Privacy Policy

Last updated August 26, 2026

This Privacy Policy explains what information zmist (operated by Anar Alishov, prowadzący działalność gospodarczą pod firmą zmist (a Polish sole proprietorship / JDG)) collects when you use https://zmist.co and the zmist web/iOS apps (the "Service"), why, and what choices you have. It's meant to be read alongside our Terms of Service and Cookie Policy.

1. What we collect

Account information

When you register, we store your email address, a display nickname, and a securely hashed password (we never store your password itself). If you sign in through Google, Microsoft, Apple, or LinkedIn instead, we receive your name and email from that provider - never your password with that provider, and never anything beyond name/email.

Channels, messages, and templates

Everything you send into a channel - free-text messages, template-triggered signals, and their timestamps and sender - is stored so the channel has real history, not just a live feed. The same is true of templates and reports you create.

Uploaded images

Avatar and channel images you upload are stored in object storage (S3-compatible) associated with your account or channel.

Technical data

Like most web services, our infrastructure (including Cloudflare, which sits in front of our web traffic) logs standard connection information (IP address, request timing) for security and reliability - we don't use this to build an advertising profile of you.

2. Why we collect it

  • To provide the Service - an account, channel history, and real-time messaging can't work without storing this.
  • To send you transactional email - a password-reset link if you request one, or a channel-invite email if someone invites you. We don't send marketing email today.
  • For security - detecting and responding to abuse or unauthorized access.

3. What we don't do

We don't sell your personal information. We don't use third-party advertising trackers - see our Cookie Policy for the full, current list of what's actually set (today: essential local storage only).

4. Who we share it with

Only the infrastructure sub-processors that make the Service work - hosting, network/DNS, object storage, and transactional email. We publish the current list, including what each one processes and where, on our Sub-processors page, and we update that page before adding a new one. None of them are permitted to use your data for their own purposes. Content you post in a channel is visible to that channel's other members by design - and, if you generate one, to anyone with that channel's public share link (see our Terms, Section 6).

We may disclose information if required by law, or to protect the rights, safety, or property of zmist or its users.

5. How long we keep it

We keep your account and channel data for as long as your account exists, so channel history stays intact. A password-reset link expires after 1 hour whether or not it's used. When you delete your account (see Section 7) it is deactivated immediately and then permanently erased - along with the channels, templates, and signals you own, and your messages in other people's channels - after a 7-day grace period, by an automated job, except where we're required to retain something longer by law.

6. Your choices and rights

  • You can update your profile information (nickname, avatar) directly in the app at any time.
  • Export your data - Settings › Profile › "Download my data" gives you a JSON file of your profile, channel memberships, and every signal you've sent (GDPR Art. 15 and 20).
  • Delete your account - Settings › Profile › "Delete account", no email to support required (GDPR Art. 17). See Section 7.
  • You can control non-essential cookies/local storage through the banner on this site or the "Cookie settings" link in its footer - see our Cookie Policy.
  • If you're in the EU/UK or California, you have additional rights (access, correction, deletion, portability, restriction, or objection to processing) under GDPR or CCPA - the export and delete tools cover most of them directly, and you can contact us for anything else. You also have the right to lodge a complaint with your local supervisory authority.

7. Deleting your account

Open Settings › Profile › "Delete account" in the web or iOS app. Your account is deactivated right away; after a 7-day grace period an automated job permanently erases your profile, the channels/templates/signals you own and all messages in them, your memberships and authored messages in other people's channels, and your entries in our search indexes. Signing back in during the grace period cancels the deletion. If you can't reach the app for any reason, email support@zmist.co from the address on the account.

8. Where your data is processed

zmist's application servers and database are hosted in the European Union. Some sub-processors (for example a content-delivery network, or an email provider) may process limited technical data or message metadata outside the EU; where that happens it is covered by an appropriate transfer mechanism such as the EU Standard Contractual Clauses. The current locations are listed on the Sub-processors page.

9. Children

zmist isn't directed at children under 16, and we don't knowingly collect their information.

10. Changes to this policy

We'll update the date at the top of this page whenever this policy changes materially.

11. Contact

Questions about this policy or your data: support@zmist.co.