Privacy Policy

Version 1.0 · Effective September 8, 2026 · Last updated September 8, 2026 · Zinnia Development LLC

1. Who we are and what this covers
2. Information we collect
3. Device permissions our apps ask for
4. How we use information
5. AI features and your data
6. How information is shared
7. Cookies, analytics, and tracking
8. How long we keep information
9. Your rights and choices
10. Notice for California residents
11. Notice for residents of other US states
12. Notice for the EEA, UK, and Switzerland
13. Deleting your account and exporting your data
14. Security
15. International transfers
16. Children
17. Third-party links and services
18. Changes to this policy
19. Version history
20. Contact us

1. Who we are and what this covers

Zinnia Development LLC ("Zinnia", "we", "us", "our") is a limited liability company registered in the State of New Jersey, United States. We publish software applications for iOS, Android, and the web, and we operate the website at zinnia.dev. Contact details are in section 20.

This policy applies to:

• This website (zinnia.dev) and any message you send us by email or through the contact form.
• Every app we publish, including Wheredai, together with each app's privacy supplement. A supplement is published in the app, on the app's own website, and is linked from its App Store and Google Play listings. It names the app, lists which categories below the app actually collects, which device permissions it uses, its current service providers, and any retention period that differs from this policy. If a supplement and this policy conflict, the supplement controls for that app.

We are the "controller" (or "business") responsible for the personal information described here. We are not a data broker, and we do not act as a processor on behalf of other companies.

2. Information we collect

2.1 Information you give us

• Account information. When you create an account in one of our apps: your email address, a display name, and a one-time sign-in code, or the name and email that Apple or Google share with us if you sign in with Apple or Google. We do not store passwords because our apps do not use them.
• Content you create in an app. The places, spaces, items, notes, labels, and other records you add; the names and email addresses of people you invite; and the settings you choose. Depending on the app, this can include the address of a home, vehicle, or rental you add, which stays private to the people you share that space with.
• Voice, photos, and video. If you use a capture feature, the audio you record, the photos you take or upload, and the video frames you capture. Section 5 explains how these are processed and how long they exist.
• Messages to us. Your name, email address, the topic you choose, and what you write when you use the contact form, email us, request support, report a security issue, or exercise a privacy right.
• Purchase information. When you buy a subscription, Apple, Google, or Stripe processes the payment and tells us the product, price, currency, date, status, and a transaction identifier. We never receive your full card number.

2.2 Information collected automatically

• Device and technical data. Device model, operating system and version, app version, language, time zone, screen size, a random installation identifier we generate, and the IP address your device connects from. IP addresses are used for security and to infer an approximate region, then truncated or discarded.
• Usage data. Which features you use and when, performance timings, and whether an action succeeded, collected without cookies and without third-party advertising identifiers.
• Diagnostics. Crash reports and error logs, which can include the state of the app at the time of the error. We redact account content from these where technically possible.
• Website server logs. The IP address, browser type, requested page, referring page, and timestamp of each request to zinnia.dev.

2.3 Information from other sources

• Sign-in providers (Apple, Google): your name and email address, or a private relay address if you choose to hide your email.
• App stores and payment processors (Apple, Google, Stripe, and our subscription-management provider): purchase and subscription status.
• Other users. If someone invites you to a space or mentions you in content, we receive the email address or name they entered.

We do not collect precise GPS location in the background, biometric identifiers, health data, government identification numbers, or financial account numbers. We do not buy data about you from data brokers.

3. Device permissions our apps ask for

Our apps request the following permissions only when you use a feature that needs them. Each permission is optional; you can decline it or turn it off later in your device settings, and the rest of the app keeps working.

4. How we use information

We use personal information for the following purposes, and no others:

We do not use personal information for targeted advertising, we do not build marketing profiles, and we do not make decisions about you by automated means that have legal or similarly significant effects.

5. AI features and your data

Some of our apps use machine learning and large language models to transcribe speech, recognize what is in a photo, understand a question, or suggest where something probably is. Here is exactly what that means for your data:

• Your content is never used to train models. Not by us, and not by the AI providers we use. Every AI provider is bound by contract terms that prohibit training on customer data and require zero or minimal retention.
• Audio is ephemeral. Voice recordings are streamed for transcription and discarded from our servers once the transcript is produced. If you record while offline, the audio is encrypted on your device and deleted after it is uploaded and transcribed.
• Images are minimized. Location and camera metadata is stripped before a photo is stored or analyzed. Only the image content needed for the feature is sent to a recognition provider.
• Sensitive facts stay out of models. Where an app lets you mark something as secret (a lock code, a Wi-Fi password), that value is encrypted so that it is never sent to a model or included in search indexes.
• Answers can be wrong. AI features infer; they do not know. Apps show a confidence level where they can. Verify anything that matters.
• You can opt out by not using voice, photo, or question features. Manual entry, browsing, and search work without them.

