ZenZen privacy notice
ZenZen is an AI wellness companion operated by Decodation LLC, 8930 W Lancelot St, Boise, ID 83704-6310, United States. This notice describes the current ZenZen application and identifies remaining legacy-data limits. It applies to com.art.zenzen and Apple app 6475656449.
Before you chat: your message, recent conversation context and any managed-memory texts you have selected and enabled are sent through ZenZen’s server to OpenAI after you agree to AI sharing. Text you enter can reveal health or other sensitive information. Leave out names, contact details and information about other people where possible.
ZenZen is not medical care, a human therapist or an emergency service. Conversations are not monitored for emergencies.
1. What we process and why
- Account and profile: a Firebase user ID, including an automatically created guest account; the email used for optional sign-in to an existing email/password account; profile details you provide, such as name, age or sex; and account creation information. These support authentication, account management and your profile. A guest account is still an identifiable app account, not a promise of anonymity.
- Conversations: messages, replies, drafts and recent context for generating AI responses and continuing conversations. Optional editable conclusions contain the concern, insight and next step you choose to save with a conversation. Current chat history, conclusions and consent choices are stored in the device’s secure storage and separated by Firebase account ID.
- Optional wellbeing records: when these features are available in your installed version, mood and energy ratings, optional day tags and notes, practice-completion records with optional easier/same/harder feedback, and favorite practices help you review what you chose to record. You may skip entries. These records and editable conclusions are kept locally in account-scoped FlutterSecureStorage; ZenZen does not provide built-in cloud synchronization for them and does not automatically include them in AI requests. If you choose to copy their text into a message and send it, that message follows the AI-sharing rules above. Availability of practice content is subject to separate review and does not follow from this notice.
- Today and weekly reflection: the optional Today card keeps one local-day action you explicitly save, its date, and collapse/skip choices. It does not keep an archive of daily plans. My week derives descriptive counts from retained local check-ins and practice feedback, and can store your own editable words about what you noticed, what helped and what you want to try. These fields share the current Firebase account’s device secure-storage record with chat and wellbeing data. They have no built-in cloud synchronization and are not automatically added to AI requests or managed memory. Only text you deliberately copy into and send as a message, or explicitly save and enable in managed memory, follows those separate sharing rules.
- Optional local reminders: reminders are off by default. If you opt in, the app stores your selected time and any quiet hours and requests the device’s notification permission when needed. Scheduling takes place on the device. Notification text is neutral and does not include your journal, mood, practice feedback or conversation contents. Your operating system may display that neutral text on the lock screen according to your settings.
- Service and security records: request and conversation identifiers, a fingerprint of the request, a hashed account identifier, reply-delivery records that can include reply text, usage counts, timestamps and technical network/app-verification information. These prevent duplicate charges, deliver replies, enforce limits and reduce abuse. A minimal account-ID deletion block can also be retained to reject still-valid account tokens during deletion. A hashed ID is pseudonymous, not anonymous.
- Purchases: app user identifiers, purchase and subscription status, products and transaction-related records handled with RevenueCat and Apple or Google to provide and restore paid access.
- Diagnostics and older-version advertising: the reviewed configuration for the updated ZenZen app no longer includes the Google AdMob advertising SDK. Older installed releases can still include it. Firebase Performance and RevenueCat integrations remain and can process app/install identifiers, technical network/performance information and diagnostics to operate the service, check subscriptions and investigate failures. In older releases that include AdMob, advertising SDKs can also process device or advertising identifiers, IP/network information and app interactions according to their settings. Updating this notice does not itself update or verify an older installed app.
- Support: messages and contact details you choose to send us, to answer questions and handle privacy requests. Optional read-aloud uses your device’s selected speech engine; its processing depends on the engine and device settings.
Guest access and optional existing-account sign-in
You can continue as a guest. In updated versions, the welcome screen also offers Sign in to an existing account. This uses Firebase Authentication to sign in with an email/password account you already have. This flow does not create a new email account or provide password-reset controls.
ZenZen uses the password for that authentication or for normal account confirmation before deletion. The app does not persist the password in its own storage or send it to ZenZen’s AI gateway or OpenAI. The input field is cleared on successful sign-in, cancellation or disposal of the form; after a failed attempt it can remain temporarily in that form while you retry. Firebase can retain authentication/session state. Your operating system or password manager may separately offer autofill or save credentials according to your choices and device settings.
