Privacy Policy

Zetrr (“we,” “us,” or “our”) operates the website zetrr.com and the Zetrr creator platform, together with our native applications for iOS, iPadOS, macOS, and Android (collectively, the “Platform”). We are committed to protecting your privacy and handling your personal data with care.

The Zetrr platform is modular. Our native apps currently provide the Zetrr Planner module (content planning, boards, scripts, tasks, notes, saved ideas, and team collaboration). Additional modules are available on the web at zetrr.com. This Privacy Policy applies to all of them.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, your rights regarding your data, and how to contact us. It applies to all users of the Platform, including visitors, free-tier users, and paid subscribers.

Our native apps deliver the Zetrr Planner module. This section summarizes exactly what the apps do with your data and mirrors the “App Privacy” / Data Safety disclosures shown on our App Store and Google Play listings.

What the apps collect, all linked to your account and used only to operate the app:

• Account email address — to sign you in and sync your planner across your devices.
• The planner content you create — to-dos, boards, cards, scripts, script versions, notes, saved ideas, tags, and chat messages you exchange with your team.
• Optional voice notes — recorded only when you choose to record one and attach it to a saved idea. The microphone is accessed only at that moment, and only if you grant permission.
• A device notification token — created only if you enable notifications, so we can deliver reminders and updates to your device.

What the apps do not do:

• No advertising and no advertising SDKs.
• No advertising identifier (such as Apple’s IDFA) and no cross-app or cross-website tracking.
• No third-party analytics SDKs are embedded in the apps.

Device permissions are optional and requested only at the point of use: Microphone (for voice notes) and Notifications (for reminders). You can use the core planner without granting either, and you can change these at any time in your device settings.

Account information you provide directly: name, email address, profile picture, and any other information you add to your account profile.

Content you create: planner content (to-dos, boards, cards, scripts, notes, saved ideas, tags, team chat), and — when you use other Zetrr modules on the web — form submissions, content pipeline data, invoices, automation rules, giveaway configurations, and any other content you generate using the Platform (“User Content”).

Usage and diagnostic data: on our website, we automatically collect limited technical data such as browser type, device information, pages visited, timestamps, referring URLs, and general geographic location inferred from IP address — collected in part through Google Analytics — to operate the site, improve it, and diagnose issues. To understand how the website and the signed-in dashboard are actually used — and to spot errors and points of friction — we also use heatmaps and session-replay analytics (Microsoft Clarity), which record on-page interactions such as clicks, scrolling, and mouse movement. This is used only to improve your experience; sensitive input is masked by default. As noted in Section 2, our native apps do not embed third-party analytics or tracking SDKs; any diagnostic information from the apps is limited to what is necessary to operate and secure the service.

Authentication & abuse-prevention data: when you sign in or sign up, we process your credentials securely and use a bot/abuse challenge (Cloudflare Turnstile) to protect accounts. This may involve your IP address and challenge token being processed by our security provider (see Section 5).

Payment data: if you subscribe to a paid plan on the web, our payment processor (Stripe) handles your payment information. We store only a transaction identifier and billing history on our systems — never your full credit or debit card number. Purchases made through an app store are handled by that store (see Section 5 and our Terms of Service).

Third-party connections: if you connect third-party accounts (e.g., Instagram via OAuth, Google) when using web modules, we may receive certain profile information from those services, subject to your privacy settings with those providers. In particular, when you use the Automation or Giveaways modules and connect your Instagram Business or Creator account through Meta’s official Instagram API, we access your Instagram profile, media, comments, and messages — and process limited information about the Instagram users who interact with you — as needed to run those features. See Section 14 for full details.

We use your data to:

• Provide, maintain, and improve the Platform and its features.
• Create and manage your account; authenticate you on each visit and keep your data in sync across your devices.
• Deliver reminders and notifications you have enabled.
• Process transactions and send related service communications (e.g., receipts, renewal reminders).
• Send you service-related notices (e.g., password resets, security alerts, policy changes).
• Respond to your support requests and provide customer service.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Analyze usage patterns (primarily on the website) to improve user experience and develop new features.
• Enforce our Terms of Service and other agreements.

We do not use your personal data for advertising, and we do not sell your personal data to third parties.

