Privacy policy

This policy says what Zoopy ("we", "us") collects when you use the Zoopy phone app, the Zoopy web app and this website, why we collect it, which companies handle it for us, and the choices you have. It applies in every country where you use Zoopy. Zoopy is run from Australia.

What we collect

How you sign in: your phone number (we text you a one-time code), or the account id that Apple or Google gives us when you choose "Sign in with Apple" or "Sign in with Google". Apple and Google may also pass us your name and an email address; with Apple you can hide your real address.
Name and email for receipts: when you buy a plan we ask for a name and an email address for your invoices.
Your hunts and settings: the searches you make (keywords, makes and models, price range, place and radius, the marketplaces you picked), your alert settings, the listings you saved and the sellers or places you chose to hide. This is the service: we use it to find listings and alert you.
Your home area: the suburb, town or city you choose, so we can show distances. If you tap "use my current location", your device's position at that moment is saved as your home point. We do not follow your location after that.
Push tokens: the address of your phone for notifications.
Alert history and diagnostics: which alerts were sent or held back and why, your app version, and crash reports from the phone app. Crash reports do not carry your account.
Your plan: which plan you have and when it ends, from the store you bought it in. We never see or store your card details.
Ask Zip: when you ask Zip, the in-app assistant, a question, we count the question against your daily limit. We do not keep the text of your question on our servers.
Invites: if you invite a friend or join with an invite code, we keep the code and who invited whom, so the reward reaches the right person.
The email list on this website: the email address you enter, your browser's time zone and the country your connection comes from, the page you joined from and, if you pick one, what you hunt for. We use them only to tell you when Zoopy is available to you. To stop abuse of the form we also keep a one-way hash of your IP address for about a week, never the address itself. Email us to be removed at any time.

Listings and sellers

Zoopy reads listings that online marketplaces show in public, without a login. We keep a listing's title, description, price, place, links to its photos and the seller details the marketplace shows in public with it: display name, seller id, profile link and picture, rating and the year the seller joined. We use this to match listings to hunts, to show price changes and to tell dealers from private sellers. We do not build profiles of sellers for any other purpose. If your listing is in Zoopy and you want it removed, email us.

What we don't do

We don't sell your personal information, and we don't share it for advertising.
We don't show third-party ads.
This website and the web app use no advertising or tracking cookies and no third-party analytics.
We don't access your accounts on any marketplace. Zoopy never asks for your Facebook login or any other marketplace password, and never posts or messages for you.

Companies that handle data for us

We send each company only what its job needs.

Supabase (database and sign-in; servers in Canada, behind Cloudflare's network): your account, hunts, matches, settings and the website's email list.
OVH (Canada) and IONOS (United States, a stand-by): the servers that run your hunts. They process your hunts, alert settings and push tokens.
Vercel (United States and its worldwide network): hosts this website and the web app. Like any web host it handles the IP address of each visit.
Google Firebase: Cloud Messaging delivers notifications (your push token and the alert's text: the listing's title, price, place and photo link, and the hunt's name). Crashlytics receives crash reports from the phone app.
Apple: delivers notifications to iPhones, runs "Sign in with Apple", and bills App Store subscriptions.
Google: runs "Sign in with Google" and bills Google Play subscriptions.
Twilio (United States): sends the text message with your sign-in code. It receives your phone number and the code.
RevenueCat (United States): keeps track of subscriptions. It receives your Zoopy account id and your purchase state, not your name or email. When payment on the web opens, Stripe will take those payments for us.
DeepSeek (China): answers the questions you ask Zip and drafts hunts for the AI hunt builder. Your question is sent with what Zip needs to answer it: your plan, time zone, alert settings, the name of your home area, your hunts and the listings you ask about. Never your name, phone number or email. The app asks for your permission before your first question, and nothing is sent if you say no. On iPhones with Apple Intelligence the hunt builder runs on the phone and sends nothing.
TypeSafe: a reading model we are testing. It reads a listing's title and description and tells us, for example, if the text mentions damage. With a listing we send the search words, makes, models and years of the hunt it matched. Never the hunt's name or owner, your place, your prices, or anything about your account. During the test its answers are only logged; they change no alert.
Network providers (Decodo, Webshare): carry our servers' encrypted requests to the marketplaces. They can see which marketplace site is contacted, not what is asked or whose hunt it is.
The marketplaces themselves: our servers send them searches made from hunts (the words, the area and the price range), never your account. When the app shows you a listing, its photos load straight from that marketplace's image servers, so that marketplace sees your device's IP address, as it would on its own site. When you tap through to a listing you are on that marketplace and its own policy applies.
OpenStreetMap, Photon (Komoot) and Nominatim: the map and the place search. Your device sends them the place name you type and loads map tiles from them. If you tap "use my current location" in the web app, your position is sent to them once to find the name of the place. Our servers also ask Nominatim and postcodes.io for the place name or postcode at the centre of a hunt.

Where your data goes

Your account data is stored in Canada. The companies above handle data in Canada, the United States and, for Ask Zip only, China. These countries may protect personal data differently from the country where you live. We keep what leaves our own systems as small as the job allows, and Ask Zip sends nothing until you agree.

Why we are allowed to use it

Where the law asks for a reason (for example in the European Union and the United Kingdom): we use your account, hunts, settings and purchase state to provide the service you signed up for (a contract); alert history, crash reports and abuse checks because we need them to keep Zoopy working and safe (our legitimate interest); and Ask Zip, the website's email list and your current location only with your consent, which you can take back at any time.

How long we keep it

Your account, hunts and settings: until you delete your account.
Matches you did not save: 90 days. Saved listings stay until you remove them or delete your account.
Alert history: 90 days. Price history of listings: 180 days.
Ask Zip counts: up to 90 days.
Billing events from the stores: up to 400 days.
Listings that matched no hunt: about 10 days.
The website's email list: until you ask us to remove you.

Deleting your account and getting a copy

You can delete your account at any time in the app under You → Account → Delete account, or by email (see delete your account). This permanently removes your profile, hunts, matches, saved listings, alert history, invites and push tokens. It does not cancel a store subscription; cancel that with Apple or Google first. Apple, Google and RevenueCat keep their own purchase records under their policies. To get a copy of your data, tap Export my data in the same place.

Your rights

Wherever you live, you can ask us for a copy of your personal information, ask us to correct or delete it, and take back a consent you gave. Depending on your country you may have more rights, for example:

European Union and United Kingdom (GDPR): to object to or restrict some uses, to move your data to another service, and to complain to your data protection authority.
Australia (Privacy Act): to complain to the Office of the Australian Information Commissioner.
Canada (PIPEDA and provincial laws): to complain to the Privacy Commissioner.
United States (state laws such as California's): to know what we collect and to ask us to delete it. We do not sell or share personal information as those laws define it.

Email us and we'll answer within 30 days. We will not treat you differently for using these rights.

Children

Zoopy is not for children under 16 and we do not knowingly collect their data.

Changes

If we change this policy we'll update this page and the date above. We announce changes that matter in the app.

Contact

Questions or requests: zoopy.ops@gmail.com