Privacy Policy

1. Who we are

zvena (the “Service”, available at zvena.app) is a workspace for design, documents, projects, mail and calendars, with a free plan and optional paid plans. It is operated by Zvena Software Pte. Ltd., Singapore, a team of 23 people (“we”, “us”). It shows no ads. You can reach us at support@zvena.app. For the personal data described in this policy, we are the controller under the EU and UK General Data Protection Regulation (GDPR). US state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) apply to businesses above size thresholds that zvena does not meet, but we honor the rights in section 9 anyway.

For content that you and your teammates put into a shared workspace, the workspace owner decides who can see it. We store and show that content only to provide the Service.

2. What we collect

Information you give us or that comes from your sign-in provider

zvena accounts have no passwords. The only passwords we keep are the ones you give us to connect a mailbox or a CalDAV calendar (see below). We do not collect card details: Stripe processes payments for paid plans (stripe.com/privacy), and collects at checkout what a payment and tax need — your card, e-mail address, billing address and, if you add one, a tax ID. From Stripe we keep, for each workspace that buys something, its Stripe customer id and what Stripe tells us about each purchase — the checkout, subscription, invoice and charge ids, the product and period, the amounts, dates and whether it was paid, refunded, disputed or cancelled — so the workspace gets what it paid for. We do not copy your card details, e-mail address or billing address from Stripe into zvena.

Mail and Calendar

Both are optional. Nothing below happens unless you connect a mailbox or a calendar, or use Calendar in a workspace.

• Mailbox sign-in. To connect a mailbox you give us your mail server’s address, your user name and your password or app password. We store the password encrypted (AES-256-GCM, with a key derived from a secret that stays on our server), use it only to sync your mail and send the messages you write, never show it again, and delete it when you disconnect the mailbox.
• Copies of your mail. We keep the headers (sender, recipients, subject, date, flags and labels) of messages from the last 90 days, up to 2,000 per folder; the text of messages from the last 30 days and of older ones you open, up to 512 MB per person (the oldest texts go first and are fetched again when you open them); a full-text search index of subjects, addresses and texts; your drafts, views, snippets and settings; and the addresses you write to or hear from, to suggest them as you type. Attachments you receive stay on your mail server and are fetched when you open one; files you attach while writing are kept until the message is sent, or for a week if no draft uses them. Messages leave zvena when they fall outside the 90-day window or are deleted on your mail server.
• Only you see your mail. It is not shown to the members of your workspaces unless you save a conversation to a page or turn it into an issue yourself; what you copy there becomes workspace content. Your mail is never sent for suggestions on its own; if you turn a conversation into an issue, that issue (with the message it quotes and its sender) is handled like any other new issue (see Smart suggestions). We never use your mail to train AI models. Messages you send go through your own mail server, not through our email provider.
• Calendars. We store your calendars, events, reminders and invitations, with the names and email addresses of guests, and your time zone (which your browser tells us) so dates and reminders are right. If you connect a CalDAV calendar (such as iCloud or Fastmail), we store its address, your user name and an app password, encrypted as above, and keep a copy of its events in a window around today. If you subscribe to a calendar by its address, our server fetches it about every half hour. A secret feed link lets other calendar apps read your calendar; anyone with the link can, so you can reset it at any time. Invitations, booking confirmations and reminders by email are sent through our email provider (section 5).
• Booking pages. If you publish a booking page, people who book time with you give their name, email address, an optional note, and their time zone and language. We use them to create the event in your calendar and to send both of you the confirmation, and later any reschedule or cancellation. The guest gets a private link to change the booking; we store only a keyed hash of it.

Apps, devices and notifications

zvena works in a browser, in the apps for Android, Windows, macOS and Linux, and on an iPhone or iPad as a web app added to the Home Screen. The apps show the same zvena: what this policy says about your account and content applies to them unchanged.

