ZyeproPrivacy policy
1. Who we are
Zyepro makes apps. "We" and "us" in this policy mean ZYEPRO PLT, a limited liability partnership registered in Malaysia, of 113 Lebuh Bangau, Taman Berkeley, 41150 Klang, Malaysia. We are responsible for your personal data under this policy (the "controller" in European data protection law, the "data user" in Malaysia's Personal Data Protection Act 2010).
Questions about privacy: support@zyepro.com.
2. The short version
- One Zyepro account works in every new Zyepro app. To run it we keep your email address, how you sign in, the devices you are signed in on, and whether you have Zyepro Pro.
- Zyepro Notes keeps your notes on your device and, so your other devices get them, on our sync server. We do not read or analyse them.
- We do not keep your name, a password or your card details. We have no ads, no analytics, no tracking, and we never sell your data.
- You can delete your account at any time, in the app or at account.zyepro.com/delete. That deletes it in every Zyepro app at once. You can also ask for a copy of your data.
- Our servers are in the European Union (Finland), with encrypted backups in the European Union.
3. What we collect, and why
We get this data from you, and from Google, Apple or Google Play when you use them with Zyepro. An email address is the one thing every account needs (given by you, or by Google or Apple when you sign in with them): without it we cannot create an account. Everything else is needed only for the features you use.
3.1 Your Zyepro account
When you first sign in, we create an account with a random account number. We keep:
- your email address, and whether you proved you own it, so you can sign in, get back into your account, and receive essential messages about it;
- a random billing reference, which we give to the app store when you buy Zyepro Pro so the purchase lands on your account (it reveals nothing about you);
- when the account was created and last used, and whether you have used a free trial.
3.2 How you sign in
- Email code. We email you a 6-digit code and a link. We store only scrambled (hashed) versions of the code and link, and delete them after 24 hours. To stop abuse we count how many emails and wrong codes each address gets, and delete those counts after 2 days.
- Google. Google tells us your Google account number, your email address and whether Google has verified it. Google may also send your name and profile picture; we do not keep them. We never see your Google password.
- Sign in with Apple, if you use it. Apple tells us your Apple account number and an email address, which may be a private relay address that forwards to you. We also keep an encrypted Apple token, only so that we can withdraw Zyepro's access at Apple when you delete your account. If you delete your Apple ID and it was your only way to sign in, we lock your Zyepro account instead of deleting it (you may still be paying for Zyepro Pro elsewhere), email you a way back in if we can, and delete the locked account after 30 days.
3.3 Your devices and sessions
Each time you sign in, we record a session: which app, the platform (for example Android or Windows), the device name, the app version, and when it was created and last used. This lets you see where you are signed in, sign out a lost device, and keeps your account safe.
3.4 Zyepro Pro purchases
Zyepro Pro is sold through Google Play for now. Google handles the payment; we never see your card or bank details. When you buy, we keep the store, the order and purchase numbers, the product, the dates and the state of the subscription (for example active, in a grace period, cancelled or refunded), and we check them with Google's servers. We use this to unlock Pro in every Zyepro app, to handle refunds and to answer questions about a payment. When we give someone Pro by hand (for example a tester), we record why and who did it.
3.5 Zyepro Notes: your notes
- On your device: your notes, tags, pinned and trash states and their times live in a database on your device.
- On our sync server: when you sync, the app sends your notes over an encrypted connection to our server, which stores them so your other devices can download them. The server stores notes as data it does not open, read or analyse, and we use them for nothing else. They are not end-to-end encrypted today: they are not locked with a key that only you hold, so the people who run the server could technically access them.
- The sync server also keeps your account number, a copy of your email address, whether you have Pro, how much storage you use, and a list of your devices (device name, platform, when it was added, last seen and last synced).
- Trash is not deletion: notes in the trash still sync. When you delete a note forever, its content is removed from the server; a tiny marker with only the note's random number stays until all your devices have seen the deletion.
- Signing out of Zyepro Notes deletes the notes stored on that device (the app first sends any changes not yet synced, and warns you if it cannot).
3.6 Security logs
Our servers log security events, such as sign-ins, failed codes and blocked requests, with the IP address and account number involved. We use them only to detect and stop abuse and attacks, and they are deleted after about 14 days. They never contain sign-in codes, tokens or the content of your notes.
3.7 Emails we send
We send only emails you need: sign-in codes and links, and important messages about your account (for example how to get back into a locked account). We do not send marketing email.
3.8 Cookies
- This website (zyepro.com) sets no cookies and runs no scripts or analytics. Cloudflare, which delivers the site, may set a security cookie in rare cases, to check that a visitor is not a bot.
- The account pages (account.zyepro.com) use only cookies that are strictly necessary: one that protects the sign-in form (up to 1 hour), one that carries a sign-in with Google while it happens (up to 10 minutes), and one that keeps you signed in on those pages for 15 minutes. Each holds only a random value.
- The apps use no cookies or advertising identifiers.
3.9 What we do not collect
No names (even when a sign-in provider offers one), no passwords, no payment card data, no location, no contacts, no advertising identifiers, no analytics and no crash reports.
