Privacy — Zula

The short version

The app has no advertising and no third-party trackers, and nothing it records about you is joined with data from any other company. It does record which screens you open and which buttons you press, so we can tell which parts of Zula are worth building on — see What we count. Your position and your heading are still read on your phone and stay there. You can use the whole app without an account. The one time Zula reaches out on your behalf is to fetch the preview picture for a link you saved, which you can turn off. This website counts its page views, without cookies and without knowing who you are.

What stays on your phone

This is about content — the words you write, the pictures you take, and where you are standing. None of it is sent to us. The counting described in What we count records that something happened, never what it said.

Location and heading. Used only to sort what is around you by how far off your bearing it sits. No coordinate is ever sent anywhere. Where a distance is counted at all it is rounded into a band — "between 500 metres and a kilometre" — and a bearing to the nearest eighth of a turn, which cannot be worked back into a position.
Questions you ask. Speech is turned into text on the device, and the answer is matched against places already downloaded. Neither the question nor the answer is transmitted. We count that a question was asked, whether it was spoken or tapped, how many characters long it was, and whether an answer was found.
Notes and photographs. Anything you write or attach to a place is stored on the device. It leaves only if you sign in and it syncs — see below. We count that a note was written, how long it was and whether a photograph came with it. Never the note, and never the photograph.
Saved places and visits. Kept locally by default. We count that a place was saved, which place in the public catalogue it was, and how many you now have.
What you share into Zula. A link you send from another app is stored on the device, along with anything you write on it. Recognising a place in it is done on the phone, against the catalogue already downloaded — nothing is sent anywhere to be identified. We count that something arrived and whether it was a link or plain text. Never the link, and never what you wrote on it.
Your plans. The trips you put together, their days and any costs you enter are on the device. We count that an item was added and what kind it was, and how many nights a trip runs. Never its name, never a cost, never a note.

What we count

Zula records how the app is used, so that the parts nobody can find get fixed and the parts nobody wants stop being built. It is our own counting, sent to our analytics provider (PostHog) and to nobody else. It is not advertising, it is not sold, and it is not combined with information about you from anywhere else.

What a record contains:

The name of something that happened — a screen opened, a place saved, a walk started, a search run.
Numbers and categories about it: how many results came back, how long a walk lasted, which mood was chosen, which step of the introduction you reached, whether a request to our server failed and with what code.
Identifiers of places, trips and destinations from the catalogue — the same public ids anyone can read in the app.
Your app version, iOS version, device type, language and time zone.
A random identifier created on your phone the first time you open the app. It is not your advertising identifier, not Apple's identifier for vendors, and not your device name. If you sign in it is replaced by your account identifier, so your own two phones read as one person. If you sign out or delete your account it is thrown away and a fresh random one is made.

What a record never contains: any coordinate; anything you typed or said — notes, questions, searches, plan names, place suggestions; any photograph or anything read out of one; your name or your email address.

Deleting your account deletes your synced rows and stops any further counting being attached to you. Usage records already collected are not tied to your account after that point, because the identifier they hang off is discarded.

The one thing that reaches out

When you save a link, Zula asks that page for the preview picture and title it publishes — the same card the link gets in Messages. So the site hosting it, Instagram or TikTok or a newspaper, sees a request coming from your phone, as it would if you opened the link. Nothing about you is attached: no account, no identifier, and nothing about anything else you have saved.

It can be switched off in Settings › What you share in, which also deletes the pictures already fetched. With it off, Zula never opens a saved link and the cards are blank.

If you sign in

Signing in is optional and adds exactly one thing: the same saved list on your next phone.

Sign in with Apple gives us an anonymous identifier. If you use Apple's private relay we never see your real email address.
Your saved places, visits, notes and any attached photographs are then stored against that identifier so they can be restored on another device. Each account can read and write only its own rows.
Deleting your account removes those rows and any uploaded photographs.

Who else is involved

Apple — Sign in with Apple, and the App Store's own reporting, which is aggregated and which we cannot tie to a person.
Supabase — hosts the database and file storage used for sync. They process this data on our behalf and for nothing else.
PostHog — receives the usage records described above, on servers in the United States. They process them on our behalf and for nothing else, and they are not permitted to use them for their own purposes or to combine them with anything from another customer.
Vercel — hosts this website and counts its page views. The count is aggregated, sets no cookie and keeps no identifier, and it covers these pages only, never the app.
Wikimedia — photographs of places are fetched from Wikimedia Commons as you browse, so their servers see the request. No identifier of yours is attached.
Whoever hosts a link you save — see above. They see a request for their own preview card and nothing else, and only while that setting is on.

What we never do

No cross-app or cross-site tracking, no advertising identifier, and no joining what we count with data about you from any other company.
No advertising, and no place can pay to rank higher.
No selling or sharing of personal data with anyone.
No account required to use the app.

Children

Zula is not directed at children under 13, and we do not knowingly collect anything from them.

Your rights

You can delete everything from inside the app. If you would rather we did it, or you want a copy of what is held against your account, write to hello@tryzula.com and we will do it within 30 days.

Changes

If this policy changes in a way that matters, the date at the top changes and the app tells you the next time you open it.

Questions: hello@tryzula.com