Privacy Policy

1. Who we are

This Privacy Policy explains how Zovlet (“we”, “us”, “our”, the “Service”) collects, uses, stores, and shares personal information when you use the Zovlet website at https://zovlet.com, the Android app, and the iOS app (application id com.zovlet.app).

Zovlet is a personal records service for assets, liabilities, documents, cash flow, goals, planning notes, and sharing you choose to enable. For this policy, Zovlet is the controller of personal information we process to operate your account.

Contact for privacy requests: [email protected]. By creating an account or continuing to use the Service, you acknowledge this policy and our Terms & Conditions.

2. Information we collect

• Account identity. Name, email address, and profile photo reference provided when you register or sign in, including through Google Sign-In if you choose that method. We may also read the locale associated with your Google account (for example en-IN) solely to suggest a country on first sign-in; you can change or clear that value in Profile.
• Authentication data. Session identifiers and tokens needed to keep you signed in and to protect the account. We do not receive your Google account password.
• Content you create. Records, documents, attachments, members, cash-flow entries, goals, planning details, amounts and the currency you assign to each item, and similar information you enter in the Service. Vault content is encrypted with a security key you control before it is stored for the Service. Changing your default currency preference does not rewrite amounts already saved on older items.
• Profile and preferences. Optional details you add, such as phone number, country, date of birth, gender, an emergency contact email, enabled currencies and default currency for new entries, notification choices, and a profile photo you upload.
• Security information. Device session labels, approximate sign-in context, audit events, and optional two-factor or biometric unlock settings. If you enable biometrics, the security key may be kept in your device’s secure store (Android Keystore or iOS Keychain).
• Device permissions you grant. Camera or photo library access to attach images, and location only when you send an emergency alert and choose to include position.
• Technical data. IP address, browser or app type, timestamps, and limited diagnostic logs used to operate, secure, and troubleshoot the Service.

We do not knowingly collect information from children, and we do not buy personal information from data brokers.

3. How we use information

• Create and maintain your account and authenticate you
• Provide, display, update, and delete the records and features you use
• Encrypt and decrypt vault content with the security key you control
• Send messages you request, such as invitations, reminders, and emergency alerts
• Share only the information you choose to share with people you invite
• Protect the Service against abuse, fraud, and unauthorized access
• Diagnose faults, keep the Service reliable, and meet legal obligations

We do not sell personal information. We do not use it for advertising, cross-context behavioral advertising, credit decisions, or to train generalized artificial-intelligence models.

4. Legal bases

Where the GDPR or a similar law applies, we rely on:

• Contract. Processing needed to provide the Service you requested.
• Legitimate interests. Securing accounts, preventing abuse, and keeping the Service reliable, balanced against your rights.
• Consent. Optional features such as precise location on an emergency alert, camera access, biometrics, and non-essential communications. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.
• Legal obligation. Retention or disclosure required by law.

5. Google user data — how we access, use, store, and share it

Zovlet uses Google Sign-In / OAuth 2.0 and the Google Drive API so you can sign in and keep an encrypted vault in your own Drive. This section is the authoritative disclosure of how we access, use, store, and share Google user data.

5.1 What we access

• Basic profile & email (profile, email / userinfo): your name, email address, and Google profile photo URL to create and display your Zovlet account. We do not receive your Google password.
• Google Drive app files only (https://www.googleapis.com/auth/drive.file): create, read, update, and delete files that Zovlet creates (or that you open with Zovlet)—encrypted vault CSVs, attachments, optional security-key backup, and related app files. We do not request or access your entire Drive.
• OAuth tokens (including refresh tokens for offline access) so sign-in and Drive sync keep working until you sign out or revoke access.

5.2 How we use it

We use Google user data only to provide and improve Zovlet’s core features: authentication, encrypting/decrypting and syncing your vault, sharing you initiate, transactional emails you request (invites, reminders, SOS), and security / troubleshooting. We do not sell Google user data; use it for advertising or targeted ads; provide it to data brokers; use it for credit or lending decisions; or use it to train generalized / non-personalized AI or ML models.