6. How information is shared

We share personal information only in these situations:

• With people you share with. When you invite someone to a space in an app, or a space owner invites you, the members of that space can see the content it contains, according to the visibility settings the app provides. Content you mark as private to yourself is not visible to other members, including the space owner. Guest links you create show the guest exactly what you chose to share.
• With service providers (processors). Companies that host, store, transmit, or process data for us, under written contracts that limit them to our instructions and require security and confidentiality at least as protective as this policy. Categories, with the current providers for this website:
  • Cloud hosting, storage, and content delivery (Amazon Web Services for our apps; DigitalOcean for this website), United States.
  • Authentication and sign-in (Apple, Google).
  • Speech, vision, language, and search AI providers, under no-training and zero-retention terms (listed in each app's supplement).
  • Payments and subscription management (Apple App Store, Google Play, Stripe, and a subscription-management provider named in the app's supplement).
  • Transactional email delivery (Google Workspace for this website; the app's email provider is named in its supplement).
  • Error monitoring and cookieless product analytics (named in each app's supplement; Google Analytics for this website, only when enabled).
  • Web fonts (Google Fonts, for this website).
• With app stores. Apple and Google receive the information they need to distribute the app and process your purchase, under their own privacy policies.
• When required by law or to protect people. To comply with a subpoena, court order, or other lawful request; to enforce our terms; or to protect the rights, property, or safety of you, us, or others. We will tell you about a request for your data unless we are legally prevented from doing so.
• In a business transfer. If Zinnia is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. This policy will continue to apply, and we will notify you before your information becomes subject to a different privacy policy.
• With your consent, for any purpose we describe when we ask.

We do not sell personal information and have not done so in the past twelve months. We do not "share" personal information for cross-context behavioral advertising. We do not disclose it to data brokers.

7. Cookies, analytics, and tracking

On this website

zinnia.dev has no logged-in area and sets no cookies of its own. If Google Analytics 4 is enabled, it sets first-party cookies to distinguish returning visitors and sends page-view events to Google with IP anonymization turned on:

You can opt out with the Google Analytics opt-out add-on, by blocking cookies for this site, or with a browser that sends the Global Privacy Control signal, which we honor as an opt-out. Because we do not sell or share data, a Do Not Track signal changes nothing about how we treat you; we mention it because California law asks us to say how we respond to it.

In our apps

Our apps do not use advertising SDKs, advertising identifiers (IDFA / GAID), cross-app tracking, or third-party cookies. Usage analytics are collected without cookies and tied to a random installation identifier rather than to your identity where possible. Crash reporting sends diagnostic data when the app fails. You can turn usage analytics off in the app's settings; crash reporting can be disabled at the operating-system level.

8. How long we keep information

We keep personal information only as long as needed for the purposes above, then delete or anonymize it. Unless an app's supplement states a different period:

9. Your rights and choices

Wherever you live, you can:

• Access and export the personal information and content we hold about you, in a portable format, from inside the app or by asking us.
• Correct inaccurate information, in the app's settings or by asking us.
• Delete your account and data (section 13).
• Object to or restrict processing based on legitimate interests, and withdraw consent at any time for anything based on consent, without affecting what was done before.
• Opt out of product emails with the unsubscribe link in any message, and of usage analytics in the app's settings.
• Complain to us, and to your data protection authority or attorney general.

How to exercise these rights

Use the controls in the app, or email contact@zinnia.dev with the subject "Privacy request", or use the contact form and choose "Privacy or data request". Tell us which app and which right. We do not charge for requests unless they are manifestly unfounded or excessive.

Verification. To protect your data we verify requests, usually by sending a code to the email address on the account or asking you to make the request from inside a signed-in session. We will ask for additional information only if that is not enough to confirm it is you.

Authorized agents. You may use an agent. We will ask for the agent's written authorization signed by you and may still verify your identity directly with you.

Timing. We confirm receipt within 5 to 7 business days and respond within 30 days. If a request is complex we may take up to 45 additional days, and we will tell you why. We will not discriminate against you for exercising a right: no different prices, quality, or service.

Appeals. If we decline a request, we explain why and how to appeal. Send an appeal to the same address with the subject "Privacy appeal". We respond to appeals within 45 days. If we still decline, you may contact your state attorney general or data protection authority; we include contact details in our response.

10. Notice for California residents

This section is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA"). It describes the categories of personal information as the CCPA defines them.

Retention for each category is in section 8. We do not sell personal information, we do not share it for cross-context behavioral advertising, we have no actual knowledge that we collect personal information of consumers under 16, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. We offer no financial incentives in exchange for personal information.

