Zyvn
Legal information · ESOTECH LTD

Privacy Notice

Effective 24 October 2026 · Version 3.0.1

In this document
  1. 1. Scope and responsible organisation
  2. 2. The local and online boundary
  3. 3. Information kept on your device
  4. 4. Personalisation and assistant memory
  5. 5. Online models, web search and research
  6. 6. Microphone, dictation and realtime voice
  7. Live translation
  8. 7. Images, video, files and Photos
  9. 8. Device permissions and iPhone actions
  10. 9. HealthKit and sensitive information
  11. 10. Connectors, authorisation and external actions
  12. 11. Google account data, where available
  13. 12. Authorisation service and security records
  14. 13. Downloads, websites, support and store services
  15. 14. Purposes and lawful bases
  16. 15. Recipients and permitted disclosures
  17. 16. International processing
  18. 17. Retention and deletion
  19. 18. Your controls and security
  20. 19. Requests, verification and complaints
  21. 20. Regional rights
  22. 21. Children, automated decisions and tracking
  23. 22. Changes and how to contact us
  24. Translation, PDF questions and page summaries

1. Scope and responsible organisation

This Privacy Notice explains how ESOTECH LTD handles information in Zyvn, its related websites and optional integrations. Contact [email protected] for privacy questions or rights requests. Zyvn provides a cloud account and optional cloud generation alongside on-device models. Google-account, Outlook, Facebook and WhatsApp Business connectors are not included in this release. Independent model providers, connected services and app stores have their own processing responsibilities and notices.

2. The local and online boundary

Downloaded local models run inference on your device. Selecting a managed online model sends the prompt, relevant conversation context, instructions and necessary tool results through our service to its model providers. Enabled online search, remote tools, realtime voice and cloud media generation also send information needed for the task to their selected destination. Local inference does not make an enabled remote tool offline. Review the selected provider before submitting confidential information. HealthKit tool results are kept out of managed online model requests.

3. Information kept on your device

Zyvn stores local conversations, models, files and preferences on your device. To limit duplicate free allowances, the iOS app keeps a pseudonymous device identifier and an Apple App Attest key in non-synchronizing, device-only Keychain storage. The identifier incorporates an app-vendor device value and random data; we do not use an advertising identifier or collect your phone serial number. The service keeps a protected device identifier, device-verification records and monthly allowance ownership. These checks prevent ordinary account switching from multiplying free usage; they are not used for advertising or cross-app tracking. Minimal device and grant records can remain after account deletion to prevent repeat claims. Keychain data can survive app removal. Optional provider API keys and other app storage follow device protection and backup settings; general app storage is not a separate encrypted credential vault. Supported account tokens and remote MCP credentials use SecureStore. Remove saved credentials in the app and revoke them with the provider to end access.

4. Personalisation and assistant memory

If enabled, memory stores information you ask the assistant to remember and supported preferences extracted through the app’s memory feature. It is held locally and can influence later responses. You can review, correct or delete memories and turn the feature off in settings. Memory and custom instructions can be included in the context of an online request when relevant to the feature you choose. They are not a separate Zyvn advertising profile. Avoid storing passwords, financial credentials or sensitive information about others as assistant memory.

5. Online models, web search and research

Managed text generation is routed through OpenRouter to the selected upstream model provider. The request can include prompts, relevant conversation history, custom instructions and necessary tool results. Research may make several successive requests. Optional direct provider features use the provider you select. Providers also receive ordinary network information and may apply their own retention and safety policies. We do not promise zero retention or exclusion from training for every independent provider. We do not sell your prompts or use them to train general-purpose AI models.

6. Microphone, dictation and realtime voice

Microphone access is requested for voice features. Local dictation uses a downloaded speech model on your device. Managed realtime voice sends microphone audio and conversation context through Zyvn to OpenAI and receives generated audio and text. Sessions use your text allowance and have duration and input limits. Zyvn does not retain managed voice audio or transcripts on its application server; it keeps usage and session-status records. Temporary playback files may remain in app caches. Stop or close the session to end capture. Independent provider retention and safety policies apply. We do not use voiceprints or voice recordings for advertising.

Live translation

Live translation recognizes microphone audio locally using a downloaded speech model. Offline mode also translates text on this device using your selected local model. If you select OpenAI or Gemini translation, transcript text is sent directly to that provider under its own terms, privacy policy and API charges; this mode does not send microphone audio or your assistant memory. Session text is held in app memory, not automatically uploaded to Zyvn or saved to a transcript history. Copying or sharing creates a separate copy you control. Stop, close, or leave the app to stop microphone capture. Accuracy and delay depend on the language, model, device and environment.

