# Privacy Policy

**Last Updated: December 11, 2025**

## Introduction

Welcome to ZeroBooks ("we," "our," or "us"). We are committed to protecting your
privacy and ensuring the security of your personal information. This Privacy
Policy explains how we collect, use, disclose, and safeguard your information
when you use our mobile application ("App").

Please read this Privacy Policy carefully. By using the App, you agree to the
collection and use of information in accordance with this policy. If you do not
agree with our policies and practices, please do not use the App.

## 1. Information We Collect

### 1.1 Personal Information You Provide

We collect information that you voluntarily provide to us when you:

- **Create an account:** Name, email address, profile picture
- **Complete onboarding:** Learning motivation, category interests, experience
  level, daily learning time commitment, notification preferences, referral code
  (if used)
- **Use the App:** Course selections, lesson completions, quiz responses
- **Contact us:** Messages, feedback, support requests

### 1.2 Automatically Collected Information

When you use the App, we automatically collect:

**Session Information:**

- IP address (for security and fraud prevention)
- Browser/device user agent string
- Session tokens and authentication status

**Learning Activity Data:**

- Courses, lessons, and sections you access
- Completion status and progress percentages
- Quiz scores and attempts
- Time spent on lessons (start and completion timestamps)
- XP (experience points) earned
- Learning streaks and achievements

**Usage Information:**

- AI feature usage (chat, image generation, course generation, video generation)
- AI credit transactions and balances
- Timezone and language preferences
- Notification settings

### 1.3 Information from Third-Party Sources

We may receive information about you from:

- **Payment processors:** RevenueCat, Apple App Store, Google Play Store
  (subscription status and purchase history)
- **Authentication providers:** Google OAuth (if you sign in with Google)
- **RevenueCat:** App version, platform (iOS/Android), country (derived from
  IP), last seen timestamp

### 1.4 AI-Generated Content Data

When you use AI-powered features:

- Your prompts and queries sent to AI services
- Generated content and responses
- Type of AI feature used (chat, image, course, video generation)

## 2. How We Use Your Information

### 2.1 Service Provision

- Create and manage your account
- Provide personalized educational content
- Generate AI-powered courses, lessons, images, and videos
- Process subscriptions and manage AI credits
- Track your learning progress, streaks, and XP
- Synchronize data across your devices
- Send push notifications about your learning reminders and achievements
- Deliver transactional emails (verification codes, password resets)

### 2.2 Service Improvement

- Monitor API performance and troubleshoot technical issues
- Analyze learning patterns to improve content recommendations
- Develop new features and functionality
- Optimize AI content generation quality

### 2.3 Communication

- Send you course and lesson recommendations
- Respond to your inquiries and support requests
- Administer referral programs and credit rewards
- Notify you of important app updates or changes

### 2.4 Security and Compliance

- Detect and prevent fraudulent activity and abuse
- Protect against unauthorized access using IP and session monitoring
- Comply with legal obligations
- Enforce our Terms and Conditions

## 3. How We Share Your Information

We do not sell your personal information. We may share your information with:

### 3.1 Service Providers

We work with third-party companies that provide services on our behalf:

- **Cloud storage:** Cloudflare R2 (for profile pictures, generated images and
  videos)
- **Database services:** PostgreSQL hosting providers
- **Payment processors:** RevenueCat, Apple App Store, Google Play Store
- **AI services:** OpenAI (for AI-powered content generation)
- **Monitoring:** Langfuse (for API performance monitoring and tracing)
- **Email services:** Mailgun (for transactional emails like verification codes)
- **Push notifications:** Expo push notification service
- **App updates:** Expo over-the-air (OTA) update service

### 3.2 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information
may be transferred as part of that transaction.

### 3.3 Legal Requirements

We may disclose your information if required to:

- Comply with legal obligations, court orders, or government requests
- Enforce our Terms and Conditions
- Protect our rights, property, or safety
- Investigate fraud or security issues

### 3.4 With Your Consent

We may share your information for other purposes with your explicit consent.

### 3.5 Aggregated and De-identified Data

We may share anonymized, aggregated data that cannot identify you personally for
research, analytics, or marketing purposes.

## 4. Data Storage and Security

### 4.1 Data Storage

- Your data is stored on secure PostgreSQL database servers
- User-generated content (profile pictures, AI-generated images and videos) is
  stored on Cloudflare R2
- Data is synchronized across your devices using PowerSync technology
- Local data is stored on your device using SQLite for offline access

### 4.2 Security Measures

We implement industry-standard security measures including:

- Encryption in transit (TLS/SSL) for all data transmission
- Secure password hashing using Better Auth
- OAuth 2.0 for Google sign-in
- Session token management and validation
- IP address logging for security monitoring
- Secure API communications
- Access controls on sensitive data (subscriptions, credits are read-only on
  client)

### 4.3 Data Retention

- We retain your personal information for as long as your account is active
- We may retain certain information after account deletion for legal or
  operational purposes
- You can request data deletion at any time (subject to legal requirements)

### 4.4 No Absolute Security

While we strive to protect your information, no method of transmission or
storage is 100% secure. We cannot guarantee absolute security.