California residents have the right to know, access, correct, delete, and port their personal information; the right to opt out of sale or sharing (not applicable, since we do none); the right to limit use of sensitive personal information (not applicable, since we use it only for permitted purposes); and the right not to be discriminated against for exercising these rights. Exercise them as described in section 9. We honor Global Privacy Control signals as a valid opt-out request. Under California's "Shine the Light" law (Civil Code §1798.83) you may ask whether we disclosed personal information to third parties for their direct marketing; the answer is that we do not.

11. Notice for residents of other US states

Residents of states with comprehensive privacy laws, including New Jersey, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, Iowa, Tennessee, Minnesota, Maryland, Kentucky, Indiana, and Rhode Island, have rights to confirm whether we process their personal data, to access, correct, delete, and obtain a portable copy of it, to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects, and to appeal a refusal. We do not engage in targeted advertising, sale, or such profiling. Exercise your rights and appeal as described in section 9. Where a state law requires consent before processing sensitive data, we obtain it in the app before the relevant feature is used.

12. Notice for the EEA, UK, and Switzerland

• Controller: Zinnia Development LLC, contact details in section 20. We have not appointed a representative in the EU or UK; you can contact us directly.
• Legal bases for each purpose are in the table in section 4. Where we rely on legitimate interests, we have balanced them against your rights; you can ask us for the assessment.
• Whether you must provide data: an email address is required to create an account; everything else is optional. Without the required data we cannot provide the account.
• Rights: access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, exercised as in section 9, free of charge, answered within one month (extendable by two months for complex requests, with notice).
• Automated decisions: we make none that produce legal or similarly significant effects.
• Transfers: see section 15.
• Complaints: you may lodge a complaint with the supervisory authority in the country where you live or work, or where the alleged infringement occurred. For the UK that is the Information Commissioner's Office; for Switzerland, the Federal Data Protection and Information Commissioner.

13. Deleting your account and exporting your data

Every app we publish lets you delete your account from inside the app (Settings, then Account, then Delete account) and export your data before you do. You can also email contact@zinnia.dev from the address on the account with the subject "Delete my account" and the app name. Step-by-step instructions are on our support page.

Deletion removes your account, profile, the content you own, device tokens, and analytics identifiers within 30 days, and from backups within 90 days. Content you added to a space owned by someone else remains available to that space's members unless you delete it before you leave; content you marked as private to yourself is purged after a 14-day export window. We retain only what section 8 says we must (purchase records, request correspondence) and anonymized aggregates that cannot identify you. Deleting the app from your device does not delete your account.

14. Security

We protect personal information with measures appropriate to its sensitivity: encryption in transit (TLS) and at rest; per-tenant data isolation enforced in the database; least-privilege access for staff, protected by multi-factor authentication; separate encryption for values you mark as secret; short-lived, signed links for shared and guest access; logging and alerting on unusual activity; encrypted, tested backups; and written data processing agreements with every provider. No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by the laws that apply to you, without undue delay. To report a vulnerability, see security reporting.

15. International transfers

We are based in the United States and our providers process data primarily in the United States. If you use our services from elsewhere, your personal information is transferred to and processed in the US, whose laws may differ from those of your country. For transfers from the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum or International Data Transfer Agreement) with our providers, on providers' certification under the EU-US Data Privacy Framework where available, and on supplementary measures such as encryption. You can request a copy of the relevant safeguards.

16. Children

Our website and apps are not directed to children under 13, and we do not knowingly collect personal information from them. In the European Economic Area and the United Kingdom the minimum age to create an account is 16. A parent or guardian may add a child's belongings to their own account; that information belongs to the parent's account and is governed by this policy. If you believe a child has given us personal information, contact us and we will delete it promptly.

17. Third-party links and services

Our website and apps link to and interoperate with services we do not control, including Apple, Google, Stripe, and AI assistants you may connect to an app through its connector. Their privacy policies govern their handling of your data. When you connect an assistant to an app, the assistant's provider receives the questions you ask and the answers the app returns; review that provider's policy before connecting.

18. Changes to this policy

We may update this policy as our products, providers, or the law change. We post the new version here with a new version number and effective date, and we summarize changes in the version history below. For material changes that reduce your rights or expand how we use data already collected, we will notify you by email or in the app at least 30 days before they take effect and, where the law requires, ask for your consent.

19. Version history

• Version 1.0, September 8, 2026. First published version, covering the website and all apps published by Zinnia Development LLC.

20. Contact us

Questions, requests, and complaints about this document go to:

• Zinnia Development LLC
• New Jersey, USA
• Email: contact@zinnia.dev
• Web: zinnia.dev/contact

We answer within 5 to 7 business days (Monday to Friday, 9:00 am to 6:00 pm Eastern Time).