Last updated: October 26, 2026
The English version is the authoritative privacy policy.
This Privacy Policy explains how Zinley ("Zinley," "we," "us," or "our") collects, uses, and protects your information when you use Zinley.
For questions about this policy, contact us at [email protected].
We believe you should understand how Zinley processes your data and which controls are available to you. This policy applies to Zinley's hosted services across the plans and features we offer.
We collect information necessary to provide and improve Zinley's services. The following describes each category of data we collect and its purpose:
Email address, name, and authentication credentials collected during registration. This information is required to provide account access and maintain account security.
Device identifiers, operating system information, device capabilities, and connected platform details (messaging apps, integrations). This information enables Zinley to function across your devices and connected platforms.
Your conversations, commands, files, and requests to Zinley ("Inputs"), and the responses and actions Zinley generates ("Outputs"). We process these to provide requested features and retain conversation history so Zinley can maintain context. Limited request and response content is also stored in restricted operational logs for reliability, debugging, safety, support, and security. Authorized personnel may access that information for those purposes or when required by law.
Feature usage, performance metrics, error logs, and interaction patterns. This data is used to improve the service and resolve technical issues.
We automatically collect device and connection information (IP address, device type, browser data), browsing patterns, and log files. This data supports service operation, security monitoring, and performance optimization.
When you submit feedback, bug reports, or rate responses, we collect that information and any conversation context you choose to attach so we can investigate the issue.
We use your information for the following purposes:
Service improvement activities do not use the contents of Gmail messages, Google Drive files, Google Docs, Google Sheets, Google Slides, Google Calendar events, or other Google user data obtained through Google APIs.
Zinley does not train any model on customer content. To provide AI features, we send the information needed for a request to third-party model, inference, search, and routing providers. The provider, endpoint, and region can depend on the model and feature in use.
Content flagged by automated safety systems, submitted with a support request, or needed for a security investigation may be reviewed by authorized personnel. Access is limited to the purpose of that review.
We do not sell your personal data. We may share information only in the following limited circumstances:
Depending on the features you use, providers may include Google Cloud and Firebase for hosting, authentication, and storage; Portkey and model or inference providers for AI routing and processing; Perplexity and similar services for search; Sentry for diagnostics; Twilio for phone features; SendGrid for email delivery and inbound routing; and Stripe for billing. Providers receive only the information needed for their role, subject to their applicable terms and our agreements. See the Security page for a current summary of primary providers.
We may share data with our affiliates and related entities, who are bound by this Privacy Policy.
If you connect third-party applications to Zinley, those services will receive the data necessary to provide the integration. Their use of your data is governed by their own privacy policies.
We may disclose information if required by law, court order, or government request, or to protect our rights, property, or safety, or that of our users or the public.
If Zinley is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and your options regarding your data.
Zinley accesses Google services only when you explicitly connect an account from Settings. Each Google service is a separate connection with its own consent screen and its own token. Connecting one service never grants access to another.
Zinley does not request any Google Drive, Sheets, Docs, Slides or BigQuery permission. It cannot see your Drive.
Each connection is separate and requests only the scopes listed above for that service; Google's consent screen shows exactly what is granted.
Data retrieved from Google APIs is accessed and used only with your explicit consent and only to provide the user-facing feature or action you request. For example, this may include reading or searching your Gmail messages, sending an email you approved, and reading or managing your calendars and events. Google user data is:
We store OAuth access and refresh tokens for each connected service in hosted storage protected by our infrastructure provider. Content fetched from Google APIs may become part of a saved conversation or limited operational log. Deleting a conversation moves it to Trash for up to 30 days unless you permanently delete it sooner. Disconnecting a service disables the connection and clears the stored access and refresh token values.
You can disconnect any Google service from Settings in Zinley at any time. This erases the access and refresh tokens we hold and stops all further access.
Disconnecting in Zinley does not by itself remove the grant recorded on your Google Account. To revoke it there as well, open myaccount.google.com/permissions, select Zinley, and choose Remove Access. We recommend doing both.
Zinley's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve user-facing features that are visible and prominent in Zinley and that you explicitly request or authorize.
Zinley uses third-party AI models to carry out the actions you ask for. Google Workspace user data, whether raw, aggregated, anonymized, or derived, is never used, transferred, or sold to develop, train, improve, fine-tune, or evaluate any foundational or generalized artificial intelligence or machine learning model, whether ours or a provider's.
Workspace content reaches a model only as the input to the single request you asked for, and only through providers that are contractually bound not to train on it. We route model traffic through enterprise API endpoints whose terms exclude customer content from provider training by default, and we do not opt in to any data-sharing or model-improvement program on those accounts. Zinley trains no model of its own on any customer content.
The Zinley mobile app can read Apple Health (HealthKit) on iPhone or Health Connect on Android. Nothing is read until you turn on Health sharing in the app and allow it in your phone's Health permissions. You can turn it off at any time.
