Privacy Notice

Who we are

zZuP! is operated by zZuP!, Inc., a Delaware corporation ("zZuP", "we", "us"), of 251 Little Falls Drive, Wilmington, New Castle County, DE 19808. We are the business responsible for the personal information described here, processed through the zZuP! mobile app and this website (together, the "Service").

Privacy questions, rights requests and complaints: admin@zzup.org.

zZuP! is offered in the United States only. We are a US company and our infrastructure is in the US. We do not offer the Service to people in the UK or the European Economic Area, and we do not target them.

What we collect

Account

• Email address and password. Passwords are stored only as a salted hash by our authentication provider.
• zZuP ID — a sequential public number (00001, 00002, …) issued at sign-up.

Profile you fill in

• Real identity: display name, bio, avatar, date of birth, MBTI type, country or region, contact email, student (.edu) email.
• Studies and interests, all picked from lists rather than typed: your school, major, academic stage (bachelor's, master's and so on), up to five interests, and up to three things you're looking for here (a study buddy, foodie friends and so on). Every one is optional.
• School email verification. If you signed up with a .edu email address, you can verify it: we email a 6-digit code to that address and you type it back in. We keep only a one-way hash of the code, it expires after 10 minutes, and it is deleted once used. Verifying unlocks choosing a school and a student-only chat bubble. It confirms only that you can receive email at a .edu address — it does not confirm which school you attend. The school on a profile is the one its owner picked.
• Pet identity: pet name, breed, growth stage, bio, avatar, level and experience points.
• Level and style: your own level and experience points, and the chat bubble and profile style you picked.
• Settings: whether strangers can reach you at all, whether your real name is searchable, which routes people may add you through (search or your profile), and whether your friends can call you.

Three fields are never shown to anyone else, under any setting: your date of birth (other users can only ever see the age and zodiac sign derived from it), your contact email and your student email. This is enforced in the database itself — the columns are revoked from the app's read permissions, so it holds even if a client is modified.

What you write and send

• Messages — content, which identity you sent them as, timestamps, and any attachments.
• Voice messages — in one-to-one chats and Packs you can record and send audio. We store the recording. It is not transcribed, and it is not sent to any AI provider. Your pet cannot hear it, and Pulse does not accept it.
• Roam notes — the text or image you hand your pet before sending it out, plus who has already seen it, so the same note is never shown to the same person twice.
• Replies left on other people's roaming pets.
• Pulse intent — the short "what I'm up for right now" line you type before matching.
• Read position and pins — for each chat, how far you have read and whether you pinned it, so unread counts and order match on every device. Neither is shown to anyone else.

Images, files and voice messages

• Before an image leaves your phone we re-encode it, which strips EXIF metadata including GPS coordinates, and cap it at 2048px.
• Voice messages are capped at two minutes and are stored as recorded. Like every other message, once sent they cannot be deleted.
• Chat attachments — images, files and voice messages — live in private storage. They are readable only by members of that conversation, and the app fetches them through links that expire after one hour, so a leaked URL stops working.
• You do not upload a profile picture. Your avatar is chosen from the looks and decorations we provide.

Voice and video calls

• Only friends can call each other, and only as themselves — never as a pet, and never from zZuPer Pulse or Roam. You can turn calls off in Settings.
• We do not record calls. The audio and video travel between the two phones through LiveKit (see "Who else sees your data") and are not stored — not by us, and not by LiveKit.
• Calls are encrypted in transit, but they are not end-to-end encrypted. LiveKit's servers relay the audio and video, and could technically access them while a call is in progress.
• What we keep about each call: who called whom, in which chat, voice or video, when it rang, was answered and ended, and who hung up — or that it was missed or declined. The same record appears in the chat as a line like "Voice call · 12:04", and like every other message it cannot be deleted.
• Because nothing is recorded, we cannot review what was said on a call. If someone harms you on a call, you can still report them, and we act on what we can see.

Derived data

• Interest vector — when you enter the Pulse queue we convert your intent line plus your school, major, academic stage, interests, what you're looking for, bio and pet bio into a numeric embedding, and store it on your profile to match you with someone.
• Roam vectors — the same, computed from each note's content. When you browse Roam we also compute one from your school, major, academic stage, interests, what you're looking for, bio, pet bio and pet name to pick notes you may like; that one is not stored.
• Pet memories — see below.

