ZELUNO Privacy Policy
Effective date: 15 October 2026
Controller: Wise I.N.C, ilyamudry21@gmail.com
1. What we process
| Data | Why | Where it is kept |
|---|---|---|
| Text you type or paste to translate | To translate it, explain its meaning and translate it back | Sent to our server and to the AI model only for the duration of the request. We do not store it on our server |
| Photos you take or choose to translate | To recognise the text in them and translate it | Sent in compressed form only for the duration of the request. Not stored on our server |
| PDF, Word (DOCX) and TXT documents you choose to translate | To translate them and explain what is being asked of you | Sent to our server only for the duration of the request. The AI model receives only the first pages of a long PDF or the beginning of a long text. Not stored on our server |
| Your speech while you hold the microphone | To turn it into text | Recognised by your device's system service (Apple / Google). Only the recognised text reaches our server |
| A device identifier (on iOS kept in the Keychain, so it survives a reinstall; on Android, ANDROID_ID) and an Apple App Attest / Google Play Integrity check that the request comes from the genuine app | So the free allowance can't be renewed by reinstalling and our server isn't used outside the app | Our server keeps only a one-way hash of the identifier and a daily request counter, for up to 2 days. The check is verified and not stored |
| An anonymous Firebase ID that every installation gets | To limit the number of free translations per day and tie a Pro subscription to the installation | In Firebase Authentication and in our Cloud Firestore database (EU, Belgium): the ID and a daily request counter. Not linked to your identity |
| Your account, if you create one: email, name (if you give one), password as a hash | To sign in on several devices and sync history, dictionary and glossary | In Firebase Authentication. Deleted with Settings → Delete account |
| Usage events: which features were opened, whether a translation succeeded, error codes, translation languages and style, device model, OS and app version, device language and time zone | To understand which features are needed and where the app breaks | In PostHog (EU servers) under a random analytics ID. Texts, photos and speech are never included. IP addresses are not stored and are not used to determine location. Can be turned off in Settings → Share usage data |
| Whether and when you bought ZELUNO Pro (plan, dates, status). We never receive payment details | To turn Pro on and restore a purchase on a new device | In RevenueCat under your Firebase ID (anonymous or your account's) |
| A blogger's referral code, if you entered one at sign-up, and when | To pay the blogger a share of your subscription payments. The blogger sees only counts and amounts, never emails or names | In Cloud Firestore (EU) next to the account id. Deleted with the account |
| Crash reports: error stack, device model, OS and app version, recent technical events (screens, network requests without their content) | To find and fix crashes | In Sentry (EU servers). No IP address, screenshots or translated text. Turned off by the same Share usage data switch |
| Android only, for offline translation: device manufacturer and model, OS version, app version, technical metrics (latency), ML Kit installation ID, selected and detected languages | This is how Google ML Kit, the library that translates without internet, works | Sent to Google over HTTPS. The text you translate offline never leaves the device |
| Dietary profile: allergens, what you don't eat, diet (if you set it) | To flag the dishes on a photo of a menu that aren't for you | Kept on your device. Sent to our server and to the AI model only together with a photo of a menu or a document, for the duration of the request. Not stored on our server and not linked to your identity |
| Personal glossary: words and how to translate them | To translate your own terms your way | Kept on your device. The rules whose words occur in a text are sent with it for the duration of the request. If you are signed in to an account, a copy of the glossary is kept in Cloud Firestore (EU) for sync |
| Translation history, favourites and dictionary | So you can come back to them | On your device. If you are signed in to an account, a copy is kept in Cloud Firestore (EU) to sync between devices. Deleted with Settings → Clear history, with your account, or with the app (without an account) |
Without an account we do not collect your name or email; with one, only the email and the name you gave. We do not collect your phone number, location, contacts or advertising ID. We do not sell data or use it for advertising.
AI translation (Google Gemini) and your consent
Translations, explanations, back-translation, the dictionary, reading text in photos and analysing documents are performed by the Gemini AI model of Google LLC (Gemini API). Before the first translation the app shows a "Translation with AI" screen that says what data is sent and to whom, and nothing is sent until you tap "Allow and continue".
- What is sent to Google: text you type, paste or dictate (speech as recognised text, never an audio recording); photos and documents (PDF, Word, TXT) you choose to translate; your languages and translation style; glossary words found in the text; dietary preferences — only together with a photo of a menu or a document. From Apple Watch — only the dictated text and the languages.
- How: only at the moment you start a translation yourself, through our server (Cloud Functions, EU) over HTTPS.
- Why: only to perform that request and show you the result. We do not use this data for advertising, profiling or training models.
- What is not sent: your name, email, password, contacts, location, advertising identifier or translation history.
- Protection: Google processes the data as a processor under the Gemini API terms and the data processing terms, with protection equal to or greater than described in this policy: on paid access Google does not train models on it and keeps it for a limited time only to detect abuse. Our server does not store the content of requests.
- Saying no and withdrawing: you can tap "Not now" — then only offline translation with language packs downloaded to the device works, and nothing is sent to Google. The consent screen appears again on any AI action, so you can give consent at any time; to withdraw it, delete the app or its data and the question is asked again. You can also write to us at the address below.
2. Who else receives data
- Google (Gemini API) — Gemini models perform translation and analyse text, images and documents. We use paid API access: under the Gemini API terms Google does not use this data to train or improve its products and keeps it for a limited time only to detect abuse.
- Google (Firebase) — sign-in (Firebase Authentication), the Cloud Firestore database and our server on Cloud Functions. Firestore and Cloud Functions run in the EU (Belgium, europe-west1); Firebase Authentication keeps sign-in data in Google data centres, including in the US. Firebase data processing terms
- Google (Firebase Analytics) — anonymous usage statistics: the same events as PostHog, without translation text and without an advertising identifier (IDFA / Advertising ID are not collected, ad personalisation is off). Turned off with the Share usage data switch. Privacy and security in Firebase
- PostHog Inc. — anonymous usage analytics, stored in the EU (Frankfurt). Receives only the events listed above, never the content of translations. PostHog DPA
- RevenueCat, Inc. — verifies and stores the subscription status. RevenueCat privacy policy
- Functional Software, Inc. (Sentry) — crash reports, stored in the EU. Sentry DPA
- Google LLC (ML Kit) — offline translation and language detection on Android. Receives only the technical data listed above, never the translated text; according to Google, it does not share it with third parties. Language packs are downloaded from Google's servers. ML Kit data disclosure
- Apple / Google — system speech recognition, text-to-speech and offline translation on iOS (Apple Translation) on the device, under their own policies.
3. Retention
- Texts and images are not kept on our server after the response.
- The request counter — up to 2 days (deleted automatically).
- Your account and synced history, dictionary and glossary — until you delete the account.
- Analytics events — up to 12 months.
- Crash reports — up to 90 days.
- History on your device — until you delete it.
4. Your rights
You can delete your history in the app, delete your account with all synced data (Settings → Delete account), turn off usage data and crash reports (Settings → Share usage data), revoke camera, photo and microphone access in your system settings, and email us at ilyamudry21@gmail.com with any question about your data.
5. Children
The app is not intended for children under 16, and we do not knowingly collect their data.
6. Changes
We will tell you about material changes in the app. The date of the latest revision is shown above.
7. Contact
ilyamudry21@gmail.com