Privacy Notice

Who we are

zZuP! is operated by [zZuP Labs, Inc. — replace with registered legal entity] ("zZuP", "we", "us"), the data controller for personal information processed through the zZuP! mobile app and this website (together, the "Service"). Questions: privacy@zzup.app.

Information we collect

Information you give us

• Account: email address and password (stored as a salted hash — we never see your plaintext password).
• Profile: display name, avatar, bio, university, and optional fields you choose to add (such as date of birth or nationality). Optional fields are hidden from other users by default and shown only if you switch them on.
• Pet profile: your pet's name, avatar, breed, and bio.
• Content: posts, comments, messages, and images you create — including which identity (real or pet) you chose for each one.
• Student verification (optional): if you verify your student status, your university email address and the enrollment/offer document you upload. Verification documents are stored in a private bucket, are visible only to our verification process, and are never shown to other users.
• Support: anything you send us when you contact support or report content.

Information collected automatically

• Device and log data: device model, OS version, app version, language, IP address, timestamps, and crash/diagnostic logs.
• Usage data: how you interact with features (e.g., which screens are used), to fix problems and improve the app.

Location

Location-based features, if and when offered, are opt-in. Where available, you can choose precise sharing, approximate ("fuzzy") sharing, or off — and "off" means we delete your stored location rather than just hiding it. [Confirm against shipped feature set before publishing.]

Your pet is an AI

Conversations with your pet (zZuPer Talk) and pet-generated content are produced by large language models operated by third-party AI providers [list providers, e.g. OpenAI]. To make that work:

• Messages you send your pet, plus relevant "pet memories" (summaries the pet keeps about your preferences and past chats), are sent to the AI provider to generate responses.
• Our agreements with AI providers prohibit them from using your content to train their models.
• Pet memories live in your account. [Describe user controls for viewing/clearing pet memories once shipped.]
• AI output can be wrong, weird, or both. Don't rely on your pet for medical, legal, financial, or emergency matters — it is a cartoon animal.

How we use information

• Provide and operate the Service — accounts, chats, matching, post distribution, notifications.
• Power pet features — AI conversation, memory, and matching people by conversational "frequency". Matching compares derived signals (such as embeddings of pet-chat activity), not your private real-identity messages. [Confirm technical description.]
• Keep the community safe — moderation, fraud and spam prevention, enforcing our Terms and Guidelines.
• Verify student status where you request it.
• Debug, improve, and develop the Service.
• Comply with law and enforce our legal rights.

We do not sell your personal information, and we do not use your content or behavior to sell targeted advertising.

Anonymity — what it does and doesn't do

When you interact as your pet, other users see your pet identity, not your real one. Per-conversation handles prevent other users from linking your pet across contexts. However:

• zZuP! always knows which account an identity belongs to. That's what makes blocking, moderation, and the law enforceable.
• If you reveal identifying details in a conversation, that's on you — the app can't unsay it.
• Friendship requires both sides choosing to connect as real people; the app never reveals your real identity without an action you take.

When we share information

• Other users: according to the visibility and identity you choose per post, message, or profile field.
• Service providers: infrastructure and processing partners under contract — currently including [Supabase (database, auth, storage), AI providers, push notification services, analytics — finalize list]. They may process data only to provide services to us.
• Legal: when required by law, legal process, or to protect the safety of users or the public.
• Business transfers: as part of a merger, acquisition, or asset sale — the successor stays bound by this notice.

Retention and deletion

• Messages are permanent by design. No one — including the sender — can delete a sent message. This is a deliberate safety and accountability decision: it keeps evidence intact when someone reports abuse.
• Account deletion is deactivation-first. Deleting your account deactivates your profile and both identities. Your past posts, comments, and messages may remain visible, attributed to a "deactivated user", so that conversations and reports aren't silently rewritten.
• Verification documents can't be modified or deleted after upload (audit integrity), and are retained for [retention period].
• Erasure requests: where the law gives you a right to erasure, we honor it — email privacy@zzup.app. Some data may be retained where the law permits (e.g., safety records, legal obligations).

Security

We use industry-standard measures: encryption in transit, hashed credentials, row-level access controls at the database layer, and least-privilege access for our team. No service is perfectly secure; if a breach affects you, we'll notify you as required by law. Report vulnerabilities to security@zzup.app.

Children

zZuP! is built for university communities. You must be at least 13 years old (or the higher minimum age your local law requires — e.g., 16 in parts of the EEA) to use the Service, and at least the age required to consent to our AI features in your region. We delete accounts we discover belong to children under the minimum age.

Your rights

Depending on where you live, you may have the right to:

• Access a copy of your personal information;
• Correct inaccurate information;
• Delete your information (see §7 for how this interacts with our retention design);
• Port your data to another service;
• Object to or restrict certain processing;
• Complain to your local data protection authority.

Exercise any of these at privacy@zzup.app. We respond within the timelines your local law requires. [Add GDPR legal-bases table and CCPA/CPRA disclosures before launching in the EEA/UK or California.]

International transfers

Our infrastructure is hosted in [region — e.g., the United States]. If you use zZuP! from elsewhere, your information is transferred there, protected by appropriate safeguards such as standard contractual clauses where required.

Changes to this notice

When we make material changes, we'll notify you in the app and update the date at the top. Continued use after the effective date means the updated notice applies.

Contact

[zZuP Labs, Inc.] · [registered address] · privacy@zzup.app