ZoombadPrivacy policy
In short: we collect what we need to run Zoombad — your email, your apps and what they save, and your Store activity. We don't sell your data or show ads. Other users cannot access your app data except through features you choose to share. Connected AI assistants and safety checks are explained below. You can export your data or delete your account; retention exceptions are listed in section 5.
1. Who is responsible
Kordan GmbH, c/o Ardita Abazi, Ursprungstrasse 32a, 8450 Andelfingen, Switzerland (UID CHE-138.143.105, commercial register of the Canton of Zurich). Contact for privacy questions: privacy@zoombad.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address, sign-in codes (stored only as a hash), session cookie | To create your account and keep you signed in | Contract |
| Your profile: first and last name, date of birth, country or region; phone number if you add one | To set up your account, greet you, apply age limits (sign-up from 13, Store apps rated 13+ or 18+), and for country rules such as VAT. Others see only the name you choose to show. | Contract; legal obligation (age and tax rules) |
| Your apps (their code and version history) and the data they save | To store and run your apps, undo changes, and back them up | Contract |
| Connected AI apps (which ones, when connected) | So your AI can build and change apps for you; you can disconnect any time | Contract |
| Store activity: purchases, credit, earnings, reviews, reports, creator name | To run the Store, pay creators, prevent fraud and keep records | Contract; legal obligation (accounting) |
| Payment details | Handled by our payment provider — we never see or store your card number | Contract |
| Technical logs (IP address, errors) | Security, abuse prevention and fixing problems; kept for up to 30 days | Legitimate interest |
Your creator name, Store listings and reviews are public. Your email address is never shown to other users.
Shared apps (groups): if you join an app someone shared with you (e.g. a teacher or coach), you agree when joining that they can see the name you give, when you last used the app, and the short progress summary the app reports. They can't see anything else you save. You can leave the group at any time (legal basis: your consent).
Chats: messages you send in a chat are stored on our servers so that everyone in the chat receives them, together with the name you chose for that chat. They are not end-to-end encrypted. Everyone in the chat can read them; we look at a message only if someone reports it, and an automatic check blocks child sexual abuse content. Messages are deleted when the chat ends (everyone has left), when you delete your account, or when a moderator removes them (legal basis: contract).
Calls: voice and video calls are encrypted in transit (WebRTC). They connect devices directly or use a relay when a direct connection is unavailable. We don't record or store calls; we only keep a short note in the chat that a call happened and how long it lasted.
Safety checks: apps you publish, share or send, including their code, names and descriptions, are checked automatically for content our rules forbid. Private apps your AI creates or changes are also checked for prohibited content. When the optional content-safety service is configured, app code, names and descriptions may be sent to that service for these checks, including for private apps. Saved app data is not included in these checks. Chat messages, chat names and personal notes accompanying gifts are checked on our server and are not sent to this service; call contents are not scanned. Reports and decisions are kept for 12 months; records of child-safety incidents are kept as required by law and may be passed to the authorities.
3. Your AI assistant
When you connect an AI assistant (e.g. Claude or ChatGPT), it can create and change your apps and read your apps' saved data in order to change them safely. What you write in that assistant, and what it reads from Zoombad, is processed by that provider under its own privacy policy. You decide which assistant to connect and can disconnect it at any time.
4. Who processes data for us
We use a small number of carefully chosen service providers, bound by data-processing agreements, who process data only on our instructions:
| Type of provider | Purpose | Location |
|---|---|---|
| Hosting provider | Running Zoombad and storing the database | EU (Germany) |
| Payment provider | Payments, subscriptions, creator payouts and identity checks — we never see your card number | EU/US |
| Email delivery service | Sending sign-in codes and notifications | EU |
| Content-safety service (optional) | Checking app code, names and descriptions, including private apps — not saved app data, chats, calls or personal gift notes | US |
| Connection helper for calls | Helping devices find a direct connection; it sees IP addresses, not the call | Worldwide |
On request we tell you which provider is used for a specific purpose.
Where data is transferred outside Switzerland or the EU/EEA, we rely on adequacy decisions or the EU Standard Contractual Clauses.
5. How long we keep data
- Your account data: until you delete your account. Backups are kept for 14 days and then overwritten.
- Payment and payout records: as long as accounting law requires (in Switzerland, 10 years), then deleted.
- Sign-in codes: 10 minutes. Sessions: 30 days.
6. Your rights
You can access, correct, download (You → "Download my data") and delete (You → "Delete my account") your data, object to processing, and complain to a supervisory authority (in Switzerland the FDPIC; in the EU your local authority). Contact us at privacy@zoombad.com for anything else.
7. Cookies and storage
We use one necessary cookie to keep you signed in, and your browser's local storage for small conveniences (e.g. hiding a tip you dismissed). No tracking or advertising cookies.
8. Children
You must be at least 13 to use Zoombad. From 13 to 15 you need a parent's or guardian's permission, which you confirm when you set up your profile. Store apps rated 13+ or 18+ are only available to people of that age.
9. If Zoombad changes owner
If Kordan GmbH or the Zoombad service is sold or merged, your data may pass to the new owner as part of that sale. The new owner must keep protecting it under this policy, and we will tell you beforehand. We do not sell your personal data on its own to anyone.
10. Changes
We'll tell you about important changes to this policy by email or in the app.