Privacy policy
Zoey is a private place for a family to keep track of records, renewals and who to call. This page explains, in plain language, what we keep, where it goes, and how well it is protected. We have tried to be specific and honest rather than reassuring.
Effective date: [Effective date]
Zoey is operated by Zoey.online (“we”, “us”). You can reach us at support@zoey.online or [Mailing address].
The short version
- The most sensitive values (ID, policy, membership and account numbers, estate wishes, alarm codes and similar) are end-to-end encrypted. We and our hosting provider cannot read them. The flip side: if every passkey and the recovery code are lost, we cannot get them back.
- Most of the rest (names, dates, labels, contacts, reminders) is stored readable by the service, because reminders, emails, calendar sync and the emergency packet need to read it. It is encrypted by our hosting provider, but not end-to-end.
- A few optional features send data to other companies (Google Drive and Calendar, an AI provider, RentCast, Stripe). They are listed below.
- No ads, no analytics, no tracking pixels and no third-party scripts. We do not sell your data.
What we store and how
Everything we keep falls into one of three tiers. If a detail below matters to you, read the tier it is in. Anything you type into a free-text box (a note, a label, a title) is treated like the rest of its record: if it is not a secret field, it is in tier 2. Put sensitive values in secret fields.
| Tier | Who can read it | Examples |
|---|---|---|
| 1. End-to-end encrypted | Only unlocked members of your household, in their own browsers | ID and policy numbers, account numbers, estate wishes, alarm codes |
| 2. Stored readable by the service | You and your household; our systems; the operator if needed to run or fix the service | Names, dates, labels, contacts, reminders, vehicles, house-hunting lists |
| 3. Stored elsewhere or sent to other services | You, plus the named provider | Drive files, calendar events, AI document capture, payments, email |
Tier 1 — End-to-end encrypted (we cannot read it)
These values are encrypted in your browser with a household key that you unlock with your own passkey. Our servers store only scrambled data, so a database leak, a stolen hosting credential, or the operator looking at the database does not reveal them.
| What | Details |
|---|---|
| ID and document numbers | Passport, driver licence and similar numbers on ID records. |
| Insurance policy numbers | On every policy you add. |
| Membership numbers | Loyalty, club and program numbers. |
| Account numbers | For the accounts in your account map. |
| Beneficiary intentions | Who you intend to be the beneficiary of an account. |
| Estate wishes | What you write in the “If something happens” section. |
| Other secret fields you add | For example alarm codes, safe combinations, and portal logins on contacts and home items. |
- You hold the keys. Each member unlocks with a passkey on their own device. There is no shared household password and no way for us to reset it.
- If you lose every passkey and the recovery code, these values are gone for good. We cannot recover or reset them. Keep the recovery code somewhere safe.
- What stays readable even for these fields: the field’s label (for example “Passport number”), which record it belongs to, who created it and when. The value itself does not.
- We do not provide a place to enter Social Security numbers, and we ask you not to put one in any note or label.
Tier 2 — Stored readable by the service
This data is encrypted at rest and in transit by our hosting provider, but it is not end-to-end encrypted. We keep it readable because reminders, calendar sync, email digests and the emergency packet have to read it to work. Our systems, and the operator when needed to run or repair the service, can read it.
| What | Details |
|---|---|
| Your Google profile | Name, email address and profile photo from your Google account. |
| Household | Household name, members and their roles, and invitations (including the email addresses of people you invite). |
| Waitlist | If you join the waitlist: your email address, the name and note you give, where you signed up and when, and whether you have been let in. Ask us to remove it at any time. |
| People without accounts | Family members you add (children, parents) and the details you enter about them, such as name, relationship and birth year. |
| Records (IDs, memberships, insurance) | Labels, types, who holds them, issuers or carriers, issue, expiry and renewal dates, where the paper lives, agent and claims phone numbers, premium amounts. |
| Vehicles | Make, model, year, trim, colour, VIN, licence plate, registration and inspection dates, recall results, and the service log. |
| Account map | Institution, account type, whose it is, contact phone and website, and an optional approximate balance. (Account numbers and beneficiary intentions are tier 1.) |
| Estate checklist | Checklist progress, where documents are kept, and asset labels with optional estimated values. (Wishes are tier 1.) |
| Contacts | Name, company, phone, email, address and notes. |
| Home items and warranties | Item names, brand, model, serial numbers, purchase details, warranty dates, upkeep schedules. |
| Reminders | Reminder titles, due dates and status, derived from the dates above. |
| Activity feed | A short summary of who changed what (for example “Alex added a vehicle”). Kept for 90 days. |
| House Hunter lists | Addresses, listing links, prices, scores, notes and verdicts. Lists are shared with the people you invite to that list, who may be outside your household. |
| Sign-in sessions | A session record with your IP address and browser user agent. Deleted when the session expires (sessions last 14 days). We also keep short-lived sign-in rate-limit counters, which are purged daily. |
| Google access tokens | Stored encrypted, and used only for the Google features you turn on (Drive, Calendar). |
| Passkey details for the vault | A label, an identifier and a random salt for each passkey, plus public keys and wrapped (encrypted) copies of the household key. No private key or passkey secret is ever sent to us. |
Tier 3 — Stored elsewhere or sent to other services
These features involve another company. Where a feature is optional, nothing is sent unless you turn it on or use it.