Local records remain separated by Firebase account ID on this device. Signing in switches accounts; it does not link, move, merge or migrate guest conversations, journal entries, conclusions, Today/weekly records, managed memory or consent choices. There is no built-in cloud synchronization for these records. Export any supported records you need while you can still access the guest account, before switching or signing out. You may not be able to reopen a guest account afterwards. Signing in with an email is not a way to recover an unrelated guest account.
The current RevenueCat sign-in integration receives the Firebase user ID for subscription identity. It does not automatically forward your Firebase email, profile name or password to RevenueCat. Separate information you deliberately provide to a store, support or another service follows that service’s process.
Managed AI memory
In versions with these controls, memory is off by default. You manually add or edit entries, select each entry you want to use and turn on memory use globally. ZenZen does not automatically extract memories from chats, journal entries or conclusions. A saved entry alone is not permission to send it. Only the texts that are both selected and enabled are included with future AI requests through ZenZen’s existing server to OpenAI, after AI-sharing consent. Memory may contain personal or health information you choose to enter.
Memory is stored locally in a separate secure-storage key scoped to the current Firebase account, with no built-in cloud synchronization. The limits are 10 entries, 300 UTF-16 text code units per entry and 2,000 in total. Editing, deselecting, disabling or deleting memory changes future use. A change blocks retry of an older pending request that used the earlier memory state; sending with the new state requires an explicit new request.
Disabling or deleting memory does not recall text already transmitted, erase generated answers or remove server/provider records. It removes dedicated memory, not information already present in chat messages or answers; those can still enter recent conversation context. Start a new chat or delete the affected conversation to stop using that conversation as context. This does not recall earlier transmissions. Clearing chats or the journal preserves managed memory. Forget all empties this device’s managed memory for the current account and disables its use. When you explicitly confirm account deletion, the app withdraws AI-sharing consent and clears and disables managed memory with verified secure-storage write/readback before calling the server deletion operation. For the account data successfully loaded on this device, it also clears the Today plan and weekly reflections together in a verified local write before that server operation. A pending server response does not restore these cleared fields; other records such as chats and journal entries can remain while review is pending. If a required local write/readback fails, the app reports an error rather than claiming completion. If local records cannot be read or loaded, their erasure has not been verified; do not assume that a server response or an older app version erased them. To check the remaining scope, use an updated app and contact support.
Export records you choose
Export starts with no records selected. In versions with PDF export, choose all dates, the last 7 or 30 days, or a custom inclusive period using the device’s local calendar dates, then select individual mood/energy entries. Their original timestamps retain an explicit UTC label in the document. Saved conversation conclusions have no stored date: include them only through the separate undated option and individual selection; the journal period does not filter them. Changing the period clears the selection and prepared preview. Review the text before explicitly choosing Copy, Share TXT or Preview PDF. The PDF preview shows the pages of that prepared document; a separate Share PDF action opens the system share sheet. A changed selected source or account blocks the old prepared PDF.
The existing export includes only the mood/energy entries and saved user-written or edited conclusions you select. It excludes full chats, raw AI responses, drafts, account IDs, internal technical identifiers, managed memory, Today plans and weekly reviews. There are limits of 100 selected records and 100,000 UTF-8 source bytes. PDF preparation is limited to 20 pages, 8 MiB of total page PNG data and a 12 MiB PDF; excessive selections fail rather than silently omitting content. The PDF is a personal record, not a clinical assessment or diagnosis. Its image pages include a Unicode text layer for compatible readers; accessibility and text extraction vary by reader.
Preparation uses local text rendering and PDF generation, with no remote rendering or font downloads. ZenZen does not automatically upload the export or send it to AI or a specialist; you explicitly choose any destination or recipient through the operating system. Copy places text on the system clipboard. Native TXT or PDF sharing writes an unencrypted file into the app’s owned export cache with a neutral filename, separately from secure storage. TXT is ordinary readable text; the PDF is not password-protected or encrypted. App-owned export-cache cleanup runs when you next open these controls, sign out or request account erasure, without promising immediate deletion or a fixed cleanup deadline.
