ZYEA Privacy Policy

Version of October 8, 2026 — 2026-10-08.

1. Who is responsible?

The data controller is ZYEA’s publisher. It is a self-employed person with a secondary occupation, based in Belgium.

• Trade name: ZYEA.
• Company number: 1036.280.494.
• VAT number: BE1036280494.
• Location: Brussels, Belgium.
• Email: contact@zyea.app.
• Phone: +32 456 96 31 46.
• Website: https://zyea.app.

The email address contact@zyea.app belongs to ZYEA’s publisher. Write there with any questions or requests about your information. No data protection officer has been appointed.

This policy follows the GDPR, Regulation (EU) 2016/679, and the Belgian Data Protection Act of July 30, 2018.

2. What stays on your device

The tracking works without an account. What you note is kept on your device first. An Apple or Google account is required to buy or restore ZYEA Pro. With that verified account, your tracking is backed up online automatically, with or without ZYEA Pro: welcome answers, washes, feelings, roots and daily notes. Your comfort notes, meaning discomfort, scalp reactions and freeform notes, are health information: they only leave with your explicit consent. Backing up photos requires an active Pro. The same account finds its tracking again; a new account continues the welcome, then creates its space at the first backup. Guests have no online backup. You are told before signing in with Apple or Google.

While you’re signed in, the online backup is automatic: there’s nothing to turn on or stop. To erase your online copy, delete your account: “Settings”, at the very bottom, “Delete my account”. When you sign out, your tracking and your photos stay on this phone, linked to your account: you’ll find them again when you sign back in. Another account signed in on this phone doesn’t see them. They go away when you delete your account or the app.

The one exception: your comfort notes. They join your backup only if you choose “Back them up too” on the “Your comfort notes” screen, or “Yes” in “Settings”, “Privacy”, “Comfort notes backed up”. You can answer “No” at any time in the same place: your account and the rest of your tracking stay as they are.

A photo request sends images to the AI service. This is separate from backing up your journal online, so images may be sent from your device even if you don’t have an account. The same is true of opted-in analytics and online features.

A phone backup may include app information. This depends on your system and settings. Files you export remain under your control.

3. What information is processed?

ZYEA does not include ad tracking. Every service your phone connects to also sees its IP address, as with any internet connection. Providers keep technical logs of these connections under their own policies. ZYEA’s photo service logs only error codes, durations, and attempt numbers. It never logs photos, IP addresses, IDs, or tracking text.

4. What the AI receives

AI reading of your photos is part of what you accept with one tap, along with the terms: section 9 explains where and how. Nothing is sent to AI before that tap. Once you accept, every photo taken in the Photos tab is automatically sent to Gemini. Photos in your lengths journal stay on your phone. Photos used for haircuts are also sent to Gemini. The service reviews your photos to provide the photo features offered in the app. Gemini, Google’s AI, is the only AI provider in the published app.

Analyze your hair

What gets sent may include:

• the photo you choose and a previous photo;
• their dates, the angle they were taken from, and whether your hair was dry or wet;
• your hair type and your goal;
• coded observations from earlier photos;
• the number of washes logged between the two photos;
• haircuts and notes about your ends from that period, when relevant.

The text sent doesn’t include your name, email, free-text notes, how your hair felt, or reports of discomfort. But a photo may show your face or other private information, which is sent along with it.

Suggest and try haircuts

To suggest a haircut, the service receives your photo and your preferences about your hair, your goal, and the haircut you want. It may also receive how much time you have and the face shape you selected. For a try-on, it receives your photo and the haircut you chose. The service sends back an image made for that request.

The AI doesn’t provide a medical diagnosis. Its responses may be inaccurate. Face analysis is used to suggest haircuts. It isn’t used to verify your identity.

Which services handle your photos?

The app connects to ZYEA’s photo service. This is the hair-photo function, hosted by Supabase. The service sends images directly to Google through the Gemini API. A failure does not trigger an automatic switch to another route. Using a different model would require reviewing the related information and permission.

ZYEA’s service does not keep photos. It does not keep responses either, except the coded result of a free reading, so it can send it to you again for ten minutes: see below. The Gemini API terms, reviewed on October 2, 2026, state that:

• Google does not use these photos or responses to improve its products;
• Google keeps them for 55 days to detect and prevent misuse;
• Google may also disclose them when required by law;
• Google employees who are authorized to do so may review a request flagged by its safety filters;
• This data is used only to train models that detect misuse;
• They may be stored temporarily or cached in any country where Google has facilities.

Sources: Gemini API terms and abuse monitoring.

