Privacy Policy — Zeif
Last updated: October 19, 2026
The essentials, in three sentences.
Zeif works with an account and a subscription: we keep your email, the name you show to your household and which household you belong to.
Your documents are encrypted on your phone before they leave it, so we store them without being able to open them.
There are no ads, no analytics and no trackers, and we don't sell data to anyone.
1. Who is responsible
Data controller: Christian Suarez, a private individual. Country of establishment: Colombia. Contact: info@zeifapp.com, which is the channel for any question about this policy or about your data.
2. What we keep on our server
| Data | Why |
|---|---|
| Verified email address | To identify your account, verify it and reset your password |
| Display name | So the other members of your household know who you are |
| Password hash | To check your password without knowing it. Stored with scrypt, never in plain text |
| Your account's public key and open sessions | To authenticate your requests and be able to sign them out |
| Which household you belong to and who else is in it | To share the household key among its members |
| Encrypted copies of your documents, with their size and version | So you can restore them on another phone and share them with your household |
| Your subscription status | To know whether your plan is active |
| If you join the waitlist on zeifapp.com: your email, when you confirmed it and which link brought you (for example, “whatsapp”) | To let you know when there is a spot in the beta. It is not used for anything else |
| Technical connection logs (IP, date, path) | Diagnostics and abuse limits. Kept for 30 days at most |
3. What we cannot see
The content of your documents. Attachments and backups are encrypted on your phone with AES-256-GCM before they are uploaded, and the key is derived from a recovery code that is generated on your device and never reaches us. What we receive are bytes we cannot open.
We don't see your password either: the server keeps a scrypt hash, which can check it but not reveal it.
This has a consequence worth understanding.
If you lose both your recovery code and your phone, nobody can give your documents back to you. Not even us, however much we wanted to: we have nothing to decrypt them with. That is the price of nobody else being able to open them.
4. What stays on your phone
Your documents and records also live in the app's private database: expiry dates and attachments, vehicles, pets and their vaccination history, subscriptions, cards, reminders, notes and your preferences.
For cards we keep the bank, the last four digits and the statement and payment days. Never the full number, the expiry date or the CVV, because Zeif doesn't charge anything: it only reminds you when you are charged.
5. What you share with your household
If you mark a record as shared with the household, it is encrypted with the household key and the other members can open it. Whatever you don't mark stays encrypted with a key they don't have.
Anyone who leaves or is removed from a household can no longer open what is uploaded afterwards, because the key is rotated. But whatever they had already downloaded stays on their phone: we have no way to delete it, just as we couldn't take back a paper you already handed over.
6. Who we work with
| Service | What it receives | Why |
|---|---|---|
| Google Play | The purchase and its status | To charge the subscription |
| RevenueCat | A random identifier for your account and the purchase status. Not your email | To check whether your plan is active |
| Resend | Your email address and the text of the message | To send verification, password reset and waitlist confirmation emails |
| Hosting provider | Technical connection data | To serve the API |
All of them process data on our behalf and following our instructions. None of them uses it for their own purposes, and we don't sell or hand over data to third parties for advertising or any other purpose.
None of them receives the content of your documents.
7. No ads, no analytics, no AI
The app includes no advertising, no trackers, no usage measurement tools and no advertising identifiers. Earlier versions included an assistant based on artificial intelligence to which queries were sent; that feature was removed and nothing of it remains.
8. How long we keep each thing
- Account data and encrypted backups: as long as you have the account. They are deleted when you delete it.
- Waitlist: until we invite you to the beta or you ask to be removed by writing to info@zeifapp.com. An email that is never confirmed is not used.
- Technical connection logs: 30 days at most.
- Purchase history: kept by Google Play and RevenueCat for tax and warranty obligations, even after you delete your account.
9. Your rights
You can access your data, correct it, delete it, object to its processing and request a portable copy. In practice:
- Delete your account and everything we have: Settings → Zeif account → Delete account.
- Delete only part of it: delete that specific record in the app; it disappears from your phone and from the server copy.
- Leave a household: from the family screen, without deleting your account.
- Take your data with you: export an encrypted copy with a password you choose.
- Correct your email or your name: from Settings → Zeif account.
For anything else, write to info@zeifapp.com from your account's address. More detail in data deletion.
10. Children
Zeif is not directed at children under 13 and we do not knowingly collect data from people of that age.
11. Changes to this policy
If what we do with your data changes, this page and its update date change. Important changes are also announced inside the app.
12. Contact
This is a translation. If it differs from the Spanish version, the Spanish version prevails.