Skip to document
Back to ZETIS
Legal

ZETIS Privacy Policy

How ZETIS handles account, journal, voice, AI, support, analytics, and purchase information.

Effective September 19, 2026

On this page
  1. 1. About this Policy
  2. 2. Information we process
  3. 3. Purposes and legal bases
  4. 4. Recipients
  5. 5. International transfers
  6. 6. Retention and deletion
  7. 7. Your choices and rights
  8. 8. Security
  9. 9. Changes

1. About this Policy

ZEBKA LTD is responsible for the personal information described in this Policy when you use the ZETIS websites, mobile application and related services (the "Service"). Our contact and registration details appear below. The Service is intended for people aged 18 or older.

2. Information we process

Accounts and website visits

Sign in with Apple provides an account identifier, authentication information and, if supplied by Apple, your name and email or Private Relay address. Website and network providers process connection information, such as IP addresses, request times and basic device information, to deliver and secure our services.

Alpha waitlist and email

If you join the private-alpha waitlist, we collect your email address and records needed to manage that choice: the signup source and language, the Privacy notice version, signup and confirmation times, and subscription or unsubscribe status. The form does not ask for your name, date of birth, Dream content, health information or free text. After you confirm your email, we use it only for private-alpha invitations, essential testing instructions and limited alpha-related follow-up. It is not consent to unrelated ongoing marketing.

Journal and cloud sync

The App processes Dream titles, text, transcripts, notes, dates, tags, favorites, recall and lucidity information, voice recordings, AI analyses, Profile Insights and your App preferences.

Your journal is stored on your device first. Cloud journal is optional and off by default. Enabling it sends journal text, transcripts, metadata, AI results and supported preferences to Supabase for storage and synchronization. Signing in alone does not upload your journal or enable AI. Account, consent, security, reward and purchase records may still be processed for account features you use.

Cloud journal does not upload or restore raw audio. Depending on your Apple settings, local App data may separately be included in a device or iCloud Backup.

Speech recognition

With your microphone and speech-recognition permission, Apple Speech converts recordings into text. Recognition may happen on your device or send audio and transcripts to Apple servers, depending on your device, language and service availability. Apple's processing, retention and improvement choices are explained in Siri, Dictation & Privacy. You can revoke permission in iOS Settings and enter Dreams as text instead.

AI processing

AI requires a signed-in Cloud journal and a separate opt-in. Before you enable it, the App explains the provider, data sent, purpose, retention and withdrawal controls. Dream Analysis starts when you request it for one or more Dreams. Profile Insight may update automatically from completed analyses while AI is enabled, including analyses restored from an imported journal.

Supabase sends OpenAI the title and text of each Dream selected for analysis, with language and processing instructions. Profile Insight uses an aggregate of completed analyses, such as recurring themes and counts, rather than your entire journal text. Results are stored in your cloud and device journal.

We do not add account identifiers, contact details, purchase information or raw audio to AI requests. Your own text may contain personal or sensitive information. We disable OpenAI response storage and do not opt in to training on your content. OpenAI may retain prompts and responses in abuse-monitoring logs for up to 30 days, or longer where required by law or necessary to protect its services or others from harm.

Purchases and free-analysis rewards

Apple processes payments; we do not receive your card number. We process product and transaction identifiers, subscription status, dates and refund information to provide and restore purchases.

To administer one-time rewards and prevent duplicate claims, we process credit balances and grant/use history, Apple DeviceCheck verification tokens, a random installation identifier stored in the iOS Keychain, one-way hashes of device/installation values and eligibility status. Reinstalling the App or deleting an account does not reset device eligibility.

Support, diagnostics and analytics

In-App support sends your message, optional contact details, selected screenshots and limited App/device information through Supabase to a private Telegram support workspace. Bug reports also include redacted diagnostic logs after you confirm the disclosure; feature requests do not. These logs exclude saved Dream text, transcripts, audio and AI content. Your message or screenshots may themselves contain sensitive information. Supabase retains delivery metadata rather than a support-message archive.

The App keeps limited local diagnostic logs. Sentry receives minimized crash information, configured to exclude Dream content, transcripts, audio, AI content and email addresses.

Amplitude receives no App events until you separately enable analytics. If enabled, it receives feature-interaction events and a pseudonymous account or installation identifier to measure product use. These events exclude Dream content, audio, AI content, free text, email, Apple ID, purchase identifiers, precise location and detailed sleep or health information. We do not use advertising identifiers, session replay or cross-app tracking.

Website analytics. The ZETIS website is hosted by Vercel. We use Vercel Web Analytics and Speed Insights to understand aggregate website traffic and performance. These services process technical information such as page routes, referrers, approximate location, browser and device information, and performance metrics. We do not connect website analytics with your ZETIS account or send journal content, audio, AI content or health information to these services. We do not use Amplitude, session replay or advertising tracking on the website. App Store links may contain campaign identifiers used by Apple to report campaign performance.

Where the GDPR applies, we rely on:

  • Contract, Article 6(1)(b): providing requested journal, account, cloud, transcription, purchase and support services.
  • Consent, Article 6(1)(a): the alpha waitlist, optional AI and product analytics.
  • Explicit consent, Article 9(2)(a): Cloud journal, speech recognition and AI processing of content that contains health or other special-category data.
  • Legitimate interests, Article 6(1)(f): proportionate security, troubleshooting, service reliability, fraud prevention and aggregated measurement of website traffic and technical performance, balanced against your rights.
  • Legal obligations, Article 6(1)(c): required tax, accounting and regulatory records and responses to lawful requests.

Accepting the Terms does not authorize optional processing. You may withdraw consent at any time without affecting earlier lawful processing. Cloud journal, AI and App product analytics are optional; without information necessary for a requested feature, we cannot provide that feature. Cookie-free aggregated website measurement is separate from App product analytics. Local journaling and text entry are available alternatives to cloud sync and speech recognition.

