What this app collects

Written for the actual person running this server, not a lawyer. If you deploy this for other people, you're responsible for what you tell them.

Stored on the account you create

  • Email address and a bcrypt hash of your password (never the password itself)
  • Date of birth, used to check you're old enough for an account (13+) and old enough for social features (18+) — see the ID verification note below for how this can go from self-reported to actually verified. If you turn on "show how long I've been alive" in settings (off by default), the app computes your age in years and days from this and shows it only to you on your own time dashboard — the date of birth itself never leaves the server, only that computed number
  • Optional display name, avatar image, age range, work type, and hobby — all optional, all private to you, never shown to anyone else. Separate from the personal card described below.

Your activity

  • Logged time sessions: what you did, how long, energy, mood, and an optional 1–5 rating
  • Calendar events you add manually, including an optional location if you choose to add one. By default the location stays on this server and is used only to build "open in Waze/Maps" links — opening those apps sends them nothing from here. The one exception: tapping "when do I have to leave?" on an event sends that address out to be measured — see the travel note in the third-party section below
  • Your settings and consent choices
  • Your device's timezone offset (a single number like "UTC+3", refreshed each time the app opens) — stored so server-sent reminders like "time to leave" and the school attendance alert can fire at your real local minute
  • The school world (🏫), if you use it: a parent-child link exists only when the child makes a code and an adult redeems it — both sides see each other's names from then on. A linked parent sees the child's feature requests (to approve or not) and gets an alert when a school lesson on the child's own timetable starts with no "I'm in class" tap — the parent sees that a lesson was missed and which one, never anything else from the child's account (not entries, not chats, not the rest of the calendar). Child profiles a parent adds for younger kids (a name and birth year, stored under the parent's own account) exist to create routine reminders on the parent's calendar and are visible to no one else. Zip is told the member's age bracket (teen or adult, never the birth date) so she answers age-appropriately

What becomes visible to others, and only if you choose it

  • Marking an entry to "share to world" puts its text, minutes, and rough time-of-day on the public feed — with no name, email, or account link attached
  • Turning on "open to connect" shows an anonymous, rotating time-based label to other users for that time segment, along with your social preference if you've also opted into match tags
  • Chat messages you post are visible to everyone in that time segment's room, tagged with the same anonymous time-based label, not your name — the same is true of interest rooms (chat grouped by topic instead of time of day)
  • Chat groups you create or join: a public group is visible to any eligible adult on this app; a friends group is visible only to people you've added who are already your accepted friends. Messages use the same anonymous time-based label as everywhere else. Unlike time-segment and interest rooms, group messages don't auto-expire after 24 hours — a group is meant to be a space you return to
  • Family titles, if your family group uses them: the word you pick for another member (father, mother, sister…) is stored with the group. The person you label can see the word you chose for them, and everyone's words together sort the group's family tree into generations — no names are revealed by this, each member's tree is drawn in their own words. A title is deletable at any time and dies with the group or the account
  • The paper drawer (🗂️ Documents), if you use it: scans and PDFs you file — bills, licenses, contracts — are stored on this server's own disk under your account, in folders you name. Files are served back only to your logged-in session; no public link to a document ever exists. If the operator has an AI provider configured, a scan you add rides ONE reading call so Zip can suggest a title and folder — the suggestion is only a suggestion, nothing is filed until you tap save, and the reading call stores nothing. Every document and folder is deletable, and the drawer dies with the account. If you ask Zip to read a filed document (or attach a PDF in her chat — which files it into the drawer first), that document rides the one answering call to the AI provider and is not stored by it — the saved conversation keeps only the words
  • Contact titles on your friends list (friend, boss, close friend… — a person can wear several): stored in your account and visible to you alone — the person you label never sees them. Importing contacts into Zip's book uses the device's own picker where the browser offers one (Android): the operating system shows the chooser, and only the people you tap are copied in — this app cannot read the device book in the background, on any platform
  • A professional directory listing (profession, description, optional contact info) if you choose to submit one — publicly visible once admin-reviewed
  • A personal card (display name, headline, bio, interests, location, contact info — every field optional) if you choose to create one — same public/reviewed pattern
  • A "looking for work" listing or a paid "hiring" job posting if you choose to submit one — same pattern, publicly visible once reviewed
  • A paid social event listing (title, description, date, general location, contact info) if you choose to host one — same pattern, publicly visible once reviewed
  • Friends you connect with (via a private invite link you generate and share yourself — redeeming it is what makes you friends) see your stable anonymous label, whether you're currently online, and a plain-language "synergy" description of the friendship (like "New connection" or "Close friends") — computed from how long you've been friends and how much you've used chat groups together, visible only to the two of you, never a number, never compared to anyone else's friendships, never shown anywhere else

