Privacy Policy

Last updated: September 25, 2026

This policy explains what happens to your data when you use ZIRA — the apps and the website tryzira.com. ZIRA is operated by Alhassan Laabad, based in Morocco, who is responsible for your data. Questions: zira.app.contact@gmail.com.

1. What we use, and why

An anonymous identifier. On first launch, the app creates a random identifier and stores it on your device — in your browser, for the web app. Our server uses it to keep your token balance, your free messages and your purchase history. It is not linked to your name, your email address or your Apple or Google account. It is also your recovery code: keep it private.

Your profile, if you fill it in: first name, gender (optional), date, time and city of birth. It is stored on your device. With your consent — asked on the app’s first screen, before anything is sent — it is sent to our server and to our AI provider, OpenAI, to write your readings. Our server does not keep it once the reply is written.

Your conversations. They are stored on your device only. Each message goes through our server to OpenAI while Zira’s reply is written; our server does not keep it. OpenAI does not use it to train its models, and handles it under its own policies.

Your purchases.

• On tryzira.com, Paddle.com, our reseller, takes the payment. Paddle collects what it needs for the payment and for taxes — such as your email address, payment details and country — under its own privacy policy. Paddle sends us the transaction number, the pack you bought and your app identifier, so that we can credit your tokens. In our Paddle account, we can also see your order, including your email address and country; we use them only for support, refunds and our legal obligations. We never see your card number.
• In the App Store, Apple takes the payment and sends us a transaction identifier.
• We keep transaction numbers so that no purchase is credited twice, and for support.

Videos in the Google Play app. The ZIRA app from Google Play sells nothing: instead, you can choose to watch a short video, shown by Google AdMob, to receive a reply from Zira. To show it and measure it, AdMob collects information from your device — such as its advertising ID, IP address, device model and how you interact with the ad — under Google’s privacy policy (see also how Google uses information from apps that use its services). In the European Economic Area, the United Kingdom and Switzerland, Google’s consent form asks for your choice before the first video, and “Ad privacy choices” in the app lets you change it. We send AdMob only your anonymous identifier, so that Google can confirm to our server that the video was watched and we can credit your reply. You can reset or delete your advertising ID in your device settings. The App Store app and the website show no ads.

Reports. If you report one of Zira’s replies, we keep the reported reply, the reason you chose and the app language, with your anonymous identifier, to review it and improve how Zira’s replies are moderated. Nothing you wrote is sent with it.

Technical data. When your device connects to our server or to tryzira.com, our hosting providers receive its IP address and may keep it for a limited time in technical logs, to run and secure the service. When the app or the server runs into an error, a technical report is sent to Sentry, our error-monitoring service. It describes the error, the app version and the device model, without your IP address. A report from the server can include the content of the request that failed.

Content loaded from other services. Some content comes from other servers, which then receive your device’s IP address: card images (Cloudinary), the artwork of the day (the museum or archive that publishes it) and the website’s fonts (Google Fonts). When you look for your birth city, what you type is sent to OpenStreetMap’s place search (Nominatim) to find it.

The website. tryzira.com sets no cookies and uses no analytics or advertising trackers. The payment page opens Paddle’s payment window, which may use its own cookies.

2. What we do not collect

• No account and no password.
• No location: your birth city is only what you type.
• No access to your contacts, photos, microphone or camera.
• No third-party analytics.
• No advertising in the App Store app or on the website. In the Google Play app, only the videos you choose to watch, as described above.

3. Who receives data

We do not sell your data. Only these services receive some of it, each for one purpose:

• OpenAI — writes Zira’s replies, from your messages and, with your consent, your profile.
• Paddle — takes payments on tryzira.com, as the seller of record.
• Apple — takes payments in the App Store.
• Google (AdMob) — shows the videos in the Google Play app, and confirms to our server that one was watched.
• Render — hosts our server and our database.
• GitHub — hosts tryzira.com and the Android app download.
• Sentry — receives error reports.
• OpenStreetMap (Nominatim) — finds your birth city from what you type.
• Cloudinary, museums and archives, Google Fonts — serve images and fonts.

Some of these services process data outside your country, notably in the United States.

4. Legal bases

• Running ZIRA and delivering what you bought: our contract with you.
• Personalizing readings with your profile: your consent, which you can withdraw at any time by writing to us.
• Error reports and technical logs: our legitimate interest in keeping ZIRA working and secure.
• Videos in the Google Play app: your consent where the law requires it — in the European Economic Area, the United Kingdom and Switzerland, collected by Google’s consent form; elsewhere, our legitimate interest in keeping the Google Play app free.
• Reports: our legitimate interest in moderating Zira’s replies.
• Purchase records: our legal and accounting obligations.

5. How long we keep data

• Your identifier, balance and purchase history: as long as you use ZIRA. You can ask us to delete them at any time.
• Purchase records that accounting law requires us to keep: for the period the law sets.
• Your profile and conversations: on your device only, until you delete the app — or your browser’s data, for the web app.
• Reports: as long as we need them to review Zira’s replies. You can ask us to delete them at any time.

6. Your rights

You can ask to access, correct or delete your data, to receive a copy of it, or to object to its use. Write to zira.app.contact@gmail.com with your recovery code, so that we know which data is yours. You can also complain to a data-protection authority: in Morocco, the CNDP; in the European Union, the authority of your country.

7. Security

All connections use HTTPS. Our database is encrypted at rest by our hosting provider.

8. Children

ZIRA is not intended for children under 13, or under 16 in some EU countries. If a child has used ZIRA without a parent’s permission, write to us and we will delete the data.

9. Changes

We may update this policy. The date at the top shows the current version; significant changes will be announced in the app or on this page.

10. Contact

Alhassan Laabad — zira.app.contact@gmail.com