| Service | What happens |
|---|---|
| Google Drive (only if an admin connects it) | Files you upload go into a folder named “<Household> — Zoey” in that admin’s own Google Drive, shared with household members. These files are not end-to-end encrypted. We store only an index (file name, Drive id, which part of the app). We ask Google only for access to files this app creates (the drive.file scope). When a member leaves or is removed, we revoke their share. |
| Google Calendar (optional, per member) | Reminder titles and dates are written as all-day events to a calendar the app creates in your Google account (the calendar.app.created scope, which cannot see your other calendars). |
| AI document capture (optional, Platform Pass) | The photo or PDF you drop in is sent to an AI provider (Google Gemini on a paid tier that does not train on inputs, or Anthropic) to suggest fields. We do not store the image. ID and policy numbers are never extracted. You review everything before anything is saved. |
| House Hunter setup assistant (optional, Platform Pass) | What you type to the assistant, and the names of your existing scoring criteria, are sent to the same kind of AI provider to suggest criteria. Do not type anything into it you would not want a service provider to process. |
| RentCast, listing pages and mortgage rates | Addresses you look up are sent to RentCast for property data. Listing pages you add are fetched by our server (not your browser) to read the details. Mortgage rates come from the St. Louis Fed (FRED); no personal data is sent. |
| Vehicle lookups (NHTSA) | A VIN you enter is sent to the US government’s NHTSA vehicle-decoder service, and the vehicle’s make, model and year to its recall service. |
| Map tiles and photos in your browser | The House Hunter map loads tiles from OpenStreetMap, and listing and profile photos load from the sites that host them, so those sites can see your IP address and what you are viewing. We ask your browser not to send a referrer for photos. |
| Payments (Stripe) | Stripe processes the Platform Pass payment. We never see your card number. Your email address is passed to Stripe to prefill checkout. We store the payment id, amount, currency, plan and status. |
| Email (Cloudflare Email Service) | Reminder digests and waitlist emails are sent through Cloudflare, our hosting provider, which handles your email address and the message contents (for digests, the reminder titles and dates). You can turn digests off in Account settings. |
| Hosting (Cloudflare) | The app runs on Cloudflare Workers with a Cloudflare D1 database in a North America region. Cloudflare also sees ordinary request information (such as IP addresses) as our network provider. |
| Google sign-in | You sign in with your Google account. Google handles that sign-in under its own privacy policy. We receive your name, email address and photo. |
Cookies, tracking and local storage
- No ads, no analytics, no tracking pixels, and no third-party scripts. Our content security policy blocks other sites’ scripts, fonts and styles from running on our pages.
- Cookies: a sign-in session cookie that keeps you signed in (and short-lived cookies used while completing Google sign-in). That is all.
- Local storage in your browser (never sent to us): your light/dark theme choice, and a “dismissed” flag for the welcome note on each shared House Hunter list.
How long we keep it, and deleting it
- Activity feed entries: 90 days.
- Sign-in sessions: deleted when they expire (14 days after last use at the latest).
- House Hunter lists you archive: permanently deleted 30 days later.
- Deleting a household (an admin can do this under Household settings) deletes its records, secret fields, reminders and invitations. Files in Google Drive stay in the connector’s Drive, which they can delete themselves; we revoke everyone’s share. Events already written to a member’s own Google Calendar stay there until they delete that calendar in Google.
- Deleting a household does not delete House Hunter lists (they belong to a person, not a household), and we keep payment records (payment id, amount, plan, status) for accounting and to handle refunds and disputes.
- Deleted data may remain in our hosting provider’s short-term backups for a limited time before it is overwritten.
- Deleting your account: there is not yet a button for this. Email support@zoey.online and we will delete your account within 30 days.
Your rights
You can ask us for a copy of the personal information we hold about you, ask us to correct it, ask us to delete it, or ask for an export. Email support@zoey.online. We may need to confirm it is really you first. Depending on where you live, you may have additional rights under local law; we will honour them. Because we cannot read tier 1 values, we cannot include them in an export; you can see them yourself in an unlocked browser.
Children
Zoey is not directed to children under 13, and children do not create accounts. Details about children and other family members are entered by the adults in the household. If you believe a child has created an account, tell us and we will remove it.
Security
- You sign in with Google; there are no passwords for us to lose.
- The vault uses passkeys and standard browser cryptography (AES-256-GCM), as described in tier 1.
- A strict content security policy, no third-party scripts, and encrypted connections (HTTPS) everywhere.
- Every household’s data is separated from every other household’s inside the app.
An honest limit. End-to-end encryption in a web app depends on the code we serve to your browser. If someone managed to serve malicious code to you while your vault was unlocked, it could read what you can read. Our strict content security policy, which keeps any code other than our own from running on these pages, is the mitigation. No system is perfectly secure, and we cannot promise otherwise.
Changes to this policy
If we change this policy in a way that matters, we will tell signed-in members before it takes effect. The effective date at the top shows which version is current.
Contact
Zoey.online
[Mailing address]
support@zoey.online