Privacy Policy
Effective date: October 15, 2026
Summary
- We collect what we need to run zvena: your account details from the sign-in you choose, and the content you create.
- No analytics, no advertising, no tracking pixels. We do not sell or share your personal information, and we never use your content to train AI.
- Our servers are in the European Union. A few service providers help us run zvena; they are listed below.
- You can download all your data or delete your account at any time in Settings.
1. Who we are
zvena (the “Service”, available at zvena.app) is a free workspace for design and documents. It is operated by [Company name], [Company address] (“we”, “us”). For the personal data described in this policy we are the controller under the EU and UK General Data Protection Regulation (GDPR) and the “business” under US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA).
For content that you and your teammates put into a shared workspace, the workspace owner decides who can see it. We store and show that content only to provide the Service.
2. What we collect
Information you give us or that comes from your sign-in provider
| Data | Where it comes from |
|---|---|
| Name and e-mail address | Google or GitHub when you sign in with them; you, when you sign in with an e-mail link. We store an e-mail address only if the provider confirms it is verified (a GitHub account without a verified e-mail is stored without one). Providers also send a profile picture link; we discard it and never store or display it. You can change your display name in Settings. |
| Your account id at Google or GitHub | The provider, so you can sign in again without a password. If two sign-in methods report the same verified e-mail address, we link them to one account. |
| Sign-in times and the version of the Terms you accepted, with the date | Recorded when you sign in or accept updated Terms |
| Workspaces, members and roles | You and the people who invite you |
| Content: documents, databases, comments, designs and uploaded files | You and the members of your workspaces. Uploaded photos are resized and their metadata (including location) is removed. |
| Reports about content (link, reason, description, optional contact details) | Anyone who submits a report at /report |
| Messages you send us | E-mail to our support or privacy addresses |
We do not use passwords, so we never receive or store one. We do not collect payment details: the Service is free.
Information collected automatically
- Session records. When you sign in, your browser gets a random session token. We store only a keyed hash (HMAC) of it, so a copy of our database cannot be used to sign in as you.
- E-mail sign-in codes. A sign-in e-mail contains a one-time link and a 6-digit code, valid for 15 minutes. We store only keyed hashes (HMACs) of them and delete them as soon as they are used or expire.
- Security log. A record of security-relevant actions such as sign-ins, role changes, exports and deletions. It contains account ids and the action only — no content, names, e-mail addresses or IP addresses.
- Server access logs. Our web server logs requests with the IP address truncated (IPv4 to the first two octets), without cookies, tokens or referrers.
- Guest data. If you use Docs without an account, your documents stay in your browser only. Files you upload get a random guest id (a cookie) so they stay yours; they are deleted after 30 days without a visit.
We do not use analytics, advertising or tracking technologies, and we do not build profiles of you.
3. How we use your data and our legal bases
Under the GDPR we must have a legal basis for each use. Ours are:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating your account, signing you in, storing and showing your content to you and the people you share it with | Performance of our contract with you (the Terms) |
| Sending sign-in links and essential service messages (security notices, changes to the Terms) | Performance of contract; legitimate interests in keeping accounts secure |
| Keeping the Service secure: session handling, rate limits, the security log, access logs, backups | Legitimate interests in protecting the Service and its users |
| Handling reports, moderating content, enforcing the Terms | Legitimate interests; compliance with legal obligations |
| Answering your questions and requests | Performance of contract; legitimate interests; legal obligation for privacy requests |
| Complying with the law and responding to valid legal requests | Legal obligation |
We do not send marketing e-mail, we do not use your data for advertising, and we never use your content to train artificial intelligence models — zvena has no AI features.
4. Cookies
We use only cookies and browser storage that are strictly necessary: to keep you signed in, remember your language and open workspace, and keep guest files yours. On the home page and the sign-in page, Google’s sign-in script may set its own cookie to remember that you closed the Google prompt. Details are in our Cookie Policy.
5. Sharing and service providers
We do not sell personal information and we do not share it for cross-context behavioral advertising. We disclose personal data only:
- To the people you work with. Members of a workspace see its content and each other’s names. Pages you publish with a public link are visible to anyone who has the link.
- To service providers that process data on our behalf under written agreements (listed below).
- For legal reasons: to comply with a valid legal request, to protect the rights, safety or property of our users, the public or us, or to investigate abuse. Where allowed, we tell you before disclosing your data.
- In a business transfer such as a merger or acquisition, in which case this policy continues to apply to your data and we will tell you in advance.