5.3 How we store it

• Encrypted vault content and attachments live in your Google Drive, under files Zovlet creates. Vault payloads are encrypted with a security key you control before write.
• Account identity, OAuth tokens, session metadata, and optional uploaded profile photos may be stored on our servers solely to operate the Service.
• If you enable biometric unlock on Android or iOS, a copy of your security key may be kept in your device’s secure store (Keystore / Keychain), gated by biometrics—not on Google’s servers as plaintext.

5.4 How we share it

We share Google-derived or vault-related data only when:

• You choose — member sharing, invitations, SOS / emergency alerts, or will contacts you configure.
• Google — as the authentication and Drive platform processing API requests you authorize.
• Service providers — hosting, database, and email processors that help run Zovlet under confidentiality obligations.
• Legal requirement — if required by law or to protect users or the Service.

5.5 Limited Use & revocation

Zovlet’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You may revoke Zovlet at any time in Google Account permissions. To delete account data we hold, email [email protected] from the address on the account.

6. Other sharing

Outside Google user data (covered above), we share personal information only in these cases:

• People you choose. Recipients of a share, invitation, or emergency alert receive only what you send them.
• Service providers. Hosting, database, and email providers process data only to operate the Service for us and under confidentiality obligations.
• Legal and safety. We may disclose information if required by law or legal process, or to protect users, the public, or the Service.
• Business transfer. If Zovlet is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction. We will notify you when required by law and, where required, ask for consent before a new use begins.

7. International transfers

We and our service providers may process information in countries other than your own. Where required, we use appropriate safeguards for those transfers, such as contractual clauses approved by the relevant authority. You may ask us for a summary of those safeguards.

8. Retention and deletion

• We keep account information and content while your account is active and for a limited time afterward where needed for security, dispute resolution, or legal duties, then delete or de-identify it.
• You can delete content in the app, remove a profile photo, turn off biometric unlock, and sign out of a device.
• To delete the personal information we hold about your account, email [email protected] from the email on the account. We aim to complete verified requests within 30 days, unless a longer period is required by law. We may retain a minimal record of the request itself.
• If you signed in with Google, you can also remove Zovlet from Google Account third-party access. That stops future sign-in through Google. It does not by itself delete information we already hold; use the email request above for that.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information; to restrict or object to certain processing; to withdraw consent; and to appeal a decision we make on a privacy request. California residents may also request that we disclose categories of personal information collected and whether we sell or share it for cross-context advertising. We do not sell or share personal information for that purpose, and we do not discriminate for exercising privacy rights.

Send requests to [email protected]. We may need to verify that the request comes from you. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local data-protection authority.

10. Security

We use reasonable administrative, technical, and organizational measures, including encryption in transit (HTTPS), access controls, encryption of vault content with your security key, optional two-factor authentication, and optional biometric unlock on supported devices. No method of transmission or storage is completely secure. You are responsible for keeping your sign-in method and security key confidential.

11. Cookies and local storage

We use strictly necessary cookies or similar local storage to keep you signed in, remember security settings for the session, and protect the Service. We do not use third-party advertising cookies. Your browser or device settings can block storage, but some features may then stop working.

12. Children

Zovlet is not directed to children under 16 (or under 13 where that is the applicable minimum, including under the U.S. Children’s Online Privacy Protection Act). We do not knowingly collect personal information from children. If you believe a child has provided information, contact us and we will delete it.

13. Automated decisions

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

14. Changes

We may update this policy when our practices change. We will post the new version on this page and change the “Last updated” date. If a change materially affects how we use personal information, we will provide additional notice where required by law, and obtain consent where required, before that new use begins.

15. Contact

Privacy questions, access requests, and deletion requests:
Email: [email protected]
Service: Zovlet (web, Android, iOS)
Website: https://zovlet.com
This policy: https://zovlet.com/privacy-policy
Terms: https://zovlet.com/terms