Depending on what you allow, Zinley reads activity (steps, distance, active energy, exercise, stand hours, flights climbed, time in daylight), workouts, sleep, heart rate, heart rate variability, breathing rate, blood oxygen, VO2 max, blood pressure, blood glucose, body temperature and wrist temperature, body measurements (weight, body fat), mindful minutes, and nutrition (calories, protein, water, caffeine, alcohol). Menstrual cycle data is read only if you turn on cycle tracking separately. Zinley only reads from Health. It never writes to Apple Health or Health Connect.
Your phone sends Zinley's servers daily totals for each day, plus steps per hour for the last 8 days. It does not send the individual raw samples stored in Health. Each phone sharing Health says whose data it is. If a family member's phone shares Health through your account, you label it as theirs, and their data is kept separate from yours. Please share someone else's Health only with their agreement.
You can also add things yourself, such as a health card (for example allergies, medications, conditions, or an emergency contact) and logs of how you feel, symptoms, meals, or readings. These are treated as Health data too.
Health reads, weekly reviews, care alerts, and experiment results are sent as notifications in the Zinley app and on your devices. They are never sent by text message, email, or Telegram. If you ask Zinley about your health in a conversation on another channel, the answer goes to that conversation. Health data is only shared with you, the account owner. Zinley does not mention it to anyone else or include it in anything it sends on your behalf.
You can turn off local context and health research in Settings › Health.
Zinley's health reads, alerts, and suggestions are general wellness information based on your own numbers. They are not medical advice, a diagnosis, or a substitute for a doctor. Zinley is designed never to tell you to start, stop, or change a medication. If you are unwell or worried, contact a medical professional or emergency services.
You can also remove Zinley's access in your phone's Health settings at any time. After that, Zinley cannot read anything new.
We use technical and organizational safeguards designed to protect your information. No security measure eliminates all risk.
Different records have different retention rules. Current product behavior includes:
A self-service account-deletion request begins a three-day grace period. After that period, access is disabled and the deletion workflow erases supported conversations, people data, agent assets, memory, and per-user telemetry. Minimal account, billing, fraud-prevention, security, deletion, backup, aggregate, or legally required records may remain. Subscriptions and phone lines may require separate cancellation or release.
We collect operational metrics and diagnostics to maintain service performance, security, and reliability.
We log latency, reliability, feature usage, and other operational events. We design product telemetry to minimize customer content, but limited identifiers and technical metadata may be included.
We collect error logs and crash reports to identify and resolve technical issues. Automatic PII collection is disabled for supported diagnostics, but limited identifiers, error metadata, or context you submit with a report may be included.
Depending on where you live and the law that applies, you may have the following rights regarding your personal data:
To exercise a privacy right, contact us at [email protected]. We will verify and respond to requests within the period required by applicable law.
Zinley is based in the United States, and our servers are primarily located in the US. If you access Zinley from outside the United States, your data may be transferred to, stored, and processed in the US and other countries where our service providers operate.
Where applicable law requires a transfer mechanism or additional safeguard, we use a mechanism appropriate to the service and transfer. Contact [email protected] for information relevant to your jurisdiction.
We use cookies and similar technologies on our services. The following describes how and why they are used:
These are necessary for our services to function properly, including authentication, security, and core functionality.
These help us understand how our services are used so we can improve them. Where an analytics consent or opt-out control is available, it applies as described in that control.
We use device and platform identifiers to enable cross-device and cross-platform functionality. This is essential for Zinley to work seamlessly across your desktop, phone, and messaging apps, and can be managed through your settings.
Zinley is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from a person under 18, we will promptly delete that information.
If you believe we have collected information from someone under 18, please contact us at [email protected].
The rights available to you depend on your location and whether a particular law applies to Zinley's processing.
Where the EU GDPR or UK GDPR applies, you may have rights including access, correction, deletion, objection, restriction, portability, and the right to complain to a supervisory authority. Direct requests to [email protected].
California residents have rights under the California Consumer Privacy Act, including the right to know what personal information we collect, delete personal information, and opt out of the sale of personal information (note: we do not sell personal information).
Where Brazil's Lei Geral de Proteção de Dados applies, you may have rights including access, correction, deletion, information about sharing, and review of certain processing decisions.
Users in South Korea have rights under the Personal Information Protection Act, including rights of access, correction, and deletion. If we meet the thresholds under Article 31-2 of PIPA and its Enforcement Decree, we will designate a domestic agent in Korea and publish their details here. Korean users can direct all data protection inquiries to [email protected].
Where Canadian privacy law applies, you may have rights to access and correct personal information and to withdraw consent subject to legal or contractual restrictions. Data may be transferred to the United States or other countries for processing.
We process requests under the privacy law that applies to the request and our services.
We may update this Privacy Policy from time to time. When we make changes, we will:
We recommend reviewing this policy periodically. We will notify you of material changes in accordance with the procedures described above.
For questions, concerns, or requests regarding this Privacy Policy, please contact us:
Data Controller: Zinley, San Francisco, CA, United States
Company Website: zinley.com
Privacy Team (all data protection inquiries): [email protected]
Human support escalation: [email protected]
We will respond within the period required by applicable law.