7. Images, video, files and Photos

Camera, file and photo-selection features use content you deliberately capture or choose. Cloud image generation sends your prompt and selected references to the image provider used for the feature. Managed video generation uses Kling AI, provided by Kling AI Pte. Ltd., and sends your prompt, selected opening or ending images and generation options through our service. Optional direct-provider features use the provider you select. Providers may retain inputs and outputs or review them under their own policies; the Kling API privacy notice is at https://kling.ai/document-api/protocols/privacyPolicy. Generated files may be downloaded into app storage. Saving to Photos or sharing requires your action and applicable system permission. Do not submit another person’s image, voice or private document without appropriate authority.

8. Device permissions and iPhone actions

Optional phone actions are off until enabled. Depending on the feature, iOS may request microphone, camera, Photos, speech recognition, local-network, location, calendar, reminder, contact or HealthKit permissions. Location is requested while using the feature, not for continuous background tracking. Contact lookup returns matching records; calendar and reminder actions use the access and supported operations you authorise. Phone, Messages, Mail, Maps and external-app actions hand selected details to the relevant app. iOS may present a further confirmation. You can disable a connector in Zyvn and review or revoke system permissions in iOS Settings; these are separate controls.

9. HealthKit and sensitive information

The iPhone Health and Apple Fitness actions request read access to step counts or recent workout records for the requested on-device feature. They do not write HealthKit data, run background health collection or use health data for advertising, data brokerage or marketing profiles. The released health tools are designed to present their results locally rather than send HealthKit records to an online model or remote connector. If you manually copy health or other sensitive information into an online prompt or share it outside Zyvn, that separate action sends it to your chosen destination. Location, contacts, mail and calendar data can also be sensitive; enable only the features you need and review information before sharing.

10. Connectors, authorisation and external actions

You choose which services to connect and which permissions to grant. A connector can receive the tool request and data necessary for its operation and return records or generated results to the app. Depending on its capabilities, it may read, create, change or delete data. Results can enter the assistant’s conversation context and, for a later online request, be sent to the selected provider. Approval settings, including Always allow, control repeated in-app confirmations but do not replace operating-system or provider authorisation. Removing a connection stops future use through that saved connection; it does not erase actions or provider copies already created.

11. Google account data, where available

Google-account content connectors are not available in this release. Optional Google sign-in requests basic identity information for authentication, not access to Gmail, Drive, Calendar or Contacts. Optional Gemini generation or search is a separate, explicitly selected provider feature and transmits the task information needed to Google. Enabling sign-in does not enable access to Google account content.

12. Authorisation service and security records

Auth0 manages account authentication; we do not receive or store your account password. Our application service processes a verified account identifier, basic profile information, usage and entitlement records, and task state. AWS hosts the service in the United States; a Supabase PostgreSQL database stores application records. Task inputs and results stored by the service are encrypted. Operational logs are limited to information needed to maintain and secure the service, such as request status and timing; credentials and prompt bodies are excluded. Do not include secrets in prompts. Optional purchases, when configured, use Apple and RevenueCat for transaction and entitlement processing.

13. Downloads, websites, support and store services

Model downloads contact hosts such as Hugging Face or ModelScope, which receive your network address and requested file. Opening a link contacts its destination. Our public website and authorisation endpoint are delivered through hosting, DNS and security providers, which process connection information needed to serve and protect them. We do not add advertising pixels or cross-site behavioural tracking to these public pages. If you email support, we receive your email address, message and attachments; send only information needed for the issue and redact credentials or unrelated private content. Apple independently handles App Store transactions, store analytics and system diagnostics according to its policies and your device choices.

14. Purposes and lawful bases

Where a legal basis is required, processing necessary to provide requested app features and respond to service enquiries relies on performance of our contract with you or steps you request before a contract. Optional permissions, connected-account access and optional online processing rely on consent where required; a system permission alone does not replace any additional legal consent required for sensitive data. Where applicable, explicit consent is required before processing special-category health information. Minimal fraud-prevention, authorisation-security and incident records rely on our legitimate interests in protecting the service, subject to necessity, proportionality and balancing against your rights. Legal recordkeeping or responding to binding lawful requests may rely on legal obligations. We do not treat agreeing to the Terms as consent to unrelated processing.

15. Recipients and permitted disclosures

Recipients include the model or connected service selected for your task and processors supporting authentication, hosting, database storage, security and support, including Auth0 for authentication, AWS and Supabase for hosting and storage, OpenRouter and the selected upstream providers for text generation, OpenAI for supported image or voice features, DeepL for managed translation, and Kling AI for managed video generation. Apple processes App Store purchases; RevenueCat supports purchase entitlements. The public website uses Cloudflare. Providers may act independently for their account, billing and safety operations. We do not centrally sync your entire local chat history, but selected online task content can be processed and temporarily retained by our service. We do not sell personal information or share it for cross-context behavioural advertising. Necessary legal disclosures remain subject to applicable safeguards.