• Devices. Every sign-in belongs to a device. For each one we keep its name (a browser’s comes from its user agent; an app sends the name your device gives itself), its platform, the app’s version and the store or website it came from, and when it signed in and was last active. You see the list in Settings → Account → Devices, where you can sign out a device, sign out an app and have it erase what it keeps on the device, or sign out everywhere else. When an app signs in, you confirm it in your browser; the app then gets a session and a device secret, of which we store only keyed hashes. The app uses the secret to learn that it was signed out or told to erase its data, even after its session has ended. The apps contain no advertising and no third-party analytics.
• Push notifications. Only for devices where you turn them on. A notification travels through the push service of your device: in a browser and on an iPhone or iPad, the service of the browser’s or the system’s maker (Apple, Google, Mozilla or Microsoft); in the Android app, Google’s Firebase Cloud Messaging, Huawei Push Kit or RuStore push, depending on the version you installed, or the UnifiedPush distributor app you chose (such as ntfy). Every notification is encrypted on our server for your device alone (the Web Push encryption standard, RFC 8291) and decrypted only on it, so the push service delivers it but cannot read its title or text. It still sees what it needs to deliver it: the device’s token or address, when a message was sent and how large it was. A notification carries its title, up to 600 characters of text, a link into zvena and the unread count.
• Messengers. Telegram, Slack, Discord and Microsoft Teams get nothing unless you connect your own account in your notification settings, or a workspace owner connects a channel of the workspace. A connected messenger receives the notifications chosen for it: who did what, where, and a short excerpt, with a link into zvena. We store the connection (the chat or channel, and the token or link it needs, encrypted). Disconnect it in the same settings, or in the messenger itself, and nothing more is sent.
• Offline copies on your device. So that zvena opens quickly and keeps working without a connection, your browser or the app keeps a copy of pages you opened and of changes you made offline, in the device’s own storage (IndexedDB and the browser cache), separately for each account. Changes made offline are sent to our servers when the connection is back. Signing out deletes the stored pages; an app you sign out and erase from Settings → Account → Devices deletes everything it keeps on the device; in a browser you can also clear the site’s data yourself.
• Downloading the apps. The installers and the Android app file come from downloads.zvena.app, which logs requests the same way as zvena.app (addresses truncated, no cookies; see Server logs below). If you install from an app store (such as Google Play, RuStore, AppGallery, Galaxy Store, Xiaomi GetApps or Uptodown) or from an F-Droid repository, that store’s own terms and privacy policy apply to the store; from stores we receive only the reports they give every developer, such as install counts and crash reports that do not name you.

If your workspace uses enterprise features

A workspace owner can verify the organization’s email domains, connect single sign-on and directory sync (see the table above), and see the workspace’s audit log: events about the workspace and its published pages, and the sign-ins, sign-ups, sign-outs and data exports of its members since they joined it. The log stores account ids, not email addresses or IP addresses; names are looked up when it is shown. What you did before you joined a workspace, or in it as a guest, is not in its log.

Information collected automatically

• Session records. When you sign in, your browser (or the zvena app) gets a random session token. We store only a keyed hash (HMAC) of it, so a copy of our database cannot be used to sign in as you. Each session is linked to the device it belongs to (see Apps, devices and notifications).
• Email sign-in codes. A sign-in email contains a one-time link and a 6-digit code, valid for 15 minutes. We store only keyed hashes (HMACs) of them and delete them when they are used, and within an hour after they expire. To limit sign-in emails we also keep, for one day, a keyed hash of the address and the time of each email.
• Security log. A record of security-relevant actions such as sign-ins, role changes, exports and deletions. It contains account ids, the action and its time, the ids of what it concerns (a workspace, page or member) and, for some actions, a role, a setting or a verified domain — no content, names, email addresses or IP addresses.
• Page views and workspace analytics. When you open a page in a workspace, Docs records that you viewed it: your account, the page and the time, at most once every 30 minutes. People who can open a page see in its Analytics how many people viewed it and who. Workspace owners see in Settings → Analytics the workspace’s totals (active members, views, edits, pages created), its most-read pages and, for each member, when they were last active and how many pages they viewed, edited and created — never which pages a member viewed. A page the owner can’t open is counted without its title. Edits and new pages come from the page history the workspace already keeps. Turn off Page view history in Docs settings and nothing is recorded about your visits: you appear in no list of viewers and your views show as “—”. Pages shared to the web count visits as a daily total, without recording who visited.
• Design library usage. When someone inserts a component from a shared library into a design, or detaches a copy of one, Design records the library, the file, the component, the account and the time, so the library’s analytics can show how often it is used. People who can open the library or a file that uses it see totals over time only, never who did it; the link to the account is removed when that account is deleted.
• Server logs. Our web server logs each request: the time, the address requested, the response, your browser’s user agent and language, and the country our network provider reports. The IP address is truncated (IPv4 to the first two octets, IPv6 to the first 32 bits); cookies, sign-in headers and referrers are removed. The application’s own error log, which is limited in size and overwritten as it fills, can contain the full IP address of the request that caused an error.
• Trying zvena without an account. “Try it now” makes an account with no name, email address or sign-in method, and a workspace with an example project in it. It is stored on our servers like any account, and this browser reaches it through the session cookie (see the Cookie Policy). What you make there is your content, as described in this policy; it can hold up to 200 MB. If you sign up from it, it becomes your account with everything in it, or, if you sign in to an account you already have, its workspace moves into that account. A trial nobody opens for 30 days is deleted with its content.
• Guest data. If you use Docs without an account, your documents stay in your browser only. Files you upload (pictures only) get a random guest id (a cookie) so they stay yours; each file is deleted 30 days after you upload it (Docs shows the date), and all of them sooner if you don’t come back for 30 days. If you sign in in that browser, your pages and files move into your personal workspace.