Push notifications

If you allow notifications, your phone gives us a push token — an address that identifies your specific install of this app. We store it against your account, one row per device, and delete it when you sign out or when the token stops working.

What we put in a notification: the sender's display name, and one of "Sent you a message", "Sent you a photo", "Sent you a voice message" or "Sent you a file" — or, for a call, "Incoming voice call", "Incoming video call", "Missed voice call" or "Missed video call". We never put the contents of a message in a notification. That is deliberate — a notification travels through Expo, Apple and Google before it reaches your lock screen, and it is not encrypted end-to-end at any of those hops.

What we cannot hide from them: because the notification has to be addressed and delivered, Expo, Apple and Google necessarily learn that someone sent you a message, when, and under what display name. That is true of every app that has push notifications, including the ones you already use. If you would rather they did not learn even that, turn notifications off in your phone's settings — the app works without them.

Notifications are only sent for direct messages and calls. Group chats, Roam, Pulse and your pet do not send them.

Technical data

• Server-side request logs kept by our infrastructure provider, including IP address, timestamps and error traces.
• When you file a report, and when our automated check flags something as child sexual content, we record the IP address and country the request came from and keep it with that record. This is deliberate: without it we cannot tell one bad actor with ten accounts from ten different people, and it is what a law-enforcement referral needs. We do not log your IP against ordinary activity — sending a message, posting a Roam note, or talking to your pet does not create one of these records.

Your pet is an AI

Your pet has no mind. It is a large language model operated by OpenAI, L.L.C. Every reply you get is generated by sending data to OpenAI's servers in the United States.

What we send OpenAI

• The message you just typed, and up to your last six messages with your pet for context.
• Any photo you send your pet.
• Your first name, your pet's name, breed and stage.
• Relevant pet memories (below).
• For Roam and Pulse: the note or intent line you wrote, your bio, pet bio, school, major, academic stage, interests and what you're looking for — these turn into the vectors described above.
• When you are matched in Pulse, to write the pets' conversation: your pet bio, your bio and the shareable version of your pet memories (both with private details removed — see below), your school, major, country or region, interests, what you're looking for, MBTI type and zodiac sign — and the same for the person you matched with. Your academic stage is used for matching only and is not given to your pet.

We do not send OpenAI your email address, your date of birth (only the zodiac sign derived from it), your password, your private messages with other humans, or your zZuP ID.

Pet memories

After each thing you say to your pet, a second AI call reads it and writes down any personal fact it finds — "Owner loves eating ramen", "Owner is 21 and studies Computer Science at UCL" — and stores that sentence, with a vector of it, against your account. Later conversations search those notes so your pet appears to remember you.

The same call also writes a shareable version of each note with private details taken out — anyone's name, age or birthday, family, romantic relationships, sexual orientation, exact address, money, legal trouble, and health. "Owner is 21 and studies Computer Science at UCL" becomes "Owner studies Computer Science at UCL"; "Owner's mom is visiting this weekend" has no shareable version at all.

Passwords, PINs, verification codes, card numbers and ID numbers are never written down, even if you tell them to your pet.

This is an automatically generated profile of you, written by a machine, and it is personal data. It can be wrong.

• Your full notes are never shown to other users. They are sent only to OpenAI, to generate your pet's replies. You see parts of them as you talk — your pet brings a note up when it is relevant to what you just said.
• The shareable version can be retold by your pet to another user's pet in zZuPer Pulse — so the person you matched with can read it. The same filter is applied to your bio and pet bio before your pet retells them there, and we run a second check on our own servers before anything reaches the AI. Filters are automatic and can miss things: anything you would not want a stranger to read is safer left out of your bio, and not told to your pet.

OpenAI's terms

• OpenAI does not train its models on data sent through its API.
• OpenAI retains API inputs and outputs for up to 30 days for abuse monitoring, then deletes them, unless law requires otherwise.
• We have a Data Processing Addendum in place with OpenAI.

Its limits

AI output can be wrong, strange, or both. Your pet is not a doctor, lawyer, therapist, financial adviser, or any other kind of professional, and it is not an emergency service. If you are in crisis, read our Safety page, which sets out what your pet does when someone expresses thoughts of self-harm, and where to get real help.