Opening or closing the share sheet does not prove delivery. Your chosen app, operating system or recipient can retain copies. ZenZen cannot erase system clipboard contents, files saved elsewhere, backups or recipients’ copies. These copies can contain sensitive notes and conclusions; choose what to include and where to share it.
Optional reports about AI replies
In an updated version that offers Report reply, you can review and edit a selected AI excerpt, choose a reason and optionally add a comment. The form asks for your agreement before sending your account identifier, reason, selected excerpt and comment to Decodation LLC through ZenZen’s Firebase server. Your full conversation and prompts are not automatically attached, and submitting this report does not make a new OpenAI request.
Reports and report-rate metadata are stored in restricted server records linked to your Firebase account for assessing reported problems, improving app safety and preventing abuse. There is no automatic report-expiration policy currently configured. Reports are included in the account’s known Firebase data cleanup; the separate legacy/provider limitations in account deletion still apply. Unsent and uncertain report-form state is transient on the device for an explicit retry, not an automatic background outbox.
Report received means that the server recorded the report. It does not mean a person has reviewed it, that it has been resolved or that you will receive a personal response. Reports are not emergency support and are not a monitored urgent-help channel.
2. Services receiving data
- Google Firebase / Google Cloud: authentication, profiles, app verification, hosting, the AI gateway, operational data and diagnostics.
- OpenAI: the message, bounded recent context and managed-memory texts you explicitly select and enable for future AI requests. The gateway requests non-stored API responses, but this does not mean no provider retention. OpenAI describes separate abuse-monitoring and other retention controls; ZenZen has not verified a Zero Data Retention arrangement. See OpenAI’s API data controls.
- RevenueCat, Apple and Google Play: purchase verification, subscription access, transactions and restoration. Payment processing is handled through the applicable store.
- Google AdMob (older releases): the reviewed updated app configuration removes this advertising integration. It can remain in older installed releases where ads are enabled. See Google’s privacy policy for those services.
- Supabase (legacy integration): older versions could store messages with email/profile information. New chat and concern-selection flows no longer insert those messages, but the integration remains and historical storage, access rules and full erasure have not been verified. A request to us can include a review of identifiable legacy records.
These providers may process data in the United States or other countries. ZenZen does not promise that processing stays in your country. Data may also be disclosed when required by applicable law or to address a specific security or legal obligation.
3. Storage and retention
| Record | What this means |
|---|---|
| Device conversations and drafts | Kept in secure storage until you delete them through the app’s data controls. Current history supports up to 20 conversations and 200 messages per conversation. Removing the app may not clear every secure-storage item or backup. |
| Local wellbeing records and conclusions | Up to 365 mood/energy entries, 365 practice-completion/feedback records and 20 favorite practices per account on this device. Notes are optional and limited to 1,000 text code units. Records remain until you remove them using the relevant controls; reaching a limit does not automatically discard older entries. Conclusions remain with their conversations until edited, removed or the conversation is deleted. |
| Today and weekly reflections | One saved Today plan with a local date, an action up to 300 UTF-16 code units and collapse/skip choices; a new-day view does not itself erase the stored plan. Up to 52 weekly reviews with three user-written fields of up to 1,000 UTF-16 code units each; reaching the limit does not silently discard older reviews. Counts are recomputed from retained original records. Editing/deleting a weekly review preserves originals; removing originals does not erase words you copied into a review. Bulk device-conversation clearing also clears Today and weekly reviews. For successfully loaded account data, account-deletion confirmation clears those fields in a verified write before the server operation, including while it remains pending. Older versions can omit newer fields when saving; they do not establish cleanup of data they do not understand. |
| Managed AI memory | Up to 10 entries, 300 UTF-16 text code units each and 2,000 total, stored in a separate account-scoped secure-storage key. Kept until you edit or remove them, use Forget all or explicitly confirm an account-deletion request, which clears and disables memory before the server deletion operation. Clearing chats or journal entries preserves this separate memory. |
| Selected exports | Copied text and saved/shared copies are outside app erasure controls. Native TXT/PDF sharing creates an unencrypted file in the owned app cache with a neutral filename. Cleanup runs on next feature opening, sign-out or account-erasure request; no immediate deletion deadline is promised. Generation and size limits are described above. |
| Local reminder preferences | Kept on this device until changed or the current account’s local data is cleared after confirmed account erasure. Clearing the journal does not reset these preferences. Turning reminders off cancels their scheduling; signing out also cancels scheduling but keeps local account records and preferences. |
| Server reply-delivery records | Marked with an expiry of about one day. They can include generated reply text. Automatic expiry deletion has not been verified. |
| Server usage and budget records | Marked with an expiry of about 30 days. Automatic deletion has not been verified; an expiry field alone does not prove removal. |
| Account, purchases, support and legacy data | No single verified automatic deletion schedule applies to all these systems. A deletion block can retain the account ID while older authentication tokens may remain valid; automatic removal of that block is not promised. Deletion requests require scope and identity checks; provider records or legally required records may remain. We explain unresolved items rather than treating account removal as proof of complete erasure. |
We do not deliberately write raw prompts or authentication tokens to the gateway’s application records. This is not a statement that conversation content never leaves the device, or that infrastructure and service providers keep no records.
