Privacy Policy
This Privacy Policy explains what Zovay collects when you use the Zovay app, why, how it's used, and how you can control or delete it.
1. Who this applies to
This policy covers the Zovay iOS app and the backend services it talks to. Zovay is a travel companion app: it helps travelers plan trips and find other travelers whose plans and interests overlap with theirs. It is not a dating app, and this policy is written with that actual purpose in mind.
2. Information Zovay collects
| Category | Examples | Why it's collected |
|---|---|---|
| Account & authentication | Email address; Apple Sign-In identifier; Google Sign-In identifier; a Zovay password, if you set one | To create and secure your account, and to let you sign in again. |
| Profile information | First name, optional last initial, date of birth, home country, home city, languages, travel interests | To build your traveler profile and confirm you meet Zovay's minimum age requirement. |
| Referral information | A referral code you enter, or one generated for you to share | To connect an inviting traveler with the person they invited. |
| Profile photos | Your cover photo and gallery photos | Shown on your profile to other travelers, as you'd expect from a profile-based app. |
| Trips | Destination, dates, travel interests, and an optional description for each trip you create | To run trip planning, and to show fellow travelers genuinely heading to the same destination at overlapping dates — never based on location proximity. |
| Connections | Connection requests you send or receive, and the trip context they were sent through | To run the connect/accept/decline flow between travelers. |
| Messages | Messages you send and receive with travelers you're connected with | So you can message travelers you're connected with. Stored encrypted at rest. |
| Reports & blocks | Reports you file or that are filed against you, and any blocks you place or receive | To run Zovay's safety and moderation features. |
| Verification media | A short selfie video and a still image, captured once during sign-up | To confirm your profile belongs to a real person who matches their own photos. See Section 5 — this is handled differently from your profile photos. |
| Verification result | Whether verification passed, and a similarity score | To decide whether your account can become active, and to keep an audit trail if a verification decision is ever disputed. |
| Device & session information | Device type, app version, push-notification token, IP address as processed in server request logs | To operate the service reliably, secure it against abuse, and send notifications you're eligible for. |
| Security & anti-abuse metadata | Sign-in attempt records, rate-limit counters, moderation flags on uploaded content | To protect the Zovay community from spam, fraud, and abuse. |
| Support communications | Anything you send us by email | To help you and to improve Zovay. |
Zovay does not ask for or collect government ID documents. Age eligibility is determined from the date of birth you provide, checked against Zovay's own minimum-age requirement.
3. What's public vs. private
Your profile photos, first name, last-name initial, home country/city, languages, and travel interests are visible to travelers your trips genuinely overlap with (same destination, overlapping dates) — never to every user, and never based on GPS proximity. A trip's destination, dates, and travel interests are visible the same way, as part of showing why a traveler is relevant to you. Messages are visible only to the traveler you're connected with. Your email address, exact date of birth, verification media, verification result, device information, and security metadata are never shown to other users.
4. Legal basis for processing (EEA/UK users)
Where the GDPR or UK GDPR applies, Zovay processes your information on these bases: performance of a contract (operating your account and the app's core features), legitimate interests (security, fraud prevention, and improving the service), consent (where you're specifically asked, such as for optional communications), and legal obligation (where the law requires Zovay to retain or disclose specific information).
5. Face/selfie verification, specifically
Before your account can become fully active, Zovay asks you to record a short selfie video and capture a still image. This is compared against your own uploaded cover photo to confirm the profile belongs to a real person who matches their photos.
- This is a selfie/liveness verification performed by Zovay's own systems using an image-comparison service. It is not a government identity check, and it does not use Apple's Face ID — Face ID (if you use it) only unlocks your device or the app locally, and is never sent to Zovay.
- Apple does not perform, receive, or have access to your Zovay verification media or result.
- Your verification video and image are never shown publicly and are not used as your profile photo — your own uploaded cover photo remains what's shown.
- Retention: your verification video and image are deleted immediately after a verification decision is made — whether it passes or fails — typically within seconds, as part of the same request that processes the result. An automated safety-net process also runs regularly to catch and delete any verification file left over from an interrupted or crashed session, normally within minutes of that session expiring. Zovay does not keep a 30-day or other extended copy of this media; only the verification result (pass/fail and a similarity score) and its timestamp are kept, so any subsequent dispute or investigation can be understood without keeping the underlying photo/video itself.
- If verification fails, you can try again with a fresh recording; a failed attempt's media is deleted immediately in the same way.
- If you delete your account, no verification media exists to be affected — it was already deleted as described above regardless of your account's status.
6. Third-party processors
Zovay uses a small number of infrastructure providers to operate the service. None of them are permitted to use your information for their own purposes.
| Provider | What they process |
|---|---|
| Rendering/hosting provider (Render) | Runs Zovay's backend servers and processes requests in transit. |
| MongoDB Atlas | Stores Zovay's database — your account, profile, and trip data. |
| Google Firebase | Stores your profile photos and briefly stores verification media before it is deleted per Section 5 (Firebase Storage); delivers push notifications for connection requests, accepted connections, and new messages (Firebase Cloud Messaging, which delivers to Apple's push service for iOS). |
| AWS Rekognition | Performs the automated face-similarity comparison used for verification, and automated screening of uploaded photos for disallowed content. |
| Apple | Provides Sign in with Apple; processes your Apple identity token when you use it to sign in. |
| Provides Sign in with Google; processes your Google identity token when you use it to sign in. | |
| Transactional email provider | Sends account-related emails (such as a welcome email once your account becomes active) on Zovay's behalf. |
7. International data transfers
Some of the providers above may process or store information outside your own country, including in the United States. Where this involves transferring personal data out of the EEA/UK, Zovay relies on the safeguards those providers make available (such as Standard Contractual Clauses), consistent with applicable data protection law.
8. Retention
- Verification media (selfie photo/video): deleted immediately after a verification decision, with an automated sweep clearing any leftover file within minutes of an interrupted session — see Section 5.
- Profile photos: kept for as long as your account exists, or until you remove a specific photo yourself.
- Account and profile data, trips, connections, and messages: kept for as long as your account exists, or until you delete a specific trip yourself; reported messages may be kept longer for safety review.
- Push notification device token: kept until you sign out, disable notifications, or delete your account.
- Deleted accounts: your profile, photos, and gallery images are removed as described in the Privacy Choices page. Limited information may be retained for a short period afterward where necessary for fraud prevention, security, dispute resolution, or a legal obligation.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your information, and to object to or restrict certain processing. You can delete your account and its associated data directly inside the app at any time — see Privacy Choices & Account Deletion. For any other request, contact us using the details on the Support page.
10. Security
Zovay uses industry-standard measures to protect your information, including encrypted connections between the app and Zovay's servers, rate-limiting and abuse detection, and access controls on its infrastructure. No method of transmission or storage is perfectly secure, and Zovay cannot guarantee absolute security.
11. Children
Zovay requires every user to be at least 18 years old, verified from the date of birth provided at sign-up. Zovay does not knowingly collect information from anyone under 18.
12. Changes to this policy
If Zovay makes a material change to this policy, the version number and effective date at the top of this page will be updated. Continued use of Zovay after a change means you accept the updated policy.
13. Contact
Questions about this policy or your data can be sent to Zovay via the Support page.