We do not sell your personal data. We share information only with the service providers (sub-processors) that help us operate the Platform, and only as needed to deliver the service. Each is contractually bound to protect your data and use it solely on our behalf:

• Supabase — our core infrastructure provider for database, authentication, file storage, and realtime sync. Your account and planner content are stored here.
• Cloudflare — security, content delivery, and bot/abuse protection, including the Turnstile challenge shown during sign-in and sign-up.
• Apple Push Notification service, Google Firebase Cloud Messaging, and web push services — used only to deliver the notifications you opt into.
• Stripe — payment processing for paid subscriptions purchased on the web.
• Vercel — hosting for the zetrr.com website.
• PostHog (self-hosted) — privacy-friendly product analytics for the website only; it is not embedded in our native apps.
• Microsoft Clarity — heatmaps and session replays that show us how visitors use the website (including the signed-in dashboard) so we can improve the experience and diagnose errors and usability issues. Used on the website only; it is not embedded in our native apps. Clarity masks sensitive input by default, and the data is processed by Microsoft under its Privacy Statement.
• Google Analytics (GA4) — measures website traffic and usage (such as pages viewed, sessions, approximate location, and device/browser type) so we can understand and improve the website and dashboard. Used on the website only; it is not embedded in our native apps. Provided by Google and subject to Google’s Privacy Policy.

We may also disclose information in these limited circumstances:

• Legal obligations: when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, safety, or the safety of others.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform before your data is transferred.
• With your consent: in any case not covered above, we will only share your data if you have given explicit permission.

On our website, we use cookies and similar technologies to operate the site. Our native apps do not use cookies for advertising or cross-app tracking. Website cookies include:

• Essential cookies: required for authentication, session management, and core website functionality. These cannot be disabled without making the site unusable.
• Analytics cookies: help us understand how visitors use the website so we can improve it. We use PostHog (self-hosted, privacy-friendly product analytics), Microsoft Clarity (heatmaps and session replays used to spot errors and usability problems), and Google Analytics (website traffic and usage measurement). These tools are used only to improve your experience — never to sell your data or advertise to you — and Clarity masks sensitive input by default.
• Optional functional cookies: remember your preferences (e.g., theme selection, language).

You can control or disable cookies through your browser settings. Disabling essential cookies will prevent you from using the website.

We retain your personal data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce agreements.

• Account data and planner content: retained until you delete your account (see Section 10). After deletion, limited records may be kept for up to 90 days for legal, tax, security, and fraud-prevention purposes, unless a longer period is required by law.
• Voice notes: stored as part of your account content and deleted when you delete the note or your account.
• Instagram giveaway data: entrant comments collected for a run are automatically deleted 7 days after the run. The winning username and winning comment are kept in your run history until you delete your Zetrr account.
• Usage logs: anonymized and aggregated where possible, retained for up to 12 months.
• Payment records: retained for a minimum of 7 years as required by financial regulations.

We implement industry-standard technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption in transit (TLS/HTTPS) for all data transmitted to and from the Platform.
• Encryption at rest for data stored in our databases.
• Row-level security so that you can only access your own data, enforced at the database layer.
• On-device secure storage of your session credentials (e.g., the iOS/macOS Keychain) so you stay signed in safely.
• Access controls: our team follows the principle of least privilege — only personnel who need access to your data to maintain the Platform have it.
• Regular security reviews and vulnerability scanning.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you suspect a security breach, contact us immediately at security@zetrr.com.

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Correction: request that we correct inaccurate or incomplete data.
• Erasure: request deletion of your personal data (the “right to be forgotten”).
• Restriction: request that we limit how we process your data in certain circumstances.
• Portability: request your data in a structured, commonly used, machine-readable format.
• Objection: object to our processing of your data for certain purposes.
• Withdraw consent: where our processing is based on your consent, withdraw that consent at any time.

To exercise any of these rights, contact us at privacy@zetrr.com. We will respond to all verified requests within 30 days.

You can delete your account and its associated data at any time, directly inside any Zetrr app or on the web — you do not need to contact us or wait for a manual process.

In the apps (iOS, iPadOS, macOS, Android):

• Open Settings.
• In the account section, tap “Delete account”.
• Confirm. Your account and associated planner content are permanently deleted.

On the web: go to Account Settings, choose “Delete account,” and confirm.

