safety, and compliance records.

We do not treat acceptance of this Policy as blanket consent to every form of processing. Additional consent will be requested where the law requires it. We do not use the app’s practice feedback or achievement counts to make hiring decisions about you.

6. Service providers and other disclosures

• Agora: real-time audio connectivity, authentication for audio channels, and related network/audio quality information.
• NetEase Yunxin (NIM): messaging account connectivity, messages and conversation information, and delivery/session data.
• Apple: distribution and In-App Purchase payment processing. We send relevant transaction data to our verification service and receive fulfillment information; Apple handles payment details under its own policies.
• Backend, object-storage, and network providers: hosting account and business records, uploaded media, API requests, and operational data.
• Other users: the public content and participation you choose to expose, and messages sent to their accounts.

We may disclose necessary information to meet legal obligations, protect users and rights, address security incidents, or complete a business reorganization with appropriate protections and notice where required. We do not sell personal information or share it for cross-context behavioral advertising. The current app does not implement third-party advertising or advertising-identifier tracking.

Provider references: Agora privacy policy, NetEase Yunxin, and Apple privacy policy. These providers’ policies describe their own processing and do not replace this Policy.

7. Retention and deletion

Account and saved service records are retained while needed to provide the account and its features. Messages, uploaded media, operational logs, support records, and purchase records may have different lifetimes depending on their purpose, provider processing, legal duties, and unresolved disputes. A five-minute in-app cache is only a refresh policy; it is not a server deletion period.

We keep personal information no longer than reasonably necessary for its stated purpose and applicable legal requirements. When no longer needed, we delete or de-identify it, subject to backup cycles and lawful retention. A deletion request may not immediately remove independent recipient copies, legally retained transactions, or files held in provider backups. Contact us for the scope and progress of a specific deletion request; this Policy does not promise an unsupported instant erasure capability.

To request deletion of your account and associated data, email Zaylek@gmail.com. Uninstalling alone does not delete server-side data. The current app does not provide a dedicated in-app account-deletion control.

8. Worldwide service and international transfers

Zaylek is intended for users worldwide, subject to local law and availability. Our service providers may process information in countries other than where you live, whose privacy laws may differ. Global availability does not mean every record is stored in your own country.

Where applicable law requires safeguards for international transfers, such transfers must be supported by an appropriate legal mechanism, such as an adequacy decision, applicable standard contractual clauses, a UK addendum or equivalent mechanism, and any required additional protections or consent. Contact us to request information about the providers, processing locations, and safeguards applicable to your account.

9. Your rights by region

All users

You may contact us to request access, correction, deletion, or a copy of account-linked personal information, or to withdraw consent for optional processing. We will handle requests in accordance with applicable law. We may verify your identity using proportionate information; never send your password or payment-card details. Some requests are subject to lawful exceptions, including protecting other people’s rights and retaining necessary transaction records.

European Economic Area, United Kingdom, and Switzerland

Where applicable, you may also request restriction, data portability, or object to processing based on legitimate interests. You may complain to your local supervisory authority. We ordinarily respond to applicable GDPR requests within one month, with extensions only as permitted by law and with notice.

California and other United States states

Depending on applicable state law, you may have rights to know, access, correct, delete, receive a portable copy, opt out of sale, sharing, targeted advertising or certain profiling, and appeal a request decision. Our current practices do not include sale or cross-context behavioral advertising. We will not unlawfully discriminate against you for exercising rights. An authorized agent may submit a request where permitted, subject to verification. Where the California 45-day response period applies, we follow that period and any lawful, notified extension.

Brazil, mainland China, and other regions

Local laws may provide additional rights, including confirmation of processing, explanations, access, correction, portability where available, withdrawal of consent, deletion or anonymization, and information about disclosures. We will apply the relevant local requirements, including rules on sensitive information and cross-border transfers where applicable. This global Policy does not reduce rights granted by your location.

Send requests or appeals to Zaylek@gmail.com, subject “Zaylek — Privacy Request”. Include the account email and a description of your request. We respond within the period required by applicable law and explain any lawful refusal or extension. You may also contact the relevant regulator.

10. Security

The app uses HTTPS connections, authentication, account-scoped access controls, and platform secure storage for credentials and tokens. These measures reduce risk but do not guarantee absolute security. Device compromise, recipient actions, and network/service incidents can affect confidentiality. Protect your device and credentials and contact us if you suspect unauthorized use.

We do not claim that chat or room audio is end-to-end encrypted. Reports and support messages may need authorized review to address the issue you submit.

11. Children’s privacy

Zaylek is not directed to children under 13 or below a higher applicable local minimum age. Where parental permission is required by local law, it must be obtained before use. If you believe a child below the applicable age has provided personal information, contact us so we can investigate and take appropriate steps, including deletion where required.

12. Changes and contact

We may revise this Policy to reflect feature, provider, or legal changes. We update the revision date and provide notice of material changes where required. New consent-based processing will require appropriate consent.

Operator and responsible entity: Zaylek
Scope: Worldwide, subject to applicable local law
Email: Zaylek@gmail.com
Suggested subject: Zaylek — Privacy Inquiry