What we do not do

• We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as California law defines those terms.
• There is no advertising in zZuP!, and no advertising or attribution SDK in the app.
• There is no analytics SDK. We do not track which screens you visit or build a behavioural profile of your usage.
• We do not collect your location. "Campus first" ordering compares the school you picked on your profile — nothing more. The app has no GPS feature, and it does not request a location permission on either platform.
• We do not read your contacts, your photo library beyond the images you pick, your calendar, or your other apps. We use your camera only when you take a photo to send or are on a video call, and your microphone only while you record a voice message or are on a call.
• We do not currently use your content to train any AI model, ours or anyone else's. If that changes, we will tell you before it takes effect.

US state privacy law — categories and rights

California, Delaware, Virginia, Colorado, Texas and a growing list of other states give residents rights over their personal information. The rights set out below are available to every user in the United States.

Mapped to the statutory categories California uses:

Category	Do we collect it?
Identifiers	Yes — name, email, zZuP ID, account ID, IP address in server logs and in safety records, and a device push token if you allow notifications
Protected classification characteristics	Yes, if you fill them in — date of birth, country or region
Education information	Yes, if you fill them in — the school you pick, your major and academic stage; your student email and whether you verified it
Audio, visual or similar information	Yes — images and voice messages you send. Calls are not recorded
Internet or network activity	Operational server logs, plus the IP address recorded with a report or a child-safety flag. No browsing history, no cross-site tracking
Inferences drawn to create a profile	Yes — pet memories (including their shareable versions) and interest vectors
Geolocation data	No
Biometric information	No
Commercial or financial information	No — there is nothing to buy
Employment information	No

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

Who else sees your data

• Other users — as much as the identity and visibility settings you chose. In zZuPer Pulse, also your MBTI type, zodiac sign and country on the match card, and what your pet tells their pet (see "Pet memories").
• Supabase — our database, authentication, file storage and server functions. Hosted in US East (N. Virginia).
• OpenAI, L.L.C. (United States) — as described above.
• LiveKit, Inc. (United States) — relays the audio and video of calls between the two phones. It receives your account's internal ID (not your name or zZuP ID), your IP address, and the call's audio and video while it is in progress. It does not record them.
• Resend (United States) — sends our email: password resets, school email verification codes, and the receipt you get when you write to us. It handles your email address and the contents of those messages.
• Discord (United States) — our staff alerts arrive in a private channel there. A report, a moderation hit, an enforcement action, a new sign-up or a message sent through our contact form raises one. These alerts contain personal data: the zZuP IDs involved, what you wrote in a report or a contact form, the email address you gave us, and — for a moderation hit — the IP address and country the request came from. They do not contain your messages to other users or to your pet.
• Expo (United States) — relays our push notifications to Apple and Google. It handles your push token and the notification itself: the sender's display name and a line like "Sent you a message". It never receives the contents of a message.
• Apple and Google — three separate roles:
  • They operate the app stores you install from, and handle crash reporting at the OS level under their own privacy policies. We have not integrated any third-party crash or analytics service of our own.
  • Apple (APNs) and Google (FCM) deliver every push notification to your phone. There is no other way to reach a phone that is asleep or has the app closed. They receive your device's push token, the sender's display name, and the same one-line summary — never the contents of a message.
  • Because delivery requires it, they know that a message was sent to you, and when. See "Push notifications" above.
• Law enforcement and regulators — when legally compelled, or where we believe in good faith that disclosure is needed to prevent serious harm.
• A successor — if the company is acquired or merged, bound by this notice.

Everything is stored and processed in the United States. Your data is not transferred abroad. The one exception is a call in progress: LiveKit relays it through the server nearest to each caller — for someone calling from the US, a US server. Nothing from a call is stored.

How anonymous your pet actually is

Read this part carefully.

• Against other users, in normal use: your pet identity does not reveal your real name, avatar or profile.
• Against us: none. We hold your account, both of your identities, and what each of them did. This is deliberate. It is what lets us act on reports, protect other users, and respond to a lawful demand.
• Against a determined technical attacker: we have protections in place and they are not absolute. Someone who inspects network traffic or modifies the app may be able to link a pet identity to an account. We do not promise otherwise, and we do not warrant the Service against that — see the Disclaimers in our Terms.
• What Pulse reveals about you: the match card shows your MBTI type, zodiac sign and country, and your pet may mention your school, major, where you're from, your interests and what you're looking for. Put together, these can narrow down who you are — especially at a small school. Your zodiac sign comes from your date of birth; anything else you leave blank cannot be shown or mentioned.
• Against yourself: if you type your name, your hall of residence or your timetable into a pet conversation, that is your own doing. Nothing we build can unsay it.