16. International processing

Online services may process information outside your country. Our application service is hosted on AWS in the United States. Managed video uses Kling’s international service. Processing can involve Singapore and other countries under the provider’s policy; we do not promise that all copies remain in one country. Other providers explain their processing locations and transfers in their own notices. Where we are responsible for a restricted international transfer, we must use the safeguards required by applicable law, such as an applicable adequacy decision or approved contractual safeguards and supplementary measures where necessary. Contact us for information about safeguards relevant to processing under our control.

17. Retention and deletion

Local chats, memories, models and files remain until you delete them or device cleanup applies; backups and Keychain entries may persist separately. On the managed service, successful completed or confirmed rejected tasks clear their queued input payload. Unsent queued tasks expire after 24 hours. Successful encrypted task results are scheduled for deletion after seven days. Uncertain upstream outcomes may require reconciliation before input cleanup. Account, usage, billing and idempotency records have separate operational, fraud-prevention and legal retention requirements; we do not represent that all records disappear when a chat is removed. Request account deletion in Account & plan, or contact [email protected] for rights requests. Account deletion does not cancel an App Store subscription; manage cancellation in App Store settings. Independent providers retain their own copies under their policies.

18. Your controls and security

You can delete chats, models and memories; change custom instructions; remove saved keys; disconnect supported services; disable tools; and revoke iOS or provider permissions. Deleting a local chat does not delete an email, Notion page or other external item created by a tool. Revoking access does not necessarily delete copies already held by a provider. Use provider controls where appropriate. We apply proportionate access controls, protected transport and data-minimisation measures to processing under our control. General app storage, account compromise, device backups and independent services still create risks. No security method is absolute. If a personal-data breach under our responsibility meets a notification threshold, we will notify the relevant authority and affected people as required by law.

19. Requests, verification and complaints

Depending on the applicable law, you may request access, correction, deletion, portability, restriction, withdrawal of consent or objection to relevant processing. Contact [email protected] and describe the information and right involved; do not send passwords or full identity documents unless a proportionate, secure verification step is specifically necessary. We may need limited information to verify identity or authority, respond within the applicable statutory period and explain lawful exceptions or extensions. We cannot retrieve data held only on your device or promise deletion from an independent provider; we will explain the appropriate controls or destination. You may complain to your competent data-protection authority without first obtaining our permission.

20. Regional rights

Where EEA or UK data-protection law applies, rights include access, rectification, erasure, restriction, portability, withdrawal of consent and objection, including objection to processing based on legitimate interests; you may complain to your local supervisory authority or the UK ICO. Where California law applies to us and your information, rights can include knowing/accessing, correcting and deleting covered information, limiting certain sensitive-information uses, opting out of sale or sharing and requesting review through an authorised agent. We do not sell information or share it for cross-context behavioural advertising and do not penalise a lawful privacy request. Other US state laws may provide an appeal right. Where Australian privacy law applies, you may seek access and correction and complain to us or the OAIC. Other jurisdictions may provide comparable or additional rights, including rules for sensitive data and overseas transfers. These descriptions do not reduce any mandatory protection or assert that every regional statute applies in every case.

21. Children, automated decisions and tracking

Zyvn is not directed to children under 13, and independent use requires the eligibility described in the Terms. We do not knowingly seek children’s personal information for our server services; contact us if you believe it was improperly provided. Zyvn generates responses and may execute tools under your instructions; we do not use it to make solely automated decisions on our own behalf about your eligibility for credit, employment, insurance or comparable legal benefits. We do not use app data for targeted advertising or cross-app tracking. Provider cookies and processing on external authorisation pages are governed by their separate notices and choices.

22. Changes and how to contact us

The current notice is available in the app and at https://www.pumliai.com/zyvn/privacy; Terms of Use are at https://www.pumliai.com/zyvn/terms. We will update the date when this notice changes, explain material changes and obtain a new consent where required before introducing materially different processing. A new feature does not automatically authorise access to an unconnected account. For privacy enquiries, requests or complaints contact ESOTECH LTD at [email protected]. Please identify Zyvn in the subject so the request can be routed correctly.

Translation, PDF questions and page summaries

Managed Translation sends the text and language choices you submit through Zyvn to DeepL. PDF questions extract text on your device, using on-device recognition for supported scanned pages, then send the extracted text, question and relevant document conversation through Zyvn and OpenRouter to the text model. Web summaries send the readable page text and URL after you tap Summarize. These features use your text allowance. Encrypted task inputs and results follow the task retention periods below; providers have their own processing policies.