Privacy policy

Last updated 7 November 2026

This is the working text for the launch period and is being reviewed. If anything here is unclear, contact us before you pay.

What we collect

• Your name, email address and a hashed password (we cannot read your password).
• Your orders, top-ups, credit history, refund requests and problem reports.
• The email you ask us to invite to a subscription.
• The receipt images you upload as proof of a bank transfer. A receipt can show your name, bank and account details.
• Records of who did what in the admin area, and of when a shared login was viewed.
• Your approximate network address, used to slow down repeated login attempts.
• If you use the SubSheep phone app: a random notification address for your phone (so we can send you alerts) and, if you turn on fingerprint sign-in, a hash of a random sign-in token. Your fingerprint itself never leaves your phone and we never receive it.

The phone app

• Notifications. Alerts such as “payment confirmed” or “your access ends soon” are delivered through Google Firebase Cloud Messaging, which receives your phone’s notification address and the alert text. Alerts never contain passwords, invite links or bank details. You can turn each kind off under Security → Notifications, or in your phone’s settings. Logging out stops alerts on that phone.
• Fingerprint sign-in. The phone keeps a secret in its secure hardware, unlocked only by your fingerprint. We store only a hash of a random token, up to five phones per person, and you can remove a phone any time under Security. Changing your password or choosing “Log out everywhere” ends it on every phone.
• Administrator accounts do not use fingerprint sign-in.

Why

To take your payment, give you access, support you, prevent fraud and keep an accounting record. We do not sell your data and we do not send you advertising.

Automated receipt check

To speed things up, a receipt image you upload may be sent to an AI service (Google Gemini, with Anthropic Claude as a backup) which reads the amount, reference and date. It only advises us; a person confirms the payment. On the free tier of such services, the provider may use submitted content to improve its products, so avoid uploading images that show more than the transfer details. If you are not comfortable with this, contact us before paying.

Who sees it

Our administrators see your orders and receipts. Our service providers process data for us: hosting (Netlify), database (Neon), file storage (Cloudflare R2), email and the AI services above. Shared login details are encrypted in our database.

How long we keep it

• Receipt images are deleted from storage 3 months after the payment is decided, unless an order, refund or problem is still open. We keep a fingerprint of the image so it cannot be used twice.
• Order, payment and credit records are kept for accounting and dispute purposes.
• Login attempt counters and password reset links are cleared within about a day.

Deleting your account

You can delete your account yourself, in the app or on the website:

1. Log in and open Security.
2. Choose Delete my account and confirm with your password (and your two-step code, if you use one).

If you cannot log in, email ZalelTechLTD@gmail.com from the address on the account and we will do it for you. Deletion is not possible while an order, top-up, refund or problem report is still open; the page tells you what to finish first.

• We remove your name, email address, password, fingerprint sign-in, two-step login and phone notification addresses, and sign you out everywhere.
• Order, payment, refund and credit records are kept without your name, because we must keep accounting records and settle disputes. Receipt images are still deleted 3 months after the payment is decided.
• Any store credit left is lost when the account is deleted (it is never paid out as cash), and active access ends straight away.
• You can sign up again later with the same email address as a new customer.

Your choices

You can ask us for a copy of your data, to correct it, or to delete your account (see above). Contact: ZalelTechLTD@gmail.com.