The result of a free reading

So that a dropped connection doesn’t make you lose your free reading, the photo service keeps its result on the server for a short time. If you ask for a reading of the same photo again within ten minutes, this result is sent to you again, without a new reading. This result contains only codes: the criteria rated, the steps suggested, and the photo’s quality. It never contains the photo or any free text. It’s linked to your account or your technical identity in a transformed form. After ten minutes, it’s never sent again, and a task that runs every ten minutes deletes it from the server. Your phone, for its part, keeps a small receipt, without the photo, until the reading is finished. This receipt is also removed when you erase your data on this phone.

Photo reading limits

The photo service limits the number of photo readings, haircut ideas, and try-ons, for each person. With ZYEA Pro, you get 6 photo readings a week, haircut ideas included, and 1 haircut try-on a week. The week runs from Monday to Sunday, Paris time: your readings and your try-on come back every Monday. Without Pro, a single photo reading is included. It allows 5 tries at most. Every try counts, even without a reading, for example after a service error. From the same IP address, tries for the included reading are also limited each week. The service also slows down requests made too close together, over a few minutes, and those from the same IP address, to stop bots. In case of an attack, the publisher may limit readings for everyone for a while. When a limit is reached, the app tells you and, when it knows, shows you when to try again. These limits protect the service and its budget. They take nothing away from your tracking or your photos.

5. Why we process your data and the legal bases

The legal bases below correspond to the features described in this document. Each use has a legal basis under the GDPR.

These legal bases don’t give blanket permission for other uses. Personalization is based on your answers and history. The app suggests hair care steps, dates, and haircut ideas. It doesn’t make legal decisions on your behalf. Sources: GDPR, Articles 6–9, and CNIL guidance on consent.

6. Who receives the information?

Supabase, Google for the Gemini API, and RevenueCat process this information on the publisher’s behalf. Their published terms include a data processing agreement under the GDPR. Expo also acts on the publisher’s behalf under its privacy policy. Cloudflare hosts the website for the publisher, under its published terms. Apple, for sign-in and the App Store, and Google, for sign-in, act on their own behalf. At the publisher’s end, only the publisher can access these services. It views your information only to respond to you, fix a problem, or comply with the law.

7. Transfers outside the European Union

Your online backup is stored in Ireland, within the European Union. Other processing may take place elsewhere:

• Supabase operates from Singapore and the United States. Its server functions run in the region closest to the person.
• Google may process photo requests in any country where it has facilities.
• RevenueCat processes purchases in the United States.
• Expo is based in the United States.
• Cloudflare, which hosts the zyea.app website, is based in the United States.
• Apple and Google apply their own policies to their services.

Supabase and RevenueCat use the European Commission’s standard contractual clauses. Google, Expo, and Cloudflare rely on the EU–U.S. Data Privacy Framework, and on these clauses if needed. To get a copy of these safeguards, write to contact@zyea.app. They are also included in each provider’s published terms.

Accepting the Terms of Use doesn’t replace these safeguards. Source: GDPR, international transfers.

8. How long?

Information may be kept longer if required by law or to defend a legal claim.

9. Change your mind and delete

AI reading of your photos

You accept the terms and this policy with one tap, under this sentence: “By continuing, you agree to the Terms of Use and Privacy Policy, including the reading of your photos by Gemini, Google’s AI.” It appears on the welcome screen, above “Later,” under “Continue with Apple” and “Continue with Google,” and on the sign-in screen. You can read both documents with one tap from this sentence before continuing. If you haven’t accepted yet on this phone, the same sentence appears under the button for your next photo, under the “Your haircut” buttons, or under the toggle in Settings. There, it ends with “including AI reading of your photos.” Nothing is sent to AI before that tap. A new version of these documents that changes what you accept brings the sentence back once. If you had turned off the reading, the sentence also comes back under the button for your next photo: that tap accepts the new version, and the reading stays off.

You stop or restart the reading with the “Share my photos with AI” toggle. Find it under “Settings,” “Privacy,” “My photos and AI.” Stopping blocks future photo uploads. After stopping, only this toggle turns the reading back on. It covers photo analysis, haircut ideas, and try-ons. It does not delete your local log or stored responses. Something a provider has already received can’t be recalled. You can request deletion by contacting the privacy contact.

Your acceptance is kept on this device, not with the backup account. On another device, you’ll see the sentence again. Restoring your phone may still copy its storage.

Online backup

With your verified Apple or Google account, the online backup includes your tracking, with or without Pro, up to 1 MiB (1,048,576 bytes). Your comfort notes require your explicit consent, described below. With an active Pro, up to 200 photos (250 MiB in total, 5 MiB each) can also be backed up. After Pro expires, your tracking keeps being backed up and read. Photos already backed up stay visible; no new photo is backed up.