We do not use third-party analytics, advertising or tracking technologies, and we do not build advertising or marketing profiles of you. The page views above stay in your workspace and are shown only as described.

3. How we use your data and our legal bases

Under the GDPR we must have a legal basis for each use. Ours are:

We do not send marketing email, we do not use your data for advertising, and we never use your content to train artificial intelligence models.

Smart suggestions and automations

Smart suggestions help with routine decisions in Projects and check the conditions of a workspace’s automations. They use a decision model (a machine-learning model trained with reinforcement learning from human feedback) run by our model provider. It answers by choosing among options we give it or by giving a yes/no probability; it does not write text. Smart suggestions are on in every workspace unless its owner turns them off in the workspace’s Projects settings (Smart suggestions). Only the workspace owner can change it; the change is recorded in the workspace’s audit log.

When they are on, we send our model provider the text needed at these moments only. Nothing scans your workspace in the background, but a request carries some context besides the item at hand, as listed here — including titles of existing issues:

• A new issue: its title and the plain text of its description (up to 2,000 characters); the names and descriptions of the team’s labels and active projects; the titles and short snippets of up to five similar open issues (to flag duplicates); and, to suggest an assignee, the titles of each teammate’s last three issues, with teammates listed by number rather than by name. The duplicate check also runs while someone writes a new issue: each time they pause, the draft’s title and up to 1,000 characters of its description are sent with up to five similar open issues.
• A new comment: its plain text (up to 1,000 characters) and the issue’s title, to notice when it says the work is done.
• A new issue that states a target (such as “Reach 1,000 sign-ups”), or when someone presses “Find the number automatically” on an issue: its title, and the names and current values of up to 12 live numbers of the workspace that its creator (or the person who pressed the button) may see, never numbers from Mail — to link the goal to the number that measures it.
• “Goals from a document”, only when someone runs it: the document’s title and up to 40 of its lines (up to 200 characters each).
• The Triage button, when someone presses it: the issue’s title and description (up to 2,000 characters) and the names and descriptions of up to 12 of the team’s labels.
• A record another app sends (through the ecosystem API or a connector), and a new or renamed issue in a workspace that keeps such records: its title, type, status and up to 10 of its properties — never a property that names a person, and with email addresses and phone numbers masked — and the same for up to five issues, projects, pages or other apps’ records that share a reference (such as an order or invoice number) or words of its title with it and that the app’s maker may see, to link the ones that are about the same thing.
• Connecting software (Settings → Apps & flows), when the person who made a connector opens it after it received a delivery, to suggest which field is the id, the title, the link and the status: the names of up to 120 of the delivery’s fields and up to 40 characters of each value, with email addresses, phone numbers and fields that name a person masked.
• Automations a workspace sets up with a “Run only if” condition: only the fields that automation lists — up to 12 properties of a Docs database row (up to 2,000 characters each; for a workspace rule, also the row’s page text, up to 4,000 characters), an issue’s fields, or a live number’s name and value. A field that names a person — an issue’s assignee, or a person, created-by, edited-by, email or phone column — is never sent, even when the automation lists it.

We do not send account ids, files, design files or mailboxes — though text people write or copy into an issue (an @mention, or the message, design comment or meeting an issue was made from) can itself contain a name or an email address. When the answer is confident, a new issue’s priority, label or project is filled in if still empty, a goal issue is linked to the number that measures it, two records the model is sure are about the same thing are linked (shown as “linked automatically”; anyone who can edit removes the link, and it is not made again), and a Docs database automation whose condition was checked runs; the change shows in the issue’s history (or on Home, under “Done automatically”) as made by “Automation”, and most such changes can be undone (text an automation wrote, and messages or webhooks it sent, cannot). Everything else is a suggestion a person accepts or ignores. Each workspace has an hourly and a daily limit on these requests.

