Privacy Policy

Effective date: October 28, 2026

This policy explains what personal data the ZereZ ("we") iPhone app and this website handle, how we use and protect it, and how you can manage it.

Scope of this policy

• This policy applies to personal data we handle when you use the ZereZ app and this website.
• It does not apply to other sites and services linked from the app or this website, or to people we do not engage or manage.
• Please read this policy before you start. If you do not agree, please do not use ZereZ.

ZereZ is provided and operated by the ZereZ developer. For any privacy question, email support@zerezapp.com.

Personal data we collect and use

• Sign-in data: When you sign in with Apple or Google, the sign-in service provides an account identifier, your email address, and your name; Google sign-in also provides a profile photo, which is shown as your avatar to members of your groups and to your friends. We use this data to create and identify your account and to prefill your display name. Your email address is never shown to other users.
• Content you enter: your display name, groups and members, expenses and repayments (title, date, amount, currency, exchange rate, category, payer and recipient, split, note), reasons for voiding or editing, and friends and the nicknames you give them. We use this data to record and split shared expenses and to settle up. Notes and void or edit reasons are visible to members of the same group.
• Account settings: your language and Financial notifications settings are saved to your account to apply those settings. They are not shown to other members.
• Receipt photos: Receipt photos you attach are stored in private cloud storage. Before upload, each photo is re-processed on your iPhone to remove EXIF, location, and other metadata. When uploading, the app includes a randomly generated identifier stored on your device, used to recognize and clean up unfinished uploads. It is not an advertising identifier and is not used for ads or to follow you across other apps or websites.
• Photo library: When you add a receipt photo from your library, the app uses the system photo picker and only receives the photos you select. It never reads your whole library.
• Camera: used only to take receipt photos.
• Contacts: When you add a friend from your contacts, the app uses the system contact picker and only takes the name of the one contact you select (or the company name if there is no name). It never reads your whole address book.
• Push notifications: If you allow notifications, we store the device token from Apple's push notification service to send ledger-change notifications. A notification only says that something changed; it never contains amounts, groups, or anyone's identity.
• Subscriptions: When you buy or restore ZereZ Pro, we store data such as the App Store transaction identifier, product, subscription status, purchase date, and expiry date to confirm your plan. When you buy, the app also passes your ZereZ account identifier to Apple so the subscription can be matched to your account. When you restore a purchase that is linked to another ZereZ account, the app verifies this device through Apple's device verification service; we do not keep the device key.
• Usage events: for example, reaching a free-plan limit, opening the upgrade screen, the result of a purchase, the first app launch each day, and subscription status changes (containing only the type of change and the environment). These events are linked to your account, are used to understand plan usage, improve the product, and check that purchases and subscriptions are working, and are deleted after 180 days. When you delete your account, existing events are deleted with it; if your subscription status changes after that (for example, a subscription you didn't cancel renews), new events may be recorded and are also deleted after 180 days.
• Support emails: When you email us, we receive your name, email address, the contents of your message, and anything else you include. We use this to reply to you and handle your request. Our support address forwards mail through an email forwarding service to the email service we use, and our replies may come from a different address at that service.
• Technical data: Access logs kept by our server and website hosting services may include IP addresses. Invitation link tokens sit after the "#" in the link, so your browser never sends them to a server.

Protecting your data

• We protect your data with encrypted connections and access controls. Receipt photos are stored in private storage, and only people entitled to view them under the rules can get them.
• Please keep your iPhone and your Apple or Google account safe. If you notice someone else using your account or anything unusual, let us know as soon as possible.
• The data you enter must be lawful and must not infringe the rights of others.

No system can guarantee absolute security. If a data incident affects your rights, we will handle it and notify you as required by law.

What others can see

Members of the same group can see all of the group's ledger, splits, repayments, notes, void and edit reasons, edit history, receipt photos, group activity (such as who exported the ledger), and your name and avatar. Your friends can also see your name and avatar.

Former members who have left or been removed from a group can still see, on the Past group records screen, their own balance and payments, corrections, and voids involving them after they left; when it can be worked out, the screen also shows their own current repayment suggestions (the other person's name, direction, and amount). The complete historical statement CSV they export includes the ledger as of when they left, confirmed later changes, and balances and repayment suggestions derived for that history. These derived results are calculated for the fixed set of members as of when they left, also cover other members, and are not current payment instructions. The CSV does not include repayments added after they left.

Former members can also see group activity from before they left under Activity. For expenses they created that existed before they left, they can open the details from Activity and see the expense's current content and attached photos, including changes other members made after they left. They cannot see photos on other expenses.

When records after they left can't be confirmed as complete, the Past group records screen only shows active repayments involving them, without a balance or suggestions; the partial historical records CSV they export still includes the ledger as of when they left and confirmed changes, but does not provide derived balances or repayment suggestions. Activity and the expense details above are not affected by this limit.

Invitation links work for whoever holds them; ZereZ does not check whether the holder is the person the sender meant to invite. While a link is valid, its holder can get the following:

• Personal invitation links: after signing in with an Apple or Google account (no ZereZ account needed yet), the app shows the inviter's name, the invited member's name, and the names and roles of the groups that member is currently in. The preview data sent to the app also includes the total number of that member's groups, counting groups they have left or been removed from. The regular group list does not include the names, statuses, or roles of those groups. If that member and the holder both have member records in the same group, the preview data and the screen also list the current names of those conflicting groups, including groups that either of them has left or been removed from.
• Group join links: after signing in and finishing ZereZ account setup, the app shows the group's name.