Sent to a third party

  • If the operator has set up an AI provider key, some features send text to that provider's API to generate a response: photo analysis and message drafting on the help page, the scoped home-page question box, the "AI Me" personal advisor and calendar suggestions (which include your own recently logged entries as context), the jobs and events page search assistants, the one-sentence weather and travel-time summaries (rephrasing figures this server already computed), and a content moderation check that can run on chat messages, personal cards, and job/professional/event listings before they're allowed to post
  • Two newer AI features work the same way and deserve their own plain sentences. The search bar's web-search agent sends your query to the AI provider, which searches the live web to answer it; if you also turn on the "learn your search habits" switch in Settings (off by default), your own past searches are stored on this server and used as context — while it's off, nothing is stored at all. And Zip, the built-in chat assistant, sends each conversation to the AI provider to answer; the conversation itself is stored in your account on this server until you delete it (every chat has a delete button). Asking Zip for pictures sends a short search query to Wikimedia Commons, a free public image library. Asking Zip to add a task or calendar entry writes nothing until you tap confirm. Asking her what's on your day reads your own calendar, tasks, and logged time at that moment, and the summary rides that one conversation like everything else in it. A photo you attach to a Zip message rides that one message to the AI provider and is not stored — the saved conversation keeps only the words. And if you turn on Zip's personal memory (off by default), facts you let her keep are stored in your account and included as context in your own future chats — every save is shown to you the moment it happens with an undo, the full list lives under 🧠 in her window, each fact is deletable, and none of it is ever visible to anyone else
  • Zip's voice and drawings: if the operator has configured OpenAI, tapping the mic sends that one recording to OpenAI to become text, Zip's spoken answers are generated by OpenAI's voices from the answer's text, and asking Zip to draw sends your description to OpenAI to create the picture — in each case the recording and text are processed to produce the result, and this app stores none of it (a finished drawing is kept in your own conversation like any other picture there). A voice signature, only if you record one (🎗️ in Zip's voice window): six seconds of your speech become 192 numbers on this service's own machines — the audio itself is not kept anywhere, and the numbers cannot be played back as sound. They exist so Zip can greet the family member actually speaking on a live call; a fresh sample is compared against your signature and those of your family circle, each of whom recorded their own by choice. Deletable in one tap, and it dies with the account. Live voice conversation with Zip (🎙️), if you start one, streams your microphone audio directly from your device to OpenAI's realtime service for the duration of that call — this app's server only opens the line and never hears or stores the audio; the live captions you see are not saved. Without OpenAI configured, the mic uses the operator's own self-hosted transcription server if one is set up (your recording stays on this service's own machines), or else your device's built-in recognition where audio never leaves the phone — and spoken answers fall back to your device's built-in voices
  • Zip's contact book (the 📇 window): people YOU add there, explicitly for Zip's secretary work — those entries (name, number, note) ride along as context in your own Zip conversations so she can put the right number into a call reminder. Your phone's and WhatsApp's contact lists are never touched — their makers seal them, and this app doesn't try. Every entry is deletable, and the book dies with the account
  • The message inbox, if you turn it on: an iPhone Shortcut that YOU create forwards messages from senders YOU choose to this server, where they're stored in your account (newest hundred kept) and each one's text is sent to the AI provider once, to be classified — advertising, appointment, or personal — and to extract any date worth proposing. Appointments become proposal cards that write nothing until you tap confirm. The inbox address is a secret token you can rotate or delete at any time, and deleting a message removes it for good
  • One AI Me option is the exception to the AI line above: turning on "automatically mirror every entry into your calendar" does not send anything to an AI provider — it's a plain copy of an entry's own title and time into a new calendar row, done directly by this server, not a generated response
  • If the operator has set up Stripe, payment and identity-verification data is handled entirely by Stripe's own hosted flow — this app never receives or stores your card details or ID photo
  • The travel question. Tapping "when do I have to leave?" on a calendar event sends that event's address text to Nominatim (OpenStreetMap's free address lookup) to find it on the map, and the coordinates of it and of your starting point to OSRM (a free route calculator) to measure the drive — no name or account attached, and only at the moment you ask. The "time to leave" push that fires later reuses the answer stored then and contacts nothing. These are the default services; an operator can point both at servers of their own
  • The weather window sends the coordinates of the place you're looking at to Open-Meteo, a free weather service — rounded on this server to about a kilometer before they go out, with nothing about your account attached. A place name you type into the weather search goes to Open-Meteo's place lookup the same way
  • The calendar's holiday layer asks hebcal.com (for Israel) or date.nager.at (for other countries) for the year's public holidays — the request carries a year and a country code, nothing else
  • The sun on the home screen is today's actual sun: this server fetches one public photograph a day from NASA's Solar Dynamics Observatory, the same picture for every member — the request carries nothing about anyone

ID verification — optional, and operator-controlled

  • If this server's operator has configured Stripe Identity, you can complete a real ID verification (a government-issued document plus a selfie, handled entirely by Stripe's hosted flow)
  • If you do, the date of birth on that document replaces the one you self-reported at signup — this is what makes "verified" mean something for the age check, rather than just recording that you completed a scan without confirming what it said
  • This app never sees or stores the document image itself — only the corrected date of birth and a status word (pending/verified/failed)
  • Without this configured (or if you skip it), your age stays exactly what you self-reported at signup, unconfirmed against anything

What this app does not do

  • Doesn't sell your data or share it with anyone beyond what's described above
  • Doesn't do private matching or introductions between strangers — every real connection here (friends, professional listings, personal cards, job listings) is something you browse and act on yourself, not something this app arranges on your behalf
  • Doesn't watch your video calls — and nothing is recorded anywhere, on any kind of call. A regular call connects directly between the participants' devices, encrypted end to end: this app's server carries only the ringing and connection setup, never the conversation, and when two devices can't reach each other directly the still-encrypted stream passes through the operator's own relay server, which cannot decrypt it. The one exception is a "big room" — chosen with its own checkbox when a call is created, off by default, and never offered when you call a friend directly — where everyone's streams flow through the operator's own media server, which handles the audio and video in order to route them between many people. It relays; it does not record
  • Doesn't verify anyone's professional credentials, job legitimacy, or the accuracy of a personal card — admin review of these means the text was checked for spam or abuse, nothing more

Your controls

  • Settings → Account → "Download my data" gives you a file with your account, settings, profile, entries, calendar events, professional listing, personal card, job seeker listing, job postings, and social events
  • Settings → Account → "Delete account" permanently removes your account and everything tied to it across every feature above

Back to Timezip