## 5. Your Privacy Rights

Depending on your location, you may have the following rights:

### 5.1 Access and Portability

- Request access to your personal information
- Receive a copy of your data in a portable format

### 5.2 Correction and Update

- Update or correct inaccurate information
- Modify your profile and preferences

### 5.3 Deletion

- Request deletion of your account and personal data
- Some information may be retained for legal or operational reasons

### 5.4 Opt-Out

- Unsubscribe from promotional emails
- Disable push notifications in your device settings
- Opt out of certain data collection (may limit App functionality)

### 5.5 Data Processing Restrictions

- Object to certain data processing activities
- Restrict how we use your information

### 5.6 Automated Decision-Making

- Opt out of automated decision-making and AI-based recommendations
- Request human review of automated decisions

### 5.7 Withdraw Consent

- Withdraw consent for data processing where applicable
- Does not affect the lawfulness of processing before withdrawal

## 6. Children's Privacy

The App is not intended for children under the age of 13 (or the applicable age
of consent in your jurisdiction). We do not knowingly collect personal
information from children under 13.

If you are a parent or guardian and believe your child has provided us with
personal information, please contact us immediately. We will take steps to
delete such information from our systems.

## 7. International Data Transfers

Your information may be transferred to and processed in countries other than
your country of residence. These countries may have different data protection
laws.

We ensure appropriate safeguards are in place to protect your information when
it is transferred internationally, including:

- Standard contractual clauses
- Adequacy decisions
- Your consent where required

## 8. Third-Party Services

### 8.1 Third-Party Links

The App may contain links to third-party websites or services. We are not
responsible for their privacy practices. We encourage you to review their
privacy policies.

### 8.2 AI Service Providers

We use OpenAI to power AI-generated content features. Your prompts and
interactions are processed by OpenAI subject to their privacy policy and terms
of service. We recommend reviewing OpenAI's privacy policy to understand how they
handle data.

### 8.3 OAuth Authentication

If you sign in with Google, we receive basic profile information (name, email,
profile picture) according to the permissions you grant. Your use of Google
sign-in is subject to Google's privacy policy.

## 9. Data Storage and Synchronization

### 9.1 Local Storage

The App uses local storage on your device to:

- Cache content for offline access (courses, lessons, videos)
- Store user preferences and settings
- Maintain session information
- Enable offline functionality through PowerSync technology

### 9.2 Data Synchronization

Your data is synchronized between your devices and our servers using PowerSync:

- Most data can be accessed and modified offline
- Changes sync automatically when you're online
- Some sensitive data (like subscription status and credits) is read-only on
  your device for security

### 9.3 Performance Monitoring

We use Langfuse to monitor API performance and troubleshoot issues:

- API request traces and response times
- Error tracking and debugging information
- This helps us improve app performance and reliability

## 10. Advertising and Tracking

We do not display third-party advertisements or use advertising tracking
technologies (such as IDFA or Android Advertising ID) in the App. We do not
participate in cross-site or cross-app tracking for advertising purposes.

## 11. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the
California Consumer Privacy Act (CCPA):

- **Right to Know:** Request disclosure of personal information collected
- **Right to Delete:** Request deletion of personal information
- **Right to Opt-Out:** Opt out of sale of personal information (we do not sell
  personal information)
- **Right to Non-Discrimination:** Not receive discriminatory treatment for
  exercising your rights

To exercise these rights, contact us at
[hello@zerobooks.app](mailto:hello@zerobooks.app).

## 12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the
General Data Protection Regulation (GDPR):

### 12.1 Legal Basis for Processing

We process your information based on:

- **Consent:** For marketing communications and optional features
- **Contract:** To provide services you requested
- **Legitimate Interests:** To improve our services and prevent fraud
- **Legal Obligation:** To comply with legal requirements

### 12.2 Your GDPR Rights

- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to restrict processing
- Right to data portability
- Right to object
- Rights related to automated decision-making

To exercise your rights, contact us at
[hello@zerobooks.app](mailto:hello@zerobooks.app).

## 13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of
material changes through:

- In-app notifications
- Email notifications
- Updating the "Last Updated" date at the top of this policy

Your continued use of the App after changes constitutes acceptance of the
updated Privacy Policy.

## 14. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

- Notify affected users without undue delay
- Report the breach to relevant authorities where required
- Take immediate action to mitigate harm

## 15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or
our data practices, please contact us:

**Email:** [hello@zerobooks.app](mailto:hello@zerobooks.app)

**Address:** Kapybara - 552, Sector 3, HSR, Bengaluru, KA, India

For GDPR-related inquiries, you may also contact the supervisory authority in
your jurisdiction.

## 16. Your Consent

By using ZeroBooks, you consent to our Privacy Policy and agree to its terms.

---

**ZeroBooks**
*Protecting Your Privacy While Empowering Your Learning*