Privacy Policy

Last updated: July 2, 2026

    ZONA is designed with privacy as a core principle. All reports are anonymous. We never share your location with other users. Your phone number is never publicly visible.
  

1. Data controller

Aleix Molas
Email: hola@joinzona.com
Application: ZONA — Citizen Safety
Bundle ID: com.joinzona.app

2. What data we collect and why

Data	Purpose	Legal basis
Phone number (verified via OTP)	Verify you are a real person and prevent spam. Never visible to other users.	Legitimate interest (Art. 6.1.f GDPR)
Location (only while using the app)	Show you nearby incidents and send alerts within your configured radius.	Consent (Art. 6.1.a GDPR)
Report content (type, location, time)	Display incidents on the map. No identification of the author.	Legitimate interest (Art. 6.1.f GDPR)
Push notification token	Send you alerts about incidents near you based on your settings.	Consent (Art. 6.1.a GDPR)
App preferences (radius, language, SOS contacts)	Personalization. Stored on your device and in Firebase, tied to your anonymous ID.	Performance of a contract (Art. 6.1.b GDPR)
Questions to the AI assistant	The question and answer are stored to improve the assistant — with no user identifier at all, not even your anonymous ID. We cannot tell who asked a given question.	Legitimate interest (Art. 6.1.f GDPR)

3. Data we do NOT collect

Real name or surname
Email address
Photos or videos
Physical descriptions of people
Continuous location history (only used at the moment of the query)
Payment data (the app is free)

4. Anonymity of reports

When you report an incident, other users see the type, approximate location, and time — never who reported it. Internally we store an anonymous Firebase ID linked to the report to detect and block abuse. This ID cannot be reversed to your phone number by third parties.

5. Who we share your data with

We do not sell or rent your data. We share it exclusively with:

Google Firebase (Firestore, Auth, FCM) — data storage and infrastructure. Servers in Europe (Belgium / Netherlands). Google's privacy policy.
Twilio — phone number verification via SMS OTP. Twilio's privacy policy.
Google Maps Platform — map display. Your location is sent to Google to render the map if you have it enabled. Google's privacy policy.
Anthropic — the AI assistant inside the app. Your question is sent to Anthropic to generate the answer; we never send your phone number or any other identifying data. Anthropic's privacy policy.

6. International transfers

Google Firebase and Twilio have servers outside the EEA. These transfers are protected by the Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Art. 46 GDPR.

7. How long we keep your data

Incidents: automatically deleted after 48 hours.
Verified phone number: for as long as you keep your account active.
Push token: until you disable notifications or uninstall the app.
Full account: permanently deleted 30 days after you request deletion.
Questions to the AI assistant: automatically deleted after 30 days. Stored with no user identifier.

8. Your rights

Under GDPR and Spanish data protection law (LOPDGDD) you have the right to:

Access: know what data we hold about you.
Rectification: correct inaccurate data.
Erasure: delete your account and all your data ("right to be forgotten"). You can do this yourself anytime from the app, or see how at this page.
Portability: receive your data in a structured format.
Objection: object to processing based on legitimate interest.
Restriction: request that we suspend processing.

To exercise any of these rights, write to us at hola@joinzona.com. We will respond within 30 days.

You may also file a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

9. Cookies and similar technologies

The mobile app does not use cookies. The website joinzona.com uses only technical cookies necessary for the service worker (offline caching) to function. We do not use tracking or advertising cookies.

10. Minors

ZONA is not directed at children under 16. If you are under 16, please do not use the app. If you are a parent or guardian and believe your child has used the app, contact us at hola@joinzona.com.

11. Security

All data is transmitted encrypted via HTTPS/TLS. Firebase implements encryption at rest. We carry out periodic data access audits. No system is 100% secure — in the event of a security breach affecting your data, we will notify you within the legally required timeframe.

12. Changes to this policy

If we make substantial changes, we will notify you through the app at least 15 days in advance. Continued use of the app after the changes take effect implies acceptance of the new policy.

13. Contact

For any privacy-related questions:
hola@joinzona.com