Privacy Policy
Updated August 13, 2026
Core principle: leads and sensitive data stay on your device. Our servers only keep what's needed to run your account and credit.
Data stored ON YOUR DEVICE (local)
- Post content, leads, and extracted phone numbers — stored in a local database, with phone numbers encrypted at rest.
- Your Facebook login session (inside the app's browser) and your Zy Seller login token — stored securely via the OS keychain, not as plain text.
- You can delete every phone number / lead from your device at any time inside the app.
Data stored ON Zy Seller's SERVERS
- Account: email, display name, login times, sessions/devices. If you use Google sign-in, we also store your Google account identifier (a string issued by Google — not a password) so we can recognise you next time.
- Credit: balance and credit transaction history.
- AI usage data (summary): timestamp, model, token count, status, and cost of each scoring call. Post/lead content is not stored in this log.
When AI scores a lead
When you request scoring, the app sends the post content and your criteria to our server for processing by an AI model (a third-party provider). This content is used to generate the score and is not retained as a log on Zy Seller's servers. The AI provider's own processing is governed by their terms.
Email is used to sign in (sending a one-time code) and for support contact. We do not sell your data.
Signing in with Google
If you choose Google sign-in, the sign-in window opens in your own system browser — Zy Seller never sees your Google password. Once you approve, Google returns a one-time code, and our server exchanges that code with Google for your identity details.
- What Google sends us: your email address and whether it is verified, your Google account identifier, your display name, and the security information needed to validate that the sign-in is genuine. The basic-profile permission may also cause Google to include a few extra fields (given/family name, profile-picture URL, locale) — Zy Seller does not use or store those fields.
- What we store: your email, your Google account identifier, and the fact that the email has been verified. The display name is only used as the default name when creating a new account; if you already have an account, your existing name is not overwritten.
- About access tokens: Google returns a short-lived access token during the code exchange, but Zy Seller does not use, store, or log it. We also do not request offline access, so we never receive a refresh token. The permissions we request cover sign-in and basic profile only — they do not grant access to your Gmail, Drive, or Contacts.
- You can revoke access at any time from your Google account connections page. After revoking, you can still sign in with a one-time email code. Note that revoking on Google's side does not automatically delete the data already stored on our servers — to remove it, request account deletion (see Your rights below).
Advertising measurement (Meta Pixel & Conversions API)
On the zyseller.com website we use the Meta Pixel (cookies _fbp/_fbc) to measure the performance of our Facebook/Instagram ads — page views, pricing views, and app-download clicks. When you create an account or make a payment, our server sends a conversion signal to Meta via the Conversions API: your email is one-way hashed for matching, we never send your plain email, and we never send post/lead content or phone numbers. This data is used only to optimize advertising and is subject to Meta's data policy. You can turn off personalized ads in your Facebook account settings or block cookies in your browser.
Your rights
- Delete phone numbers/leads from your device at any time.
- Revoke login sessions on other devices from the Account section.
- Request account deletion via [email protected].
You are the controller of the personal data you collect; please comply with applicable regulations. See also Responsible use.