Privacy policy

Developer and contact

The app and the website are Zoabase, published under the name Zoabase. The service runs at zoabase.com.

Privacy questions, data requests and account deletion requests go to [email protected]. Write from the email address on the account so we can match the request.

What we access, collect and use

We only use data that the workspace needs. We do not use it for advertising, and we do not sell it. Sale means giving personal or sensitive data to a third party for money. Sending a file or message because you chose to is not a sale.

• Account and authentication. Name, email, a password stored only as a hash, profile photo, and a Google account identifier if you use Sign in with Google. Optional two-factor codes. On Android, a short-lived access token, a refresh token, and the public half of a key created in the phone’s hardware keystore. That key signs refresh and workspace-switch requests. It is not a hardware serial number.
• Workspace content you add. Messages, files, voice notes, photos, projects, issues, docs, meetings, reminders, and CRM records (organizations, contacts, deals) that you or your team type in. Those CRM contacts are records in the workspace. Zoabase does not read the phone’s address book, and it does not publish private contacts.
• Microphone and camera. Asked only when you record a voice note, take a photo, or join a call, and only after you allow the Android permission. Audio and video of a call go to LiveKit so the other people on that call can hear and see you. While a call is in progress the microphone, and the camera if you turned video on, stay active so the call continues if you leave the app. They are not used when you are not on a call, and they are not used for tracking.
• Notifications. If you turn push on and allow notifications, Firebase Cloud Messaging gives us a token for that device so we can deliver mentions, messages, assignments and reminders you already get in the app. Nothing is sent while do not disturb is on.
• Bluetooth. During a call, to connect a headset you choose. We do not collect a list of nearby devices for any other purpose.
• Payment. Plan and invoice records, and a customer reference at Stripe or Razorpay. Card and bank details are entered with that provider. Zoabase does not store full card or bank numbers, and it never shows financial or government identification numbers publicly.
• Security. Sign-in events, session identifiers, and on Android a Google Play Integrity result at sign-in (whether the installed app is the genuine Zoabase package). Used to sign you in and to detect abuse. Not used to identify you for ads.
• Help center. If you contact a workspace as a customer, the name, email and messages you send, so that workspace can reply.

Data we do not collect

Zoabase does not access your location, SMS, call log, phone address book, health data, or the list of apps installed on the device. It does not collect or link persistent device identifiers such as IMEI, IMSI, SIM serial number, the Android Advertising ID, or the App Set ID. It does not use any of those for advertising or measurement.

Who we share it with

Personal and sensitive data is shared only as needed to run Zoabase, with a provider acting for us, or when the law requires it. These parties do not receive it so they can sell it.

• People in your workspace, limited by the roles and channels that workspace sets. Admins can see members and workspace settings.
• Google, for Sign in with Google, Play Integrity, and push delivery through Firebase Cloud Messaging.
• Stripe or Razorpay, when a workspace pays for a plan.
• The email provider that sends invitations, password resets and workspace mail.
• LiveKit, for the audio and video of a huddle, meeting or call link you join.
• The host that stores and serves Zoabase.

We may also disclose data to comply with law, a valid government request, or to protect Zoabase, our users or the public, and we will give notice of a merger or acquisition where the law requires it.

How we protect it

• Traffic between the app, the website and our servers uses HTTPS.
• Passwords are stored as hashes. Session and refresh secrets are stored as hashes. The Android private key stays in the hardware keystore and is not backed up off the phone.
• Android permissions for the microphone, camera and notifications are requested at the moment you use that feature, after the screen that explains why. Leaving that screen, or pressing back, is not treated as permission.
• Payment card data is collected by Stripe or Razorpay, not by the Zoabase app.

How long we keep it

Account and workspace data are kept while the account or workspace is in use. Push tokens are removed when you turn notifications off or sign out of that device. You can end other sessions from account settings.

Security and fraud-prevention logs are kept for a limited period and then deleted. Invoices and similar billing records are kept where tax or accounting law requires it. We say so here rather than holding an account open.

Children

Zoabase is a workplace app. It is not directed at children, and it is not part of the Google Play Families program. We do not knowingly collect data from anyone under 16. If you believe a child has an account, email us and we will delete it.

Changes

When this policy changes, the new text is published on this page with a new date. The page stays at zoabase.com/privacy, including account deletion.