While you’re signed in, the online backup is automatic: there’s nothing to turn on or stop. To erase your online copy, delete your account: “Settings”, at the very bottom, “Delete my account”. When you sign out, your tracking and your photos stay on this phone, linked to your account: you’ll find them again when you sign back in. Another account signed in on this phone doesn’t see them. They go away when you delete your account or the app.

Your comfort notes

Your comfort notes are the discomfort and reactions of your scalp, and the freeform notes you write. They can reveal a health condition: Article 9 of the GDPR protects them.

They stay on your phone until you have chosen. When a first note of discomfort or a reaction exists and you are signed in, the “Your comfort notes” screen asks for your choice, once. “Back them up too” adds them to your online backup. “Keep them on this phone” leaves them on your phone. Both buttons are equally visible, and nothing is saved without a tap from you.

This choice is free, with or without Pro. Its legal basis is your explicit consent, GDPR Article 9.2.a. The date of your choice and the version of the text you read are kept on your phone so it can be demonstrated. With your account, your choice and its date are also kept in your online backup. You can change your mind at any time in “Settings”, “Privacy”, “Comfort notes backed up”: “Yes” or “No”.

When you withdraw your consent:

• sending these notes stops at once;
• their online copy is removed from your backup as soon as your phone is online;
• your notes stay on this phone, and your tips keep using them;
• your account, tracking, photos and subscription stay as they are;
• a copy may remain for a while in Supabase’s technical backups, see section 8;
• what was done before the withdrawal remains valid.

These notes are never sent to the AI.

Usage metrics and diagnostics

The toggle is called “Help ZYEA improve.” Go to “Settings,” then “Privacy.” Withdrawing consent stops new uploads and clears the local queue. The service is asked to delete the data remotely. If you’re offline, the request waits until you’re connected again.

Account, device, and copies

You can edit or delete items from their screens. “Download my information,” at the very bottom of Settings, gives you a file with your tracking. To delete your account, go to “Settings,” then “Delete my account” at the very bottom. You’ll confirm with Apple or Google. Deleting your account removes its active state and local copy. It keeps the separate guest profile and any files you’ve already exported. Measurements, purchases, and technical access to photos are handled separately. Don’t assume deleting your account removes all of them. Deleting your account doesn’t cancel an Apple subscription. Simply signing out deletes neither your online account nor the tracking and photos kept on this phone.

This file includes your tracking data and photos. It doesn’t include all records held by service providers. To request those records, use the designated contact for exercising your rights.

10. Your rights

You can request access to, correction of, and deletion of your information. You can also request to receive it in a portable format or to restrict how it’s processed. You can object to processing based on legitimate interests. These rights are subject to the conditions set out in the GDPR. You can withdraw your consent without affecting processing that took place before you withdrew it.

Email contact@zyea.app. We may need to verify your identity in an appropriate way. You’ll usually get a response within one month. Under the GDPR, this period may be extended by two months in certain cases. Exercising your rights is free and doesn’t require a subscription.

You can also file a complaint with Belgium’s Data Protection Authority:

• address: Rue de la Presse 35, 1000 Brussels;
• phone: +32 2 274 48 00;
• email: contact@apd-gba.be;
• website: www.autoriteprotectiondonnees.be.

You can also contact the authority in your country of residence, such as France’s CNIL. Source: GDPR, individual rights.

11. Security

Communications with services use encrypted connections. Account sign-ins use the supported authentication services. Native sessions use your phone’s secure storage. This doesn’t mean the entire log is encrypted separately. The online backup filters information based on your choices. Basic rules limit access to tracking data to the account it belongs to. The photo service checks requests and applies access limits.

These measures don’t eliminate every risk. If there’s a data breach, the publisher will notify the supervisory authority within 72 hours when required by the GDPR. The publisher will also notify you promptly if the risk to you is high.

12. Age and updates

Minimum age: 18. The AI service that reads the photos, Google’s Gemini, requires it. By accepting the terms, you confirm you are at least 18. The welcome screen asks for your age range. ZYEA isn’t offered to people under 18: with that answer, the welcome stops and your answer isn’t kept. Your age range and the date of your answer stay on your phone. They don’t go into your tracking or online. They’re erased when your account or the app is deleted. If your tracking comes back by itself after a reinstall, the question isn’t asked again. If the publisher learns that an account belongs to someone under 18, it will delete the account and its online data. Automatically rejecting photos of children doesn’t verify anyone’s age. It doesn’t replace the rules that apply to minors.

The date at the top identifies this version. When a new version changes what you accept, the acceptance sentence comes back once in the app, under the button for your next photo, under the “Your haircut” buttons, or under the toggle in Settings. No photo is sent to AI before that tap.