Service providers (subprocessors)
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Our hosting provider | Servers that run zvena and store its databases, files and backups | All data described in this policy | European Union (Warsaw, Poland) |
| Cloudflare, Inc. | Content delivery, DDoS protection and the encrypted connection to your browser | IP address and request metadata of every visit | Global network; USA |
| Resend (Plus Five Five, Inc.) | Delivering sign-in links and service e-mail | Your e-mail address and the message | USA |
| Google LLC | Sign in with Google and Google One Tap — only if you choose it, and the One Tap prompt on the home and sign-in pages | Your Google account id, name and verified e-mail; your browser talks to Google directly to show the prompt | USA |
| GitHub, Inc. | Sign in with GitHub — only if you choose it | Your GitHub account id, name and verified e-mail | USA |
Google and GitHub also act as independent controllers for the accounts you hold with them; their own privacy policies apply to that relationship. We will update this list before adding a new provider that processes your personal data.
6. International transfers
zvena’s servers are located in the European Union. Some of the providers above are based in, or may access data from, the United States and other countries. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on the European Commission’s Standard Contractual Clauses and additional safeguards. You can ask us for a copy of the relevant safeguards at support@zvena.app.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and profile | While your account exists; deleted immediately when you delete the account |
| Documents, comments and uploaded files | While the workspace or your account exists. Shared workspaces pass to the next member if the owner deletes their account. |
| Designs and their files | While the workspace exists; deleted designs stay in the trash for 30 days, then are erased |
| Guest uploads | 30 days after the last visit (a banner warns you before that) |
| E-mail sign-in links and codes (stored as hashes) | 15 minutes, or until used |
| Sessions | Up to 30 days, or until you sign out |
| Security log | 1 year |
| Reports about content | Until a moderator resolves and removes them |
| Server access logs (truncated IP addresses) | 30 days |
| Encrypted backups | 14 days on a rolling basis, so deleted data disappears from backups within 14 days |
We may keep specific data longer when the law requires it or to establish, exercise or defend legal claims.
8. Your rights
Depending on where you live, you have some or all of these rights:
- Access — get a copy of your personal data;
- Portability — receive your data in a machine-readable format;
- Correction — fix inaccurate data;
- Deletion — have your data erased;
- Restriction and objection — limit or object to processing based on our legitimate interests;
- Withdraw consent where we rely on it (we generally do not);
- Complain to a data protection authority, for example in the EU country where you live or work, or the UK Information Commissioner’s Office.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
9. Notice for US residents
Residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to receive a portable copy; and not to be discriminated against for exercising these rights.
- Categories we collect: identifiers (name, e-mail address, account ids), internet activity limited to security and access logs, and the content you create. Sources and purposes are described in sections 2 and 3. Retention is in section 7.
- Disclosures for a business purpose: to the service providers in section 5, for hosting, security, e-mail delivery and sign-in.
- We do not sell or share personal information, including for cross-context behavioral (targeted) advertising, and have not done so in the past 12 months. We do not process sensitive personal information for purposes that would require a right to limit. We do not knowingly sell or share data of people under 16.
- Authorized agents may submit a request on your behalf with your signed permission; we may ask you to confirm your identity directly.
- Appeals. If we decline your request, you can appeal by replying to our decision or writing to support@zvena.app with the subject “Privacy appeal”. We answer appeals within the time the law requires. If you disagree with the outcome, you may contact your state Attorney General.
10. How to exercise your rights
- Download your data: Settings → “Download all my data” gives you a ZIP archive with your documents (JSON and Markdown), uploaded files, designs (.penpot files) and account data.
- Correct your name: Settings → Profile.
- Delete your account: Settings → “Delete account” deletes the account and its data immediately (designs leave the trash within 30 days and backups within 14 days).
- Anything else: write to support@zvena.app. We will verify the request comes from the account holder (usually by replying from the e-mail address on the account) and respond within one month (GDPR) or 45 days (US state laws). We may extend this when the law allows, and will tell you if we do.
Exercising your rights is free.
11. Children
zvena is not directed to children under 13, and we do not knowingly collect personal data from them. In the EEA and the UK, people under 16 (or the lower age set by local law) may use zvena only with the consent of a parent or guardian. If you believe a child has given us personal data, contact support@zvena.app and we will delete it.
12. Security
We protect data with encryption in transit (HTTPS everywhere), sign-in without passwords, hashed session tokens, strict browser security policies that stop the pages from sending data to other sites, access controls on servers, encrypted backups, and rate limits against abuse. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
13. Changes to this policy
When we change this policy we update the effective date above. If the change is material, we tell you in advance by e-mail or in the Service, and you will be asked to review the updated documents the next time you use zvena.
14. Contact us
[Company name][Company address]
Privacy questions and requests: support@zvena.app
If you are in the EEA or the UK and the law requires us to appoint a representative there, their contact details will be listed here. You can also reach us at support@zvena.app for anything else.