Privacy Policy

This page explains, in plain words, what data Zotu (zotu.app and the app sites on its subdomains) processes, why, and what you can do about it. It is written to meet the EU General Data Protection Regulation (GDPR).

What we process

• Account data: your email address and a hash of your password, if you sign up.
• Your files that you keep in Zotu's cloud. We don't read them and never use them for analytics or advertising.
• Technical data: IP address, browser and device type, request times — to run and protect the service.
• Usage analytics from Google Analytics, only if you agree (see below).

Why, and on what legal basis

• To give you your account and your files — performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service working and secure — our legitimate interest (Art. 6(1)(f)).
• To understand which pages and features help people, with analytics cookies — your consent (Art. 6(1)(a)), which you can withdraw at any time.
• To answer your support requests — performance of a contract or our legitimate interest.

Cookies and Google Analytics

• hub_session — keeps you signed in. Strictly necessary.
• hub_consent — remembers your cookie choice. Strictly necessary.
• _ga, _ga_* — Google Analytics 4 (Google Ireland Limited / Google LLC). Set only after you click “Accept”; ad features are always off. Analytics sees which pages are opened, where visitors come from and the device type. On the desktop it never sees the names or contents of your files.

Change cookie settings

Who else receives data

We don't sell personal data. We share it only with providers we need to run the service — hosting, content delivery, and Google Analytics if you consent — and with authorities when the law requires it. Where data leaves the EU/EEA, it is protected by the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

Account data and files — as long as your account exists; they are deleted when you delete your account. Technical logs — only as long as needed to run and protect the service. Analytics data — as set in Google Analytics' retention settings.

Your rights

You can access, correct, delete or export your data, object to or restrict its processing, and withdraw consent at any time. Write to [email protected]; we reply within one month. You can also complain to your local data protection authority.

Changes

If this policy changes, the new version will appear on this page.

Last updated: October 18, 2026