4. Your controls and requests
- Stop future AI sharing: open the chat’s AI sharing and privacy control and withdraw consent. This stops future AI requests from that account on that device; it does not recall data already sent.
- Manage local conversations and conclusions: edit or remove a conclusion in its conversation, or delete one conversation through History to remove that conversation’s chats, drafts and conclusions. The bulk Delete conversations on this device action also clears the Today plan and weekly reviews for the current account. It preserves mood/practice records, managed memory and reminder preferences. Server/provider deletion is separate.
- Manage wellbeing records: in the wellbeing/journal screen, edit or delete individual mood entries. Its separate clear action removes mood entries, practice-completion/feedback records and favorite practices for this account on this device, while keeping chats, conclusions, managed memory, Today, user-written weekly reviews and reminder preferences. Removing an original entry changes derived weekly counts, but does not remove words you copied into a review or plan.
- Manage memory and export: add, edit, select or delete memory and use its separate Forget all action. Review the memory-sharing limits and selected-export and copy limits above before sending or sharing.
- Manage reminders and sign-out: choose reminders, time and quiet hours in the reminder settings, or turn reminders off. Notification permission can also be changed in device settings. Signing out cancels scheduling but retains local records. When you explicitly confirm account deletion, the app withdraws AI-sharing consent and clears and disables managed memory with verified secure-storage write/readback before calling the server deletion operation. For the account data successfully loaded on this device, it also clears the Today plan and weekly reflections together in a verified local write before that server operation. A pending server response does not restore these cleared fields; other records such as chats and journal entries can remain while review is pending. If a required local write/readback fails, the app reports an error rather than claiming completion. If local records cannot be read or loaded, their erasure has not been verified; do not assume that a server response or an older app version erased them. To check the remaining scope, use an updated app and contact support. After confirmed account erasure and successful local cleanup, the app removes the current account’s remaining device records. Clearing one device does not remotely erase other devices.
- Request account and associated data deletion: use the in-app account/data controls or follow our account deletion instructions. You can also contact decodationllc@gmail.com without reinstalling the app.
- Manage purchases: cancel an auto-renewing subscription with Apple or Google Play. Deleting the app, history or account is a separate action.
Depending on your location, you may have rights to access, correct, delete or receive a copy of personal information, restrict or object to processing, withdraw consent, or complain to your local privacy authority. Send requests and questions to the contact above. We may need proportionate information to verify ownership. Never send passwords, authentication tokens, API keys or full payment-card details.
5. Security, children and updates
The new chat uses HTTPS, account authentication, app verification and device secure storage. Local wellbeing data uses the same account-scoped secure-storage record as chat history. Managed memory uses a separate account-scoped secure-storage key; shared TXT/PDF cache files and clipboard copies have the different handling described above. Operating-system backups, secure-storage persistence and behavior after uninstall or device migration vary by platform and configuration. These measures do not guarantee absolute security, anonymity or erasure by uninstalling. Do not use ZenZen to store information you cannot risk disclosing.
ZenZen is not designed as a child-directed service. If you believe a child supplied personal information without the consent required by local law, contact us so we can review the information and appropriate action.
We update this notice when processing changes. Material changes to AI sharing will be explained before seeking any additional consent that is required. Older public versions can have legacy behavior described above; this notice does not establish that every older build has been updated.