What our model provider does with it. zvena’s founder agreed directly with our model provider that it collects only minimal data from us and does not use it to train AI models. We cannot promise that text sent for suggestions is deleted at once. If your workspace should not send text to a model provider, its owner can turn smart suggestions off: nothing is sent from then on, and an answer that arrives after it was turned off is discarded.

zvena AI, the assistant

zvena AI answers questions about a workspace and does work in it when someone asks: in a panel on every page, in the Docs editor, in Projects and in Design. It runs only when a person asks it something, with that person’s own access: it can read and change only what they could read and change themselves, and every change it makes is shown with Undo. It is on in a workspace unless its owner turns it off (Settings → zvena AI).

When someone asks, we send the AI model they chose (through OpenRouter, see below):

• their question and the earlier messages of the same chat;
• the title of what they have open (a page, an issue, a project or a design file) and any text or design layers they selected;
• what the assistant reads to answer: search results, the pages, issues and projects it opens, what an item is linked with (including other apps’ records and the links zvena suggests) and the names of the apps connected to the workspace — only those the person can open, never anyone’s mail;
• in the Docs editor, the selected text or the page being written; in Design, the names and text of the selected layers.

We send requests through OpenRouter, which forwards them to the provider of the chosen model (such as Anthropic, OpenAI or Google), and we ask it to use only providers that do not collect data from requests or use it to train their models. We never use your content to train AI models ourselves. Chats are stored in zvena so you can come back to them; each person sees only their own, and a workspace owner sees only how many requests and credits each member used, never what they asked. The assistant’s answers can be wrong: check what matters.

4. Cookies

We use only cookies and browser storage that are strictly necessary: to keep you signed in, remember your language and open workspace, and keep guest files yours. The Android and desktop apps keep the same sign-in cookie in their own storage on your device. When Google sign-in is turned on, Google’s sign-in script on the sign-in page may set its own cookie to remember that you closed the Google prompt. Details are in our Cookie Policy.

Embeds and images from other sites. When a page shows an embed someone added (such as a video or a map) or a picture linked from another site, your browser loads it from that site, which sees your IP address and may set its own cookies under its own policy.

5. Sharing and service providers

We do not sell personal information and we do not share it for cross-context behavioral advertising. We disclose personal data only:

• To the people you work with. Members of a workspace see its content and each other’s names. Pages you publish with a public link are visible to anyone who has the link. Calendars are visible to the members you share them with, at the level you choose (free/busy, details, or editing); a workspace’s owners see its audit log. Your mail is visible only to you.
• To services you connect or point us to. Our server talks to your mail server, CalDAV server and subscribed calendars; to your organization’s identity provider and directory; to web addresses you set for webhooks of the API or of an automation; to pages you clip or whose links you paste (for a preview); and to remote images in your mail, which our server fetches so the sender never sees you. What they receive is what you asked us to send them.
• To workspaces you bridge with. A workspace’s owner may open a bridge with another organization’s workspace (its owner accepts) and choose projects to show it: those projects’ issue titles, keys, statuses, priorities, due dates and project names appear there for its members — never people, descriptions or comments. Either owner can close the bridge at any time, and what was shown is removed at once.
• To apps you allow. An app or AI assistant you allow into a workspace (with an integration’s secret, or by signing in to zvena and allowing it, such as Claude or ChatGPT through MCP) reads and changes what the scopes and products you chose let it, as you, never more than you can see; it handles that data under its own terms. You can turn it off at any time in Settings → Developers (under Advanced).
• To service providers that process data on our behalf under their terms and our arrangements with them (listed below).
• For legal reasons: to comply with a valid legal request, to protect the rights, safety or property of our users, the public or us, or to investigate abuse. Where allowed, we tell you before disclosing your data.
• If the Service passes to another organization, in which case this policy continues to apply to your data and we will tell you in advance.

Service providers (subprocessors)

Google and GitHub also act as independent controllers for the accounts you hold with them; their own privacy policies apply to that relationship, as do your mail provider’s and your organization’s for the services you connect. The same goes for the messengers you connect, for the app store you install from, and for a UnifiedPush distributor you choose on Android (such as ntfy): it delivers encrypted notifications under its own terms. We will update this list before adding a new provider that processes your personal data.

Maps. Map pictures and address search in Docs come from OpenStreetMap. Our server asks for them, so OpenStreetMap never sees your IP address; an address you search for is sent as typed.