How long we keep things, and what deletion really does

Messages are permanent

Sent messages cannot be deleted by anyone — not by you, not by the person who received them, and not by us in the ordinary course. This is a deliberate safety decision: it means a person who is harassed still has the evidence when they report it, and it means someone cannot abuse a stranger and then erase the proof.

You can remove a message from your own view. That hides it from you and nothing else — the message still exists, the other person still sees it, and it is still there if either of you reports it. We do not offer a way to delete it, and we will not add one.

Deleting your account

When you delete your account in Settings, the following happens immediately:

• Erased at once: your real name, pet name, both bios, both avatars, date of birth, country or region, school, major, academic stage, interests, what you're looking for, contact email, student email and its verification status, any unused verification code, and your interest vector. Your display name becomes "Deleted user" everywhere.
• Switched off: every route by which someone could find, add, or notify you.
• Removed: your friendships, and every record of you blocking someone else. Any group you created is handed to its longest-standing member.
• Kept:
  • Your messages, including call records — attributed to "Deleted user". A conversation is also the other person's data; they do not lose their history because you left.
  • Records of other people blocking you.
  • Your zZuP ID — retired and never reissued.
  • Your pet memories (and their shareable versions) and your private conversations with your pet.

Deleting your account does not remove the items above. We can still see them, and we keep them. They are what we rely on when someone reports abuse, when we have to act on a legal demand, and when we have to show what happened.

We keep these records indefinitely. If the Service shuts down, they are destroyed or transferred as the law requires.

Where the law requires it, we retain material longer still — in particular, US law obliges providers to preserve reports of child sexual exploitation for at least one year. State privacy laws that give you a right to deletion also carve out data kept to comply with a legal obligation, to detect and prevent fraud or illegal activity, or to protect someone's safety. The items above sit in those carve-outs.

You can also delete your account from the web: zzup.org/delete-account.

Your rights

Whatever state you are in, you can ask us to:

• Know what we hold about you, and get a copy of it;
• Correct anything wrong;
• Delete your information, subject to the retained items above;
• Take it with you, in a machine-readable form;
• Opt out of any sale, sharing, or profiling that produces legal or similarly significant effects — none of which we do.

Email admin@zzup.org and say what you want, or use the privacy request form. We respond within 45 days, extendable once by another 45 where the law allows, and we will tell you if we need it. We will not charge you, and we will not degrade your experience for asking.

You do not have to delete your account to do any of this. These rights apply to a live account — you can ask us to remove particular information and carry on using zZuP!. The one thing deletion cannot reach is sent messages, for the reasons set out above.

We may need to verify that a request really comes from you before we act on it, particularly for deletion. You can use an authorised agent where your state allows it.

If we say no, we will tell you why, and you can appeal by replying to our decision. If you are still unhappy, you can contact your State Attorney General.

We do not sell or share personal information, so there is no "Do Not Sell or Share My Personal Information" link — there is nothing for it to switch off. If that ever changes we will publish the link and tell you before it takes effect.

Age

zZuP! is built for university communities and is not intended for children. You must be at least 18 to create an account.

We do not knowingly collect personal information from anyone under that age. We never knowingly collect it from children under 13, which US federal law (COPPA) prohibits without verifiable parental consent. If you believe a child has an account, email admin@zzup.org and we will remove it.

This is enforced on our servers, not just in the app: the date of birth you give at sign-up is checked in the database itself, and an account for someone under 18 cannot be created. Modifying the app does not get around it.

Security

Data is encrypted in transit. Passwords are salted and hashed by our auth provider. Access to every table is enforced by row-level security in the database rather than only in the app, sensitive columns are revoked outright, and privileged operations run through audited server-side functions rather than direct client writes. Chat media sits in private storage behind expiring links.

No service is perfectly secure. If a breach affects you we will notify you and the relevant authorities within the deadlines your state's breach-notification law sets. Report a vulnerability to admin@zzup.org; we will not pursue good-faith security research.

Changes

We will tell you in the app before a material change takes effect and update the date at the top. If you do not accept a change, delete your account.

Contact

zZuP!, Inc., a Delaware corporation · 251 Little Falls Drive, Wilmington, New Castle County, DE 19808 · admin@zzup.org