1. Who operates Zween
Zween is operated by Brahim El Wafi, an individual developer based in Morocco. Zween is the name of the app; “Zween Team” is a contact name, not a registered company.
Privacy questions and requests: zweenteam@gmail.com.
2. Information we collect
Zween and the services used to provide it process the following categories of information, depending on the features you use.
Account and profile information
Firebase Authentication processes account identifiers and sign-in information. Depending on your sign-in method, this may include email address, identity-provider ID, display name and profile image URL. Zween stores profile information such as display name, selected avatar or gender presentation, pairing code, scores, account identifiers and relevant timestamps. Private account profiles are separated from minimal partner/pairing projections.
Pairing and relationship information
Pairing records and couple workspaces can contain the participating account IDs, names used in requests, relationship-related settings, pairing status, hearts, dates and timestamps.
Games, answers and history
Zween stores game invitations and sessions, player roles, turns, answers, drawings, scores, results and related timestamps. Daily Question records contain question IDs, submitted answer-option IDs, player roles, and reveal and progress state. The partners share the relevant session or couple information needed for the feature.
Memory Book, photos, drawings and shared interaction
Memory Book entries may include personal text, dates, stickers, photos, and editor identifiers. Shared drawings and room interactions may be stored in Firebase Firestore or Realtime Database. Photos may be uploaded through the authenticated Zween media service on Cloudflare and stored in the configured Supabase Storage bucket.
Notifications and device information
Firebase Cloud Messaging uses push-registration tokens to deliver notifications. Zween may retain registration tokens, platform details, message type, sender and recipient identifiers, and delivery-related timestamps.
Diagnostics and optional services
Firebase Crashlytics is used on supported native platforms and may process device and app diagnostics, crash reports, stack traces and logs. The audited V1 source did not initialize Firebase Analytics. RevenueCat-related code exists, but whether it processes production data depends on the release configuration. If enabled, purchase functionality may process account identifiers and purchase or entitlement data. Avatar generation may involve requests to DiceBear. Email verification may use the operator's Vercel-hosted OTP service.
3. How we use information
- To create and authenticate accounts, protect access and support account recovery.
- To help partners connect, play games, compare answers and track progress.
- To save shared photos, Memory Book pages, drawings and other features you use.
- To send account, pairing, game and Daily Question notifications.
- To troubleshoot bugs, investigate security issues and maintain the service.
- To respond to support, privacy and account deletion requests.
Depending on the processing activity and applicable law, these activities may rely on necessity to provide the requested service, legitimate interests in security and maintaining the service, consent where required, or compliance with legal obligations. The exact legal-basis mapping for production processing must be confirmed before final publication.
5. Service providers
Zween uses third-party infrastructure to provide its functions. Providers may process data on Zween's instructions or for their own independently stated purposes, depending on the service and contractual terms.
- Google Firebase: authentication, Firestore, Realtime Database, push messaging and crash diagnostics.
- Google and Apple: identity-provider services, when selected for sign-in.
- Cloudflare: authenticated Zween Media Worker and media traffic processing.
- Supabase: private storage for uploaded media routed through Zween's media service.
- Vercel: hosting for an email OTP or verification backend when that feature is used.
- DiceBear: externally generated avatar artwork when requested.
- RevenueCat: purchase management only if the production application enables this integration.
Provider participation, processing locations, service terms and international-transfer safeguards must be verified against the configuration actually used in the release. Zween does not claim that an unverified agreement or safeguard is in place.
6. Storage, security and international processing
At the time of the code audit, production Firestore was configured in Google's eur3 multi-region and Realtime Database in europe-west1. Other providers and their subprocessors may process data in other countries, according to their individual configurations and applicable agreements.
Zween uses account authentication, security rules, permission checks, authenticated media requests and scoped storage access intended to protect user information. No online service can guarantee absolute security. Reports of privacy or security concerns may be sent to zweenteam@gmail.com.
7. How long information is kept and how deletion works
Account information and shared feature records are ordinarily kept while needed to operate the account and requested features. Eligible shared content may be retained for the remaining partner after a couple ends, as described below. Backups, security logs, crash diagnostics, transaction records and records required by law may follow different retention schedules. The final policy must state or link to retention criteria and periods that accurately reflect the production services.
Where the released deletion workflow is operational, a user can request account deletion from Settings → Delete Account. It requires confirmation and recent reauthentication, then coordinates removal of relevant personal profile data, tokens, notifications, pairing references, active sessions and media. Identity deletion occurs last after required cleanup is secured. If required cleanup fails, the app should not falsely confirm complete deletion.
If one partner deletes their account, Zween is designed to preserve the other partner's independent account and an access-controlled, read-only archive of eligible shared Memory Book entries, drawings and completed game history. Departing-user identifiers are removed or anonymized where appropriate, and media that must not be retained is deleted. A departing user's rights regarding shared content can be raised through the privacy contact below.
Important: this description reflects the release implementation under verification. Before publication or release, the deployed service, deletion behavior, rules and any retention exceptions must be checked against this description.
8. Age eligibility
Zween V1 is intended for people aged 18 or older. The sign-up flow asks applicants to confirm that they are at least 18, without requiring their date of birth for that declaration. This is an account eligibility rule and is separate from a marketplace's content-based age rating. If you believe someone under 18 has created an account, contact zweenteam@gmail.com.
9. Your privacy rights
Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability or withdrawal of consent where applicable, and to complain to a relevant privacy authority. Contact zweenteam@gmail.com with your request. We may request only the additional details reasonably needed to verify that a request concerns your account. Requests will be handled within time limits required by applicable law.
10. Changes to this policy
We may update this policy when Zween's features, providers or applicable requirements change. Updates will be reflected by the “Last updated” date. Material changes will be communicated as required by applicable law.
11. Contact
Legal operator: Brahim El Wafi (individual developer)
Contact name: Zween Team
Email: zweenteam@gmail.com
Any additional postal contact address or EU/UK representative information that is required under applicable law must be determined and included before this notice is finalized.