Privacy Policy
This policy covers the Zero-Trust apps (Zero-Trust Notes, Tasks, Fitness, Contacts, Calendar, Browser, Phone and Time), your Zero-Trust account, and this website.
The short version
- Your notes, tasks, contacts, events, workouts, bookmarks, time entries and files are encrypted on your phone before they are uploaded. We store them, but we can't read them.
- We only see what we need to run your account: your email address and technical details such as when your data last changed and how much space it uses.
- No ads, no analytics, no tracking, and we never sell or share your data.
- You can export everything or delete your account from the app at any time.
Who we are
The apps and this website are run by [Publisher name], [country] ("we"). We are the controller of the personal data described here. Contact us at [contact email].
What we can read
- Account: your email address, an account id, and when the account was created and last signed in. One account works in every Zero-Trust app.
- Sign-in data: your password is not stored on our servers. The app turns it into a sign-in code and an encryption key on your phone; we keep only a check value for the sign-in code and a random salt.
- Technical details of your data: for each item, a random id, which app it belongs to, when it last changed, whether it was deleted, and its size. For attached files, their size.
- Server logs: our hosting provider records requests (such as IP address, time and the type of device software) for security and troubleshooting, and deletes them after a short time.
- Support emails: if you write to us, we keep the conversation to answer you.
What we cannot read
Everything you put in the apps: note and task text, contact details and photos, fitness and health data, calendar events, bookmarks, browsing history and open tabs, time entries and projects, attached files and their names. These are encrypted on your phone with AES-256-GCM under a key that only your password or your recovery key can unlock. We store an encrypted copy of that key so you can sign in on a new phone, but we cannot open it. See How it works for the details.
Because we can't read your data, we can't recover it if you forget both your password and your recovery key.
Data that stays on your phone
- Each app keeps an encrypted local database so it works offline. If you turn on fingerprint or face unlock, a key is kept in your phone's secure hardware.
- Contacts: if you choose to import from your phone or a Google account, the app reads your phone's contacts to make the import. If you turn on caller ID, the app shows names for incoming calls; call information is not uploaded.
- Phone: if you make it your default phone app, it handles your calls and reads your phone's call log and blocked numbers. Call history stays on your phone and is never uploaded. Names come from your encrypted Zero-Trust contacts.
- Browser: the pages you visit are loaded directly from those websites, which see your IP address as with any browser. Tracker and ad blocking happens on your phone from a built-in list. Private tabs are not saved or synced.
- Calendar: reminders are scheduled on your phone. If you import a calendar file, it is read on your phone.
- Fitness: if you allow it, the app reads steps and activity from your phone's sensors or Health Connect. It is encrypted before upload like everything else.
Why we use it (legal basis)
- To provide your account, sync and backup: performance of our contract with you.
- To keep the service secure and prevent abuse (server logs): our legitimate interests.
- To answer support requests and send account emails such as password resets: performance of contract.
We do not use your data for advertising, profiling or training AI models.
Who processes it for us
- Supabase hosts our database, sign-in, file storage and account emails, in the European Union (Frankfurt, Germany).
- Google Play and GitHub distribute the apps. They handle your download under their own privacy policies.
We have no other processors. We don't sell, rent or share your data, and we disclose it only if the law requires us to; even then, your content stays encrypted.
How long we keep it
- Your account and data: until you delete them. Items you delete are removed from the app straight away; a small marker without content is kept so your other devices learn about the deletion.
- When you delete your account, your account, keys, items and files are erased right away. Copies in our hosting provider's backups are overwritten within [backup retention, e.g. 7 days].
- Server logs: up to [log retention, e.g. 7 days].
Your rights
Depending on where you live (for example under the GDPR), you can ask to access, correct, export or delete your data, restrict or object to its use, and complain to a data protection authority. Most of this you can do yourself in the app:
- Export: Settings › Export my data gives you a ZIP of everything in that app.
- Delete: Settings › Delete account. See Delete your account.
For anything else, write to [contact email]. We answer within 30 days.
Children
The apps are not meant for children under [13 / 16], and we don't knowingly collect their data.
This website
zerotrust.bz is hosted on GitHub Pages. It has no cookies, analytics, ads or third-party fonts. GitHub may log your IP address for security; see GitHub's privacy statement.
Changes
If we change this policy, we'll update the date below, and tell you in the apps before a significant change takes effect.
Draft · Last updated 10 November 2026