Links are valid for 7 days, and this information can no longer be obtained once a link expires, is revoked, or is replaced. A personal invitation link also stops working once it is used or when the person who sent it no longer manages that member; a group join link only works while the group is active. The invitation web pages themselves do not show this information.

Once the holder successfully accepts, the person who sent the link does not need to approve again:

• Accepting a group join link: the holder becomes a member of that group and can see what members can see, as described above.
• Accepting a personal invitation link: the holder takes over that member's identity and ledger records. In groups the member is still in, the holder becomes a member and can see what members can see. In groups the member has left or been removed from, the holder only takes over past records, does not join the group, and can only view them within the former-member scope described above.

Sharing personal data with third parties

We do not sell your data. The app currently has no ads, does not use the advertising identifier, never asks for permission to track you through Apple's ATT prompt, does not follow you across other apps or websites, and includes no third-party SDKs for usage measurement or crash reporting.

Apart from what is described in the previous section, we only provide personal data to third parties in these cases:

• Service providers we engage to help run ZereZ (see the list below). Except as noted below, they process data only as needed to provide their services.
• With your consent.
• When required by law or lawfully requested by an authority.
• To prevent harm to the life, body, freedom, or property of you or others.
• When necessary to address conduct that violates the Terms of Use or harms ZereZ or other users.

Your data may be stored or processed outside your country or region. The types of services we use are:

• Cloud database, sign-in verification, file storage, and server services.
• Hosting for this website and the invitation pages.
• Email forwarding and mail services for handling support emails. Our support mailbox currently uses a standard email account, and that service handles messages under its own terms and privacy policy.
• Apple: Sign in with Apple, push notifications, App Store subscriptions, and device verification (privacy policy).
• Google: Google sign-in and Google account profile photos (privacy policy). The photo's address comes from Google sign-in. When other users see the photo in the app, their device loads the image directly from the host at that address, so that host may receive connection details such as the device's IP address, even if they don't use Google sign-in.
• Exchange rate data: fetched by our server; no user data is sent.

Links to other sites

The app and this website may link to other sites or services. Those sites have their own privacy policies and are outside the scope of this policy; please review them yourself.

Retention and deletion

General cleanup

• You can delete your account in the app. Once submitted, the account stops working immediately, your sign-in data is deleted immediately, and your general personal data is cleared within 7 days at most.

Records with separate retention periods

• The following data has its own retention period:
  • After you delete your account, ZereZ Pro subscription records are kept until 30 days after the subscription expires or is revoked (and for as long as a billing retry or grace period continues), to confirm subscription status and verify which account a subscription belongs to.
  • Purchase restore records and App Store subscription notification records: kept for 30 days for security checks and to confirm subscription status.
  • Your deletion receipt: kept for 7 days after cleanup finishes, so you can check the result from the sign-in screen.
  • Usage events newly recorded from subscription status changes after you delete your account: deleted after 180 days.

Other retention and deletion details

• Your name in each group is kept by default so other members can tell who a payment involves; you can choose to remove it when deleting, and it will be shown as a placeholder label instead.
• Expense titles are kept; notes, additional void notes, and edit reasons you wrote are cleared; the category chosen when voiding is kept; photos you uploaded are deleted. Exception: when a transaction's edit or void records are in an older format or incomplete, notes, older-format void reasons, and edit reasons may remain.
• After a receipt photo that was successfully uploaded is deleted (including when you delete your account), the photo and its storage path are cleared, but the on-device identifier used for the upload and the session identifier for that upload stay with the attachment's technical record. They are kept for as long as the group's data exists, with no fixed time limit.
• After you delete your account, your language and Financial notifications settings are no longer used. While other retained records still reference your account record (such as group activity, member departure records, or subscription records), these two settings stay with it, with no fixed time limit, until no references remain, and are then deleted.
• If a group still has other registered members, its shared ledger is kept for them. If only former members who have left or been removed can still view it, the group is archived and kept so they can still see its past records. If no one else can view it (for example, only members who never registered remain), the group is deleted; in a few cases the group is archived instead to preserve invitation and claim records, but no one can view it.
• Support emails are not deleted automatically when you delete your account. We keep them until they are no longer needed to handle your request or related records, with no fixed time limit. You can email us to ask for deletion, unless the law requires us to keep them. The email forwarding service also keeps records such as the sender, recipient, and subject for about 31 days.
• Outside the scope of deletion: CSV files or screenshots that other members downloaded earlier, and mentions of your name in text that other members wrote themselves (such as notes). Copies in server backups are replaced when the backup retention period ends.
• If you don't delete your account, ledger data is kept so group members can reconcile; voided transactions also stay on record.

Your rights

In the app you can change your display name, delete your account, and export a group's ledger as CSV. For any other request to access, correct, or delete your data, email support@zerezapp.com.

Minors

ZereZ is not designed for children under 13, and we do not knowingly collect children's data. Minors should get the consent of a legal guardian before using ZereZ.

Changes to this policy

We may revise this policy as the service or the law changes. When we do, we will update this page and its effective date.