Privacy Policy

Last updated 13 November 2026 · Questions: privacy@zaphiri.com

Introduction

Zaphiri is provided by Cedar Creek Ltd ("Zaphiri", "we", "us", or "our"). This Privacy Policy explains what personal data Zaphiri processes, why we process it, when it is shared, and the choices available to you. It applies to the Zaphiri app, website, Team Projects, and related services.

1. Information we collect

  • Account and authentication data: Your email address, name, profile image, account settings, subscription status, and identifiers from Google, Microsoft, or Apple if you use those sign-in methods. Email sign-in uses a verification code or link. Zaphiri does not ask new users to create a password.
  • Your Zaphiri content: Tasks, notes, descriptions, projects, labels, planning and energy preferences, time records, habits, calendar information, comments, attachments, recordings, transcripts, and conversations with AI features.
  • Team Project data: Project membership, invitations, roles, shared tasks, comments, files, time records, public intake forms, and connected project integrations.
  • Connected service data: Data returned by a service you choose to connect, such as calendar events or tasks, together with the connection credentials or authorization tokens needed to maintain that connection.
  • Billing data: Subscription, plan, invoice, and payment status. Stripe processes payment card details. Zaphiri stores Stripe customer and subscription identifiers, not full card numbers.
  • Support and communication data: Messages you send to us, support history, email delivery information, and your communication preferences.
  • Service, usage, and security data: Feature events, sign-in and account activity, request and error information, browser and device type, IP address, approximate location, and timestamps. Our internal feature events are designed to record the feature and result rather than task titles, task notes, or message text.

2. How we use information

We process personal data to:

  • create and secure your account, authenticate you, and provide the features you request;
  • store, organize, synchronize, and share content according to your choices and permissions;
  • operate subscriptions, connected services, Team Projects, and customer support;
  • provide AI-assisted features when you choose to use them;
  • monitor reliability, investigate errors, prevent misuse, and improve Zaphiri;
  • send service, onboarding, product, and promotional communications where permitted by law; and
  • comply with legal obligations and protect our users, service, and rights.

Depending on the activity and applicable law, our legal basis may be performance of our contract with you, our legitimate interests in operating and securing Zaphiri, your consent, or compliance with a legal obligation. You may unsubscribe from promotional email using the link in the message.

3. Cookies and browser storage

Zaphiri currently uses the following browser technologies:

  • Essential session cookies: Zaphiri may use an encrypted, HttpOnly session cookie for authentication, authorization, and connected-service flows. Blocking it may prevent those flows from working.
  • Local storage and session storage: The app stores authentication tokens, basic account state, preferences, feature caches, unsent drafts, and short-lived interface state in your browser. This information supports the app and is not a marketing cookie.
  • IndexedDB: The app may keep a local browser copy of collaborative document data so editing and synchronization work reliably.
  • Google Analytics: The public website loads Google Analytics 4 to measure visits and general usage only after you allow analytics cookies in the cookie banner. Until then, and if you decline, it is not loaded. The signed-in Zaphiri app at app.mytickup.com does not load Google Analytics. On the marketing website, Google Analytics may set first-party cookies such as _ga and _ga_<container-id> and process page, session, browser, device, IP-derived approximate location, and interaction data. We do not intentionally send task titles, task notes, or Team Project content to Google Analytics.
  • Google reCAPTCHA: The website's contact, enquiry and download forms, and any public Team Project intake form whose owner enables spam protection, load reCAPTCHA when you use them. Google may set the _GRECAPTCHA cookie and receive browser and interaction data needed to assess whether a submission is automated.

You can change your analytics choice at any time from Cookie settings in the website footer. You can also block or delete cookies and other site data using your browser controls, although doing so may affect sign-in, integrations, and saved preferences.

4. When we share information

We do not sell or rent personal data. We share data only as needed with:

  • Infrastructure providers that host the application, database, files, backups, and email delivery services.
  • Google, Microsoft, and Apple when you use their sign-in services, and Google, Microsoft, or Apple when you connect a calendar.
  • ClickUp, Todoist, Slack, and GitHub when you choose to connect the applicable account or Team Project feature.
  • OpenAI and Anthropic when an AI feature sends the prompt and relevant Zaphiri content needed to produce the result. The exact content depends on the feature you invoke.
  • Stripe for checkout, subscription management, invoices, and payment processing.
  • Google Analytics and Google reCAPTCHA for the separately scoped public marketing website and intake-form purposes described above.
  • Sentry for server error and reliability monitoring. Error reports may include a Zaphiri user identifier and relevant request or diagnostic context.
  • RelayBook and our customer relationship systems for account lifecycle, onboarding, product updates, communication preferences, and customer support. This may include your email, name, Zaphiri account identifier, plan, signup source, and referral information.

