zoë privacy policy
zoë is an address book of places worth knowing, shared between friends. It is run by Lunita Equity AB (org. nr 559576-0793, Sweden), which is responsible for your data. This page explains what we store, why, and what you can do about it — in plain language.
What we collect
- Account — your email address (you log in with a one-time code we email you), username, display name, bio and profile photo. Older accounts may also have a password, stored hashed and never readable by us.
- Content you create — posts, photos and videos you upload, captions, comments, likes, the places you put in lists, the places you mark as been or want 2 go, the opinions you give places (like “10/10” or “hidden gem”), and direct and group messages.
- Social graph — who you follow, who follows you, and who you block.
- How you use zoë — which places you open, what you save, search for and post, which posts you see and for how long, and how long you watch videos. We use this to make zoë work better for you and to improve recommendations. It is linked to your account and never sold.
- Technical basics — standard server logs (like IP address and device type) kept for security and troubleshooting.
Your location
If you allow it, the map shows where you are. Your location is used on your phone and is never stored on our servers. The one time it leaves your phone is when you ask for directions: your position and the place are then sent to the routing service below to draw the route, and nothing else about you goes with them.
What we don't do
- We don't sell your data, ever.
- We don't show ads or share your data with advertisers.
- We don't read your messages; they're stored to deliver them, visible only to the people in the conversation.
Who can see what
Your profile, posts, lists and the places you mark as been are visible to other zoë users (or only to your followers if your profile is private). Your want 2 go places are private — only you see them; when someone saves a place from your post, you see a count, never who. Messages are visible only to the people in the conversation. These rules are enforced in the database itself (row-level security), not just in the app.
Who helps us run zoë
These services handle data for us. Like any website, each one sees your device's IP address when your phone talks to it. zoë's typeface and code are served from our own site, not from third-party font or code services.
- Supabase — database, login and file storage, hosted in the EU (Ireland).
- Vercel — serves the app and its web pages.
- Resend — sends the login code and invitation emails.
- Apple — delivers push notifications, if you turn them on.
- OpenFreeMap — draws the map. Your phone loads map tiles from their servers; nothing about your account is sent.
- Photon (by Komoot) — suggests places and cities as you type in search. What you type is sent to find matches.
- OpenStreetMap routing (run by FOSSGIS) — draws directions, only when you ask for them (see Your location).
- OpenStreetMap and Google Places — when you add a place, our server looks up its name (and the city) to find its address and position. Nothing about you is sent.
Why we may use it (GDPR)
We process your data to provide the service you signed up for (contract), and to keep zoë safe and improve it (legitimate interest). You can object to the latter at any time by contacting us.
How long we keep it
As long as you have an account. When you delete a post, its photos and videos are deleted with it. When you delete your account, everything is deleted (see below). Server logs are kept for a short period.
Your rights
You can see and edit most of your data in the app, and ask us for a copy of everything we hold about you, to correct it, or to delete it. You can also complain to the Swedish Authority for Privacy Protection (IMY).
Deleting your account
Delete your account any time in the app: Profile → Settings → Delete account. This permanently removes your account, profile, posts, photos, videos, comments, likes, lists, saves, messages, follows and usage history from our servers. Places you added stay on the map for everyone else, without your name. It cannot be undone.
Children
zoë is not directed at children under 13, and we don't knowingly collect their data.
Changes
If this policy changes materially, we'll note it here with a new date.
Contact
Questions or requests about your data: arthur@lunitaequity.com