Privacy notice

Who runs Zidi

Zidi is run by bgato. The legal entity and data controller is Bagadi ALNOUR, 25 Rue du Capitaine Ferber, 59000 Lille, France. For anything about your data, write to zidi@bgato.com.

What we store

Account: your email address, profile details and a bcrypt hash of your password. We never store the password itself.
Your challenge data: challenge settings, actions, opportunities, income, payments, income sources and rituals. The amounts are what you type in. Zidi does not connect to your bank.
Groups: the groups you create or join. Other members see your progress as a percentage; amounts stay private.
Reports and blocks: if you report a group or member, we keep the report, your optional note and who sent it, and send them to our support mailbox. If you block a member, we keep that choice. The other person isn’t told.
Notifications: your preferences, an Expo push token and an installation ID generated by the app, used only to reach the right device.
Security records: session records and rate-limit metadata, which protect sign-in.
Crash reports: when the app hits an uncaught error it sends the error message, stack, app version and, if you are signed in, your user ID to our own API. These go to our server logs and are never stored in the database.

What we do not collect

There is no analytics SDK, advertising identifier or third-party tracker in the app. We do not collect your location, contacts, health data or browsing history, and we do not sell your data.

Face ID and fingerprint unlock are handled by your device. Your biometric data never reaches the app or us. The app only stores, on your device, whether you turned the lock on.

Why we use it

To provide the service you signed up for (contract): your account, sign-in, verification and password emails, your challenge data, group features.
To keep it secure and working (legitimate interests): rate limits, session records, crash reports.
Reminders (your choice): notifications only arrive if you allow them on your device. Quiet hours default to 22:00–08:00, there are at most two a day, and they stop by themselves after ten unopened reminders.

These are the lawful bases we rely on. You can withdraw your consent to reminders at any time, in the app or in your device settings.

Who processes it for us

Amazon Web Services: hosting of the API (ECS), database (RDS), content delivery (CloudFront) and transactional email (SES).
Expo: relays push notifications to Apple Push Notification service and Firebase Cloud Messaging.
Apple iCloud Mail: hosts zidi@bgato.com, so it holds what you send to support.

The API and the database run in AWS’s Paris region (eu-west-3). CloudFront serves requests from the location nearest you. Email delivery, Expo, Apple and Google can process data outside the EU, including in the United States. Where data leaves the EU, we rely on the safeguards in those providers’ data processing terms, such as EU standard contractual clauses or the EU-US Data Privacy Framework.

How long we keep it

Your challenge data stays as long as your account does. That includes the history of corrected earnings and voided payments, which explains how a number changed. Operational data is removed on a schedule:

Reset sign-in rate-limit records: 1 day after reset.
Expired sessions, password-reset tokens and verification tokens: deleted at expiry.
Push tokens reported as unregistered: 30 days after being disabled.
Reminder delivery history: 90 days.
Server logs, including crash reports: up to 2 months.
Database backups: up to 6 months.

Deleting your account

You can delete your account in the app at any time. It removes your account and everything linked to it from the live database. See how to delete your account.

Deleted data can remain in database backups for up to 6 months and in server logs for up to 2 months, until they expire. We keep no financial record after deletion.

Your rights

You can ask to access, correct, delete or receive a copy of your data, to restrict or object to its processing, and to withdraw consent. Write to zidi@bgato.com. You can correct most data, delete your account and export your data as one JSON file directly in the app.

You can also complain to your data protection authority. Our lead authority is the CNIL, in France.

Security

Traffic to our API and to the database is encrypted with TLS. Passwords are hashed. If an incident affects your data, we will notify you when the law requires it.

Changes

We will update this page when these practices change, and change the date at the top.