Privacy Policy

1. Who we are

ZYLO is a social messaging service operated by LoopViewMedia. This policy applies to zylochat.app, chat.zylochat.app, and the related ZYLO app experience. For privacy questions, account requests or support, contact support@zylochat.app.

2. Information we handle

• Google sign-in information: when you sign in, Google and our authentication provider, Supabase, supply and process information such as your Google account identifier, name, email address, profile information and authentication tokens. ZYLO uses this to identify your account and keep you signed in. ZYLO does not receive your Google password.
• Your profile: your chosen display name, unique username and any profile photo you upload.
• Your activity and content: friend requests, accepted friendships, text messages, private Quick Bursts, public Burst posts and their titles/descriptions, attached photos/videos, captions, likes, comments, invitation links, send/open times, temporary typing status and daily Burst activity used to calculate streaks. Typing signals do not include the text you are composing.
• Device storage: sign-in sessions, appearance choices and any local preview data are stored in your browser. The preview is separate from signed-in account data and is shared by people using that browser.
• Technical information: our service providers may process IP addresses, browser/device details, request times and error logs to deliver, secure and troubleshoot the service.
• Support correspondence: information you choose to send when contacting us.

3. How we use information

We use information to authenticate you, provide profiles and friendships, deliver messages and shared media, track Burst opening and streaks, remember preferences, handle support/deletion requests and protect the service from abuse.

Google user information is used for sign-in, account identification and related profile functionality. We do not sell Google user information, use it for advertising or use it to train general-purpose AI models. ZYLO does not request access to your Gmail messages, Google Drive files or Google contacts for its current sign-in flow.

4. Who can see information

Your display name, username and profile photo may be visible to other signed-in users through social features. Your email address is not listed in ZYLO’s friend directory. Text messages and Quick Bursts are available to the participants. Public Burst posts, their attached media, the author’s name/username/profile photo, like counts and comments can be viewed and shared by anyone, including people without accounts. Public posts remain visible until deleted. Private 24-hour stories from earlier app versions remain friends-only until they expire; they are not automatically published as posts. Invitation links disclose the inviter’s name and username to anyone with the link and allow a signed-in recipient to accept a friendship until the inviter resets the link. Resetting a link does not remove friendships already accepted.

Service providers: Supabase processes authentication information. Cloudflare hosts ZYLO and stores account profiles, friendships, messages, media and streak activity in D1. Google processes sign-in according to its own policies. Google Fonts and jsDelivr deliver fonts and software files used by the app and may receive network metadata when your browser requests them. Support email is handled by the email service used for our support address.

Data may be processed in countries other than where you live. We may disclose information when required by applicable law or when reasonably necessary to address fraud, abuse or threats to people or the service. Messages and media are not end-to-end encrypted; authorized service administration and infrastructure can access stored content.

See the providers’ policies: Supabase, Cloudflare, Google, and jsDelivr.

5. Retention and disappearing media

• Quick Bursts: an unopened Quick Burst expires after 24 hours. On opening, the server records it as opened, removes its stored image after delivery and lets the recipient view it for up to 10 seconds. Send/open metadata and daily streak records can remain after image removal.
• Stories: access expires after 24 hours, or you can delete your own story earlier. An hourly cleanup removes expired story records and expired media.
• Typing status: an active signal expires after 8 seconds without renewal and is normally cleared when you stop composing or leave a chat. Expired signals are removed by the hourly cleanup.
• Public posts: public Bursts and their media remain until the author deletes them or an account/data request is processed. Deleting a post also removes its associated likes and comments from the live database. Users can delete their own comments; a post author can remove comments on their post.
• Invitations: invitation links remain valid until reset by their owner or removed through an account/data request.
• Other account data: profiles, friendships, text messages and activity records remain available to operate your account until removed through an account/data request or another applicable retention process.
• Local data: preview content and settings remain in your browser until you clear site data. Clearing browser storage does not delete server-side account data.

Disappearing from ZYLO does not remove screenshots, recordings or copies saved by someone else. Technical logs and provider backups may follow different retention schedules, and information may need to be retained to meet legal obligations or resolve abuse reports. Avoid sharing content you cannot risk another person retaining.

6. Your controls and requests

You can change your profile and username in Settings, remove your profile photo, delete your public posts and comments, reset invitation links, delete your own active legacy stories, unfriend other users, sign out and clear local browser data. Camera access is requested only when you enable the camera, and you can revoke permission through your browser or device settings.

To request access, correction, export or deletion of your account or personal data, email support@zylochat.app from the email associated with your account and describe your request. We may verify account ownership before acting. Depending on your location, applicable law may provide additional rights. Unfriending, signing out, revoking Google access or clearing browser storage does not by itself delete all stored account data.

You can review or revoke ZYLO’s Google connection in your Google account connections. Revoking that connection may affect your ability to sign in.

7. Children and safety

Use of ZYLO must meet the age and consent requirements that apply to you and to the Google account used to sign in. If you believe a child’s information was provided contrary to applicable requirements, or you need to report harassment or unlawful content, contact support@zylochat.app. Include enough information to identify the account or content without sending unnecessary sensitive information.

8. Changes and contact

We may update this policy as ZYLO changes. The effective date appears at the top of this page. If we introduce a materially different use of personal information, we will provide an appropriate notice and seek consent where required before that new use.