6. International transfers

zvena’s servers are located in the United States (Dallas, Texas), and our company is in Singapore: if you use zvena from the EEA, the UK or Switzerland, your personal data is processed in the United States and Singapore. Some of the providers above are based in, or may access data from, the United States and other countries. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, or on the European Commission’s Standard Contractual Clauses where the provider offers them. Our model provider processes in the USA only the text smart suggestions need; the safeguards above do not cover it (our arrangement with it is described in Smart suggestions and automations), so a workspace that needs them should keep smart suggestions off. You can ask us about the safeguards for any provider at support@zvena.app.

7. How long we keep data

We may keep specific data longer when the law requires it or to establish, exercise or defend legal claims.

8. Your rights

Depending on where you live, you have some or all of these rights:

• Access — get a copy of your personal data;
• Portability — receive your data in a machine-readable format;
• Correction — fix inaccurate data;
• Deletion — have your data erased;
• Restriction and objection — limit or object to processing based on our legitimate interests;
• Withdraw consent where we rely on it (we generally do not);
• Complain to a data protection authority, for example in the EU country where you live or work, or the UK Information Commissioner’s Office.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

9. Notice for US residents

Residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to receive a portable copy; and not to be discriminated against for exercising these rights.

• Categories we collect: identifiers (name, email address, account ids), internet activity limited to security and access logs, the content you create, and — only if you connect them — your mail, calendars and the sign-in details of those accounts. Sources and purposes are described in sections 2 and 3. Retention is in section 7.
• Disclosures for a business purpose: to the service providers in section 5, for hosting, security, email delivery (including calendar invitations and booking letters), delivering encrypted push notifications, sign-in and smart suggestions.
• We do not sell or share personal information, including for cross-context behavioral (targeted) advertising, and have not done so in the past 12 months. The contents of your mail and the passwords of accounts you connect are sensitive personal information; we use them only to provide the Mail and Calendar features you asked for, which is why there is nothing to limit. We do not knowingly sell or share data of people under 16.
• Authorized agents may submit a request on your behalf with your signed permission; we may ask you to confirm your identity directly.
• Appeals. If we decline your request, you can appeal by replying to our decision or writing to support@zvena.app with the subject “Privacy appeal”. We answer appeals within the time the law requires. If you disagree with the outcome, you may contact your state Attorney General.

10. How to exercise your rights

• Download your data: Settings → “Download all my data” gives you a ZIP archive with the documents (JSON and Markdown) of workspaces you own or edit, your Projects issues with saved views (JSON and CSV), your calendars (JSON and .ics), goals and rules, uploaded files, designs (.penpot files), your security log and account data; its export report lists what is left out. A workspace owner can turn off downloading that workspace’s content for its other members. Mail is not in the archive, since the originals stay on your mail server; version history, passwords and connection secrets are not in it either. The archive includes the guests of your events (names, email addresses and answers), as your calendar shows them.
• Correct your name: Settings → Profile.
• See where you are signed in: Settings → Account → Devices lists your devices; sign any of them out there, or have an app erase what it keeps.
• Delete your account: Settings → “Delete account” deletes the account and its data immediately, including copies of your mail and the passwords of connected accounts (designs leave the trash within 30 days; backups as described in section 7). Nothing on your mail server changes.
• Anything else: write to support@zvena.app. We will verify the request comes from the account holder (usually by replying from the email address on the account) and respond within one month (GDPR) or 45 days (US state laws). We may extend this when the law allows, and will tell you if we do.

Exercising your rights is free.

11. Children

zvena is not directed to children under 13, and we do not knowingly collect personal data from them. In the EEA and the UK, people under 16 (or the lower age set by local law) may use zvena only with the consent of a parent or guardian. If you believe a child has given us personal data, contact support@zvena.app and we will delete it.

12. Security

We protect data with encryption in transit (HTTPS everywhere), sign-in without passwords, hashed session tokens, encrypted passwords for the mailboxes and calendars you connect, end-to-end encrypted push notifications, strict browser security policies that stop zvena’s own scripts from sending data to other sites, access controls on servers, encrypted backups, and rate limits against abuse. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

13. Changes to this policy

When we change this policy we update the effective date above. If the change is material, we tell you in advance by email or in the Service, and you will be asked to review the updated documents the next time you use zvena.

14. Contact us

If you are in the EEA or the UK and the law requires us to appoint a representative there, their contact details will be listed here. You can also reach us at support@zvena.app for anything else.