Privacy Policy

Zavrah ("we," "us," or "our") is a social platform where you can chat, create servers, send DMs, express yourself with cosmetics, and more. We take your privacy seriously. This Privacy Policy explains what personal data we collect, how we use it, how long we keep it, and what rights you have over your information.

By using Zavrah, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use our services.

We collect the information you provide directly, data generated through your use of Zavrah, and some technical data necessary to operate the platform securely.

Account Information

• Username and display name
• Email address
• Password (hashed and encrypted)
• Profile avatar and bio (if you add one)

Messages & Content

• Text, images, videos, and files sent in DMs and servers
• Server names, descriptions, roles, and channel content
• Reactions, highlights, and social posts

This is user-generated content. We host it so you and others can access it, but we do not scan private messages for advertising purposes.

Device & Technical Data

• IP address
• Device type, operating system, and browser
• Approximate location (derived from IP, not GPS)
• Connection timestamps and session activity

Purchases & Payments

• Cosmetics, boosts, and other digital goods you purchase through Stripe
• Transaction IDs and payment confirmation tokens
• Creator payout details if you earn through our platform

We do not store full credit card numbers — Stripe handles payment data securely on our behalf.

We use your data to:

• Provide, operate, and improve Zavrah
• Authenticate you and keep your account secure
• Enable messaging, server hosting, and social features
• Process purchases, refunds, and creator payouts
• Enforce our Terms of Service and combat abuse
• Respond to support requests and legal obligations
• Send you service-related notifications (not marketing, unless you opt in)

We do not sell your personal data. We do not use your private messages or server content to train AI models or for targeted advertising.

• Account data: retained while your account is active. If you delete your account, most data is permanently removed within 30 days, except where we must retain it for legal or security purposes.
• Messages and server content: retained as long as the relevant server or DM exists. Deleting a message or leaving a server may not erase it from our backups immediately, but it becomes inaccessible to users.
• Transaction records: retained for at least 7 years to comply with tax and financial regulations.
• IP addresses and logs: retained for up to 90 days for security and abuse prevention, then aggregated or deleted.

We use industry-standard measures to protect your data, including:

• TLS/SSL encryption for all data in transit
• Encrypted storage for sensitive data at rest
• Row-level security (RLS) policies on our database
• Rate limiting and server-side abuse prevention
• Regular security audits and dependency vulnerability scanning
• Strict access controls — only authorized staff can access production data, and only when necessary

No system is 100% secure. If we become aware of a data breach that affects your personal information, we will notify you as required by law.

We rely on trusted providers to operate Zavrah. These third parties process data on our behalf and are contractually bound to protect it:

• Stripe — processes payments and payouts. See Stripe's Privacy Policy.
• Supabase — hosts our database, authentication, and file storage. See Supabase's Privacy Policy.
• Cloudflare — provides DDoS protection and caching services. See Cloudflare's Privacy Policy.

We use cookies and similar technologies to keep you logged in, remember your preferences, and protect against abuse.

• Essential cookies — required for authentication and security. Cannot be disabled.
• Preference cookies — remember settings like theme or language.
• Analytics cookies — help us understand how Zavrah is used (see Section 8).

We also use localStorage in your browser to store your active session token and UI preferences (such as theme and sidebar state). This data is stored locally on your device, never shared with third parties, and is removed when you log out or clear your browser data.

You can manage cookie preferences through your browser settings. Disabling essential cookies will break login and security features.

We use privacy-focused analytics to understand how Zavrah is used and to improve the platform. This data is aggregated and anonymized where possible.

We do not use analytics to track you across the web, build advertising profiles, or sell behavioral data.

Zavrah is not intended for children under 13. We do not knowingly collect personal data from anyone under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at legal@zavrah.com so we can remove it.

Depending on where you live, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to fix inaccurate or incomplete data
• Deletion — request that we delete your personal data
• Portability — receive your data in a portable format
• Objection — object to certain processing of your data
• Restriction — ask us to limit how we use your data

To exercise any of these rights, email us at legal@zavrah.com. We will respond within 30 days. We may need to verify your identity before processing your request.

You can delete your Zavrah account at any time from your account settings. When you delete your account:

• Your profile, username, avatar, and bio are permanently removed
• Your messages and content may remain in servers and DMs if other users are still active in those conversations
• Server content you created may remain if others still use those servers
• Transaction and payout records are retained for legal compliance

If you want us to delete specific content without deleting your whole account, contact legal@zavrah.com.

We use third-party service providers to operate Zavrah, including: cloud hosting and database infrastructure, content delivery network, email delivery, payment processing, real-time voice/video infrastructure, and AI model providers. These providers process data on our behalf under contractual data protection obligations.

A full list of sub-processors is available on request at privacy@zavrah.com.

If you have questions, concerns, or requests about this Privacy Policy or how we handle your data, contact us at:

Email: legal@zavrah.com

DMCA / Copyright: dmca@zavrah.com

Support: support@zavrah.com

We aim to respond to all privacy-related inquiries within 30 days. For urgent security matters, please include "SECURITY" in your subject line.