Zip — Privacy Policy
Who we are
Zip is operated by the Zip team at brahui.dev. For privacy questions, email [email protected].
What we collect
Guest (anonymous) accounts. A randomly generated user ID and display handle. Nothing else.
Registered accounts. The email address and password you provide. Passwords are stored as a one-way bcrypt hash — we never see, log, or store your plaintext password.
Active sessions. A hashed refresh token plus the user-agent string sent by the device that signed in. Your IP address is read briefly in memory for abuse-prevention rate limiting and is not written to any persistent store.
Match data. The puzzles you play, your path through each grid, the time you took, and the outcome (won, lost, forfeited). This is linked to your user ID so we can show your own match history.
Preferences. Your in-app toggles, such as whether you allow random matchmaking notifications.
What we don’t collect
No analytics SDKs. No advertising trackers. No location data. No microphone, camera, contacts, or other device sensors. No cross-app or cross-site identifiers.
How we use it
- To authenticate you and keep you signed in across launches.
- To run multiplayer matches (your handle and progress are visible to your current opponent).
- To show your own match history.
- To detect and prevent abuse via per-IP and per-user rate limits.
We do not sell, rent, or share any of this data with third parties.
Where data lives
Postgres on a server we operate. Data in transit uses TLS. We do not transfer data to third-party processors.
Retention and deletion
Match records persist until you ask us to delete them. To delete your account and the data linked to it, email [email protected] from the address on file (registered accounts) or include your user ID (guest accounts).
Signing out of a guest account on a device makes that account effectively unreachable from the app, but the underlying record is retained until deletion is requested.
Children
Zip is rated for all ages but is not directed at children under 13. If you believe a child under 13 has provided us their email, contact [email protected] and we will delete the record.
Changes
If we materially change this policy we will update the “Last updated” date and announce the change in-app.