We may also disclose information when required by law, to protect rights and safety, or as part of a corporate transaction subject to appropriate safeguards.

5. Team Projects and shared content

Content placed in a Team Project is visible to project owners, administrators, members, guests, or public intake recipients according to the permissions and sharing options used. Project owners and administrators may manage membership and shared project data. Your personal Planning content remains private unless you intentionally place it in, link it to, or otherwise share it with a Team Project. An invitation does not transfer ownership of your individual Zaphiri account.

6. Zaphiri Quick Capture (Chrome extension)

Zaphiri Quick Capture lets you save the webpage you are looking at as a task in your Zaphiri account.

  • What it collects, and when: Only when you open the extension from your toolbar, it reads the title, address (URL) and site icon address of the tab you are on, to fill in the task form. It does not read the content of the page, run on pages in the background, track your browsing or keep a history. Nothing is sent until you click Add to Zaphiri.
  • What it sends: When you click Add to Zaphiri, it sends the task you created to Zaphiri's servers over an encrypted connection: the task name, your notes (including the page title, link and site icon address), the date you chose and whether it is Work or Personal. The task is then stored and handled like any other task in your account, as described in this policy.
  • Signing in: You sign in with your Zaphiri account (email code, Google or Apple). The extension keeps the sign-in tokens Zaphiri issues, and your light or dark theme choice, in Chrome's extension storage (chrome.storage.sync). If you have Chrome sync turned on, Chrome syncs this storage to your other signed-in Chrome browsers. To sign in with Google or Apple, the extension opens a sign-in tab and reads only that tab's return address to receive your sign-in. Signing out removes the tokens and theme from the extension.
  • What it does not do: No advertising, analytics or tracking code, no data sale, and no sharing with third parties beyond the service providers that run Zaphiri. Its permissions (tabs, activeTab and storage, plus access to Zaphiri's server) are used only for the purposes above.
  • Removing it: Uninstalling the extension deletes its stored data from Chrome. Tasks you created stay in your Zaphiri account until you delete them or your account.

This use of information complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

7. Data retention and deletion

We retain account data and Zaphiri content while your account is active and for as long as reasonably needed to provide the service, resolve disputes, secure the service, and meet legal obligations. Different records have different retention periods.

You may delete your account in Settings or request deletion by emailing privacy@zaphiri.com. Deletion removes the active account and associated application records, subject to limited retention in backups, security logs, financial records, records required by law, and processor deletion cycles.

8. Security

We use technical and organizational measures including encrypted connections, access controls, protected authentication tokens, and monitoring. No online service can guarantee absolute security. You are responsible for protecting access to your email account, sign-in provider, devices, and any verification code or link sent to you.

9. Your rights and choices

Subject to applicable law, you may have rights to:

  • access, correct, or obtain a portable copy of your personal data;
  • request deletion or restriction of processing;
  • object to processing based on legitimate interests or direct marketing;
  • withdraw consent where processing relies on consent; and
  • complain to your local data protection authority.

To exercise a right, contact privacy@zaphiri.com.

10. Children's privacy

Zaphiri accounts are available to users aged 13 or older. Users under 18 must have permission from a parent or legal guardian. A parent or guardian may invite or help a user aged 13 to 17 create an account, but each account remains personal to the individual user. Individual accounts for children under 13 are not currently supported, and we do not knowingly collect their personal data. If we learn that we have collected personal data from a child under 13, we will delete it.

11. International data transfers

Zaphiri and its providers may process data in the United Kingdom, European Economic Area, United States, and other countries. Where required, we use recognized safeguards for international transfers, such as adequacy regulations or approved contractual clauses.

12. Changes to this policy

We may update this Privacy Policy when Zaphiri, our providers, or legal requirements change. We will post the revised policy here, update the date above, and provide additional notice when required.

13. Contact us

Cedar Creek Ltd
Registered in England and Wales, company no. 06219685
Registered office: 869 High Road, London, N12 8QA
Email: privacy@zaphiri.com