Privacy Policy

1. Information We Collect

Account information: when you create an account, we collect your name, email address, and a securely hashed password. If you sign in with Google, we receive your name, email address, and profile picture from Google.

Content you provide: prompts, text, images, and audio you submit to generate results, along with the outputs the Service produces for you.

Usage and technical data: basic logs such as IP address, browser type, and timestamps, used to operate, secure, and improve the Service.

2. How We Use Your Information

To provide, maintain, and improve the Service and the AI features you request.

To create and secure your account, authenticate sign-ins, and send essential account emails such as email verification and password resets.

To detect, prevent, and address abuse, fraud, or security issues, including rate limiting and account verification.

To comply with legal obligations and enforce our Terms of Service.

3. Passwords and Security

We never store your password in plain text. Passwords are hashed using PBKDF2-HMAC-SHA256 with a per-user random salt before storage.

Sessions are maintained with signed, HTTP-only cookies. We apply reasonable technical and organizational measures to protect your data, but no method of transmission or storage is completely secure.

4. Third-Party Services

We use Google for optional single sign-on; your use of Google sign-in is subject to Google's privacy policy.

We use Resend to deliver transactional emails such as verification and password-reset links.

We use Cloudflare to host and serve the Service and to store account data. We do not sell your personal information.

5. Data Retention

We retain account information for as long as your account is active. Authentication tokens for email verification and password resets are short-lived and expire automatically.

You may request deletion of your account and associated personal data by contacting us at the address below.

6. Your Rights

Depending on your location, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing.

To exercise these rights, contact us at support@zofo.app.

7. Children's Privacy

The Service is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from them.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above, and where appropriate we will provide additional notice.

9. Contact Us

If you have questions about this Privacy Policy or your data, contact us at support@zofo.app.