4. Our legal reasons
Where European or UK law applies, we rely on these legal bases:
| What we do | Legal basis |
|---|---|
| Run your account, sign you in, sync your notes, provide Zyepro Pro, send essential emails | Contract: we need it to give you the service you asked for |
| Security logs, rate limits, fraud and abuse prevention | Legitimate interest: keeping the service and your account safe |
| Deleting your data and giving you a copy when you ask; keeping proof that a deletion was done | Legal obligation, and contract |
5. Companies that help us
We do not sell your data or share it for advertising. These companies process data for us, only to run the service and under data processing agreements:
| Company | What they do for us | Where |
|---|---|---|
| Hetzner Online | Hosts our servers and their disks (accounts, notes, logs) | Finland (EU) |
| Cloudflare | Delivers this website and connects you to our servers: domain names, encrypted connections, protection from attacks. Every request passes through it | Worldwide network |
| Backblaze | Stores our encrypted backups | Netherlands (EU) |
| Resend | Sends our sign-in emails (your email address and the email text) | United States company |
Some companies act on their own account, under their own privacy policies, when you choose to use them with Zyepro:
- Google, when you sign in with Google, and when you buy Zyepro Pro through Google Play. We ask Google's servers about the purchase to check it.
- Apple, if you use Sign in with Apple. When you delete your account we ask Apple to withdraw Zyepro's access.
Each Zyepro app's server (for example the Zyepro Notes sync server) is run by us and receives from the account service only what it needs: your account number, your session, your proven email address, a scrambled sign-in hint used to rebuild accounts after a server restore, and whether you have Pro.
We may disclose data if the law requires it, for example a valid court order, and we will tell you unless the law forbids it.
6. Where your data is
Our servers are in Finland and our backups in the Netherlands, both in the European Union. Cloudflare's network is worldwide, Resend is a United States company, and we run Zyepro from Malaysia. When data leaves the European Economic Area or the UK, we rely on the safeguards the law provides, such as the European Commission's standard contractual clauses in our providers' data processing agreements.
7. How long we keep it
| Data | Kept |
|---|---|
| Account: number, email, billing reference, dates, trial used | Until you delete your account |
| Sign-in methods (Google; Apple if you use it) | Until you delete your account or remove that method |
| Encrypted Apple token (Sign in with Apple only) | Until you delete your account, then until Apple confirms the withdrawal |
| Email codes and links (hashed) | 24 hours |
| Email and wrong-code counts per address | 2 days |
| Sessions | While you are signed in. After you sign out: 30 days, then only the session number, app and sign-out time for 400 days, so the sign-out stays in force everywhere |
| Account page cookies | 15 minutes to 1 hour (section 3.8) |
| Purchases | Until you delete your account; then unlinked from you and deleted after 30 days |
| Your notes and the notes device list | Until you delete the note forever, remove the device, or delete your account |
| Security logs | About 14 days |
| Account events our app servers read (account number, type of change) | 120 days |
| Proof that each app finished deleting an account (account number and times only) | 400 days |
| Record of support actions on an account (who, what, why; never an email address) | Kept as our record of what support did |
| Support emails you send us | Up to 2 years after the conversation ends |
| Backups of all of the above | 30 days (continuous backup) and 90 days (nightly backup). If we ever restore a backup, we first apply every deletion made since, so deleted accounts and notes do not come back |
8. Your choices and rights
- Delete your account. In any Zyepro app, open the account settings and choose Delete account. On the web: sign in at account.zyepro.com/delete. For your safety we ask you to sign in again if your last sign-in was more than 10 minutes ago. We delete your email address and sign-in methods at once, sign you out everywhere, and every Zyepro app deletes your data within days (at most one month). The few records that remain hold only your random account number (section 7) and exist to make sure the deletion sticks. Deleting your account does not cancel a Google Play subscription; cancel it in Google Play.
- Get a copy of your data. Use the export option in the app's account settings, or email us. You get everything the account service holds about you as a file (JSON) you can keep or move elsewhere. Your notes are on your devices; for a copy of what our sync server holds, email us.
- Correct your data. Changing your email address in the app comes later; until then, email us.
- Sign out everywhere on the account pages if you lose a device.
- Object or ask us to restrict how we use your data: email us.
- Complain. You can complain to a data protection authority: in the EU, the one where you live; in the UK, the Information Commissioner's Office; in Malaysia, the Personal Data Protection Commissioner. We would like the chance to fix it first.
We answer requests within one month. We may need to confirm it is really you, usually by asking you to sign in.
9. How we protect it
All connections are encrypted. Sign-in codes and session tokens are stored only in scrambled (hashed) form. Apple tokens are encrypted with a key kept apart from the database and its backups. Our servers accept no direct connections from the internet; only Cloudflare can reach them. Backups are encrypted. Every action our support takes on an account is logged. If a breach ever puts your data at risk, we will tell the authorities as the law requires, and tell you directly if the risk to you is high.
10. Children
Zyepro apps are not aimed at children, and you must be at least 13 to create a Zyepro account. We do not knowingly collect data from younger children. If you think a child has an account, write to us and we will delete it.
11. Google user data
When you sign in with Google we ask Google only for your basic account identity ("openid") and your email address. We use them only to sign you in, to recognise your account, and to contact you about it, as described above. We do not use Google user data for advertising, do not sell it, and do not let anyone read it except where needed to run the service, for security, or to comply with the law. Zyepro's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
12. Our other apps
MScopes, TrueTag and Facilitator do not use the Zyepro account and have their own privacy policies: MScopes, TrueTag and Facilitator. When a new Zyepro app uses the Zyepro account, it adds what it keeps itself to this policy or to its own.
13. Changes to this policy
If we change this policy we will update the date at the top. If a change matters, for example we start collecting something new, we will tell you in the app or by email before it takes effect.
14. Contact
Email support@zyepro.com, or write to ZYEPRO PLT, 113 Lebuh Bangau, Taman Berkeley, 41150 Klang, Malaysia.
This policy is also available in Bahasa Melayu. If the two versions differ, the English version applies.