Privacy Policy and Google Sign-In Data

This policy explains what information ZaFeed ("we", "us") collects when you use the website, the Member Center and the API, how we use and store it, and how you can manage it.

1. Information we collect

Account information: email address, password (we store only an irreversible hash), member UID, interface and email language, and notification settings. If you sign in with Google or GitHub, we also store that account's identifier and email address.
Sign-in and security: sign-in times, IP addresses, browser information and sign-in sessions, plus the activity log in the Member Center (sign-ins, password changes, orders and so on).
Orders and payments: order contents and amounts, payment addresses and on-chain transaction hashes. Transfers on the blockchain are public by nature.
API usage: call counts for each market Key, when WebSocket connections are opened and closed, and source IP addresses. We use these to calculate usage and connection limits and for security checks.
Support and notifications: the tickets you submit and records of the emails we send you.
News subscription: if you subscribe to updates on the News page, we store the subscribed email address and its confirmation status.

2. How we use it

To provide and maintain the service: signing in, activating markets, issuing and verifying market Keys, matching payments, and sending verification codes and expiry reminders.
Security: detecting unusual sign-ins, a Key being used from many IP addresses, or repeatedly failing requests, and disabling Keys or blocking IP addresses when necessary.
Support and reconciliation: handling tickets, refunds and payment issues.
We do not sell your personal information or use it for advertising.

3. Browser storage

The website uses your browser's local storage to keep your sign-in state and settings such as the light or dark theme and the interface language. We do not use any third-party advertising or analytics tracking code.

4. Sharing and third-party services

Email delivery: emails are sent through Resend and Cloudflare Email Sending, which receive the recipient address and the email content.
Third-party sign-in: if you choose to sign in with Google or GitHub, that platform verifies your identity.
Blockchain lookups: we use public blockchain data services to check payments received at our payment addresses.
When required by law or lawfully requested by a competent authority, we provide relevant information to the extent necessary.

Data we access: When you choose Sign in with Google, Google returns an ID token. ZaFeed reads the unique Google account identifier, email address and email verification status, along with the signature, issuer, audience and expiration needed to validate the token. ZaFeed does not access Gmail messages, Drive files, contacts or calendars, or store your Google profile photo, name, ID token or Google access token.
How we use it: We use the identifier and verified email to create a ZaFeed account, link an existing account with the same email, or sign you in to the Member Center. When used as your ZaFeed account email, the address is also used for service messages such as welcome emails, verification codes and account notifications. We do not sell Google Sign-In data or use it for advertising, AI training or image generation, including non-consensual intimate imagery.
Sharing: Resend and Cloudflare Email Sending process the recipient address and message content to deliver service emails on our behalf. ZaFeed does not send them Google account identifiers or tokens. We disclose relevant information to the extent legally required.
Storage and protection: ZaFeed stores the Google account identifier and linked email in its account database. We receive the sign-in credential over HTTPS, validate it on the server, and protect account records with server-side authentication. ZaFeed stores only a hash of its own session token on the server.
Retention and deletion: We retain the sign-in link while your account exists. Delete your ZaFeed account in Member Center → Settings → Account, or contact [email protected] to request access or deletion. Account deletion immediately revokes sessions. After 30 days, we remove the Google link from the live account database and anonymize your account email. Email logs containing the address are purged after 90 days and daily database backups rotate as described in Section 5. You can also revoke authorization under third-party connections in your Google Account.

ZaFeed handles information received from Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

5. Retention

Account information is kept for as long as your account exists.
When you delete your account, the service stops immediately. After 30 days your email address is replaced with an anonymous value, and your password, third-party sign-in links, sign-in sessions and activity log are deleted. Order and payment records are kept as required for accounting and legal purposes.
Email delivery records are kept for 90 days. Daily database backups rotate under a 14-day retention setting. Deployment rollback backups are managed separately.

6. Your rights

View your account information, orders, activity log and signed-in devices in the Member Center; change your password, sign-in email, language and notification settings; and clear your activity log.
Delete your account at any time (Member Center → Settings → Account).
Unsubscribe from news emails: every news email has an unsubscribe link at the bottom.
For other requests (such as exporting or correcting your data), please open a ticket.

7. Security

Passwords and verification codes are stored only as hashes, the whole site uses HTTPS, keys for third-party services are stored encrypted, and admin actions are logged, with two-step verification required for high-risk operations. No system can guarantee absolute security. If you notice anything unusual, change your password, rotate your Keys and contact us right away.

8. Updates and contact

When this policy is updated, we change the date on this page, and important changes are announced in News or by email. If you have any questions, please open a ticket or contact support using the panel on the right side of the page.