Privacy Policy

ZIVR is a family-centered messaging app. This policy explains exactly what data ZIVR collects, how it is stored, and the controls available to you. We aim to be direct about what happens to your information rather than vague or aspirational.

Account information

Creating a ZIVR account requires only a display name. Username, phone number, avatar, status message, and preferred language are optional. ZIVR does not collect a password — authentication is token-based. At registration, a single-use recovery code is generated and shown to you once; its hash is stored on our servers so you can recover access to your account if needed.

Child and parent accounts

Parent accounts are promoted from standard accounts when a child account is first created. Child accounts are created by a parent and are stored with an explicit child account type. A parent can optionally set a numeric PIN for the child account at creation.

Server messages

Messages sent through ZIVR's real-time server are stored in our database. Each record includes the message text, type, sender, the chat it belongs to, and a timestamp. Messages are retained indefinitely — there is no automatic expiry or TTL. When your account is deleted, your sender identity in messages is disassociated, but the messages themselves are not deleted. Messages are removed only when the chat they belong to is deleted.

Local chat backups

If you use the Backup feature for a local (device-only) chat, the chat's message data is serialized and uploaded to ZIVR servers. The upload is stored as-is; no additional encryption is applied by the backup process itself. (If you had enabled per-message AES encryption on a chat before backing it up, those individual message fields remain encrypted in the backup, but unencrypted chats are backed up as plaintext.) Backups are retained on our servers until you delete them or delete your account.

Contacts and groups

Contact relationships, group memberships, and contact approval records are stored on our servers to support the real-time features of the app.

Call history

Call history is stored locally on your device only, in the app's local storage. It is not uploaded to or retained by ZIVR's servers.

Device contacts

If you grant the Contacts permission, ZIVR reads names, phone numbers, and contact photos from your device's address book to help you find ZIVR users you already know. Imported contact data is stored locally on your device in the app's local storage (AsyncStorage). It is not uploaded to ZIVR's servers. You can revoke this permission at any time in your device settings.

Device push tokens

When you grant notification permission, your device's push notification token is sent to ZIVR's servers and stored in your account record. This token is used solely to deliver push notifications to your device. It is updated automatically when the OS issues a new token.

Usage and diagnostics

We collect basic crash reports and aggregated, non-identifiable usage metrics to improve the app. We do not sell or share this data with third-party advertisers.

When a message is sent in a chat that includes a child account, ZIVR runs automated content safety analysis on the message text. This analysis is performed server-side using a third-party AI model (Anthropic Claude).

If content is flagged, ZIVR stores a record that includes: a truncated excerpt of the flagged text (up to 500 characters), a severity level (low, medium, or high), and the AI model's reason for flagging. This record is saved in our database and is accessible to the parent account linked to the child.

Parents choose which severity levels trigger a push notification (All, Medium and above, or High only). You can change this setting at any time; the change takes effect immediately. Parents can also mark flags as reviewed within the Parental Dashboard.

Content flag records persist until the child account is deleted. There is no separate endpoint to delete individual flag records.

ZIVR provides two separate, independent privacy features for individual chats:

ZIVR includes a cloud backup feature for local (device-only) chats. When you back up a local chat, the message data is uploaded to ZIVR's servers and can be restored on a new device. The backup process itself does not add an encryption layer to the data — if your chat has per-message encryption enabled, those messages remain in their encrypted form in the backup; otherwise the messages are stored in plaintext on our servers. Backups persist until you delete them manually or delete your account.

Server-connected chat history is already stored on ZIVR's servers as part of normal messaging and does not need a separate backup step.

You can also export any chat as a PDF or plain-text file directly from the app. Exports are saved to your device; ZIVR does not receive or store a copy of your export.

When a self-destruct (view-once or timed) message is open, ZIVR requests screenshot protection using the platform's native API. On iOS and Android, the operating system may show a blank or blurred screen when a screenshot is attempted while this flag is active.

Limitations: screenshot protection relies on platform APIs and applies only while a qualifying message is on screen. It does not prevent someone from photographing the screen with another device, and behavior varies by OS version and device.

ZIVR child accounts are created by and linked to a parent account. Parents can review and approve incoming contact requests for their child, configure recurring access schedules (time limits), grant temporary access outside those hours, and choose which safety-alert severity levels send push notifications.

ZIVR does not knowingly collect personal information from children under 13 without verifiable parental consent, consistent with the Children's Online Privacy Protection Act (COPPA) and similar regulations.

Content safety flag records for a child — including flagged text excerpts, severity, and AI reasoning — are stored on ZIVR servers and are accessible only to that child's linked parent account. These records persist until the child account is deleted.

Parents may request deletion of their child's account and all associated data by contacting ZIVR support as described in section 9 below.

Parents configure which content safety severity levels (All, Medium and above, or High only) trigger a push notification. Alerts are delivered only to the registered parent account for the child in question and are not shared with other users or third parties. Changing this setting takes effect immediately for new alerts.

ZIVR does not sell your personal data. We do not share your messages or personal information with advertisers. We share data with the following third parties as part of operating the app:

• Anthropic (content safety) — message text from chats involving child accounts is sent to Anthropic Claude for content safety classification. This happens automatically for every qualifying message.
• Anthropic (PDF export appendix) — if you choose to add an AI-generated summary or key-points appendix when exporting a chat to PDF, the selected message text is sent to Anthropic for that processing. This is optional and requires explicit consent in the export flow before any text is transmitted.
• Infrastructure providers — cloud hosting, database, and related services operate under data processing agreements that prohibit use of your data for any other purpose.

We may disclose data if required by law, court order, or to protect the safety of our users or the public.

You may request access to, correction of, or deletion of your account and personal data at any time. We will respond within 30 days.

Deleting your account removes your profile record and your cloud backups from our servers. Chats you created are not automatically deleted — the chat record is retained and your identity in it is disassociated (set to anonymous). Messages in those chats remain. Child accounts linked to your parent account are not automatically deleted when your account is deleted; a separate deletion request is required for each child account. Content flags associated with a child account are removed when that child account is deleted.

Locally stored app data on your device is removed when you delete the app.