4. Recipients

Information is disclosed to providers for the purposes described above:

  • Apple: sign-in, speech recognition, payments, device services and aggregated App Store campaign reporting.
  • Supabase: authentication, cloud storage and server processing.
  • OpenAI: Dream Analysis and Profile Insight after AI opt-in.
  • Sentry: crash reporting.
  • Amplitude: analytics after opt-in.
  • Telegram: support messages you submit.
  • Vercel: website hosting, delivery, security, cookie-free aggregated traffic measurement and technical performance metrics.
  • Loops (Astrodon Corporation): email delivery and subscription management for the private-alpha waitlist.
  • Other network providers: website delivery and security.

We require processors to protect information consistently with this Policy, our instructions and applicable law. We may also disclose information to competent authorities or other recipients when legally required. We do not sell personal information or share it for targeted or cross-context behavioral advertising.

5. International transfers

Our primary Supabase database is in Frankfurt, Germany. Providers and their subprocessors may also process information in other countries, including the United States. Where required, transfers use an applicable adequacy decision, the EU-U.S. Data Privacy Framework for certified recipients, or Standard Contractual Clauses with necessary assessments and safeguards, including UK or Swiss adaptations where applicable. You can request destination information and a copy of applicable safeguards at zetis@zebka.com.

6. Retention and deletion

  • Local journal: text and saved analyses remain until you delete them or remove the App's local data. Older audio may be automatically deleted when the storage limit is exceeded, including the default automatic limit. Journal text is retained separately. Cloud sync and journal exports do not provide a recoverable audio backup.
  • Cloud journal: records remain until you delete the content or account. Deleted data may remain in restricted database backups for the seven-day recovery window. Recovery must preserve deletion requests.
  • OpenAI: abuse-monitoring retention is described in section 2. Disabling response storage does not disable those logs.
  • Diagnostics and analytics: local logs are kept for up to 7 days, Sentry crash events for 30 days and opted-in Amplitude events for 12 months from receipt, followed by the provider's scheduled deletion. Verified deletion requests are handled separately from those expiry periods.
  • Website analytics: traffic and performance records are retained only while needed to measure and improve service quality, subject to our Vercel plan, reporting window and deletion controls.
  • Alpha waitlist: an active contact is retained until you withdraw or for no longer than 12 months after signup, whichever occurs first. After unsubscribe or deletion, we remove you from the active list and may retain only the minimum suppression and consent record needed to honor your choice, demonstrate compliance or resolve a dispute.
  • AI usage records: content-free request and usage metadata is removed with the account unless retention is legally required.
  • Reward eligibility: account deletion removes the credit wallet and account-linked history. Minimal device/installation hashes and eligibility status remain without the deleted account identifier while needed to prevent repeat claims for the one-time offer. DeviceCheck eligibility and the local Keychain identifier are not reset. You may request a review of this retention.
  • Support: New Telegram messages and attachments are automatically deleted after one month. Earlier records, separately retained support copies and delivery metadata are kept only while needed to resolve the request, prevent abuse or meet legal duties.
  • Consent, transaction and administrative records: retained while needed to demonstrate your choices, meet legal duties or resolve disputes, then deleted or de-identified.

Delete individual Dreams or your account in Settings. Deleting a Dream removes its linked analysis; account deletion removes cloud journal data, Dream Analyses and Profile Insights, subject to the limited retention above. We pass applicable deletion requests to processors and other recipients.

Turning AI off stops future requests and queued work but does not delete saved results. Deleting a Dream removes its linked analysis. Account deletion removes cloud AI results and clears local AI results, subject to the limited retention above. Turning Cloud journal off stops future sync and AI requests but does not delete existing cloud data. Signing out or uninstalling does not delete your cloud account. Account deletion does not cancel an Apple subscription.

7. Your choices and rights

Manage Cloud journal, AI and analytics in App Settings, and microphone, speech-recognition and notification permissions in iOS Settings. You can review, edit, delete and export journal content in the App. The journal export excludes audio, Profile Insights and account records; request other information using the contact below. We cannot retrieve data stored only on your device. The App analytics setting controls Amplitude App events; it does not control cookie-free aggregated website measurement, which is not linked to your App account or journal.

You can withdraw from alpha email at any time using the unsubscribe link in an email or by contacting zetis@zebka.com. Withdrawal stops future alpha email and does not affect processing that was lawful before withdrawal. You may also ask us to delete your waitlist record, subject to the minimum suppression and legal records described above.

To request access, correction, deletion, portability, restriction, objection, withdrawal or recipient information, email zetis@zebka.com. Describe your request, country/state and account email or Apple Private Relay address if applicable. Do not include Dream content or health details in the initial message. We may proportionately verify your identity; no new account is required. An authorized agent may act where applicable law permits.

Rights, exceptions and response periods depend on your jurisdiction. Under the GDPR/UK GDPR, we normally respond within one month and explain any lawful extension within that period. Applicable US consumer-health rights and response periods are described in the Consumer Health Data Privacy Policy. We apply the relevant local requirements to requests from other countries.

Requests are ordinarily free. If we lawfully refuse, charge a fee or extend a deadline, we explain why. To appeal, reply to the decision or email zetis@zebka.com. We do not discriminate for exercising privacy rights. You may complain to the Cyprus Commissioner for Personal Data Protection or your competent local supervisory authority.

8. Security

We use encrypted connections, protected device and cloud storage, access controls, server authorization and minimized diagnostics to protect information.

9. Changes

We publish the effective date of this Policy and notify you in the App of material changes. We obtain a new consent where required before new purposes or materially different processing take effect.