What happens when you delete your account:

• Deletion is permanent and cannot be undone.
• Your account and your planner content — to-dos, boards, cards, scripts, notes, saved ideas, tags, chat, and any voice notes — are removed from our active systems.
• We may retain limited records required for legal, tax, security, or fraud-prevention purposes for up to 90 days (or longer where required by law), after which they are deleted.
• Any subscription purchased through Apple or Google must be canceled through that store’s account settings; deleting your Zetrr account does not automatically cancel an app-store subscription.
• Content you previously shared publicly (e.g., via a share link) may remain accessible through cached copies or third-party archives outside our control.

The Platform is not directed to, and we do not knowingly collect personal data from, anyone under the age of 16 (or the applicable minimum age in your jurisdiction). If we learn that we have collected personal data from a child under the minimum age without parental or guardian consent, we will take steps to delete that data as quickly as possible.

If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at privacy@zetrr.com.

Zetrr is operated from the United States. If you are accessing the Platform from outside the United States, your data will be transferred to and processed in the United States, which may have different data protection laws than your country.

When we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on standard contractual clauses (SCCs) and other approved transfer mechanisms to ensure an adequate level of data protection.

The Platform may contain links to or integrations with third-party websites, services, or applications. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use, including the app store from which you obtained our app:

• Apple: apps obtained from the App Store are subject to Apple’s Privacy Policy and the App Store terms.
• Google: apps obtained from Google Play are subject to Google’s Privacy Policy and the Google Play terms.
• Stripe: payment data on the web is handled by Stripe under their Privacy Policy.
• Instagram / Meta (Automation & Giveaways, and social sign-in): when you connect Instagram or use Meta or Google sign-in, your data is also subject to Meta’s, Instagram’s, and Google’s policies (see Section 14).
• Microsoft: heatmaps and session-replay analytics on the website are provided by Microsoft Clarity and are subject to Microsoft’s Privacy Statement.
• Google Analytics: website traffic and usage analytics are provided by Google Analytics and are subject to Google’s Privacy Policy.

Two optional web modules — Zetrr Automation (comment and keyword auto-replies and direct messages) and Zetrr Giveaways (comment-based entry and winner selection) — connect to your Instagram Business or Creator account through Meta’s official Instagram API (“Instagram API with Instagram Login”). Zetrr is a verified Meta Tech Provider. These features are part of the zetrr.com website only; they are not part of our native Planner apps.

We access this data only after you explicitly connect your account and grant permission, only for the account you connect, and only to operate the features you turn on. The permissions we request are:

• Automation — instagram_business_basic (your Instagram profile and media, used to target which posts a rule applies to), instagram_business_manage_comments (read comments on your posts and post public or private replies), and instagram_business_manage_messages (send direct messages and private replies on your behalf).
• Giveaways — instagram_business_basic and instagram_business_manage_comments (read your profile and the comments on the post you choose, so we can list entrants and select winners).

Information about people who interact with you. To perform the actions you configure, these features necessarily process limited information about the Instagram users who comment on your posts or message your account. For Giveaways this is limited to the commenter’s username, the text of their comment, and the comment’s own Instagram ID — no profile pictures, follower counts, or other profile data. For Automation we additionally store the sender’s Instagram-scoped user ID, which Meta requires to address a reply. We use this information solely to carry out what you set up (for example, matching a keyword, sending the reply or direct message you configured, entering a commenter into your giveaway, or selecting a winner). We do not use it to build advertising profiles, and we do not sell it.

Storage & security. Your Instagram access tokens are encrypted at rest. We store only the interaction data needed to run the feature and show you results — such as your message history, matched comments, and giveaway entrant and winner lists.

Your controls & deletion. You can disconnect your Instagram account at any time from the module’s settings, which deletes the stored access token and immediately stops all further access. Giveaway entrant comments are deleted automatically 7 days after a run. To erase the remaining Instagram data we hold for you, delete your Zetrr account (see Section 10) — or email privacy@zetrr.com and we will delete it for you.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Post a prominent notice on the Platform for at least 30 days after the change.
• Send an email notification to the address associated with your account for significant changes.

Your continued use of the Platform after any changes constitutes acceptance of the revised Privacy Policy. If you do not agree with the changes, you must stop using the Platform and delete your account.

If you have any questions about this Privacy Policy or our data practices, please contact: