Privacy policy
ZenClub (Zen City) is an independent collection of experiences to watch, listen to and gently take part in. This policy explains what we store and why.
What we store
- Account: email address, display name, a salted password hash, the date you accepted the terms, and a country code supplied by our network edge for regional availability.
- Activity: server-measured time in each experience (from activity heartbeats), saves, moments you choose to keep, badges, titles and tallies, plus short event names reported by experiences, such as "run finished".
- Preferences: time zone, language, appearance and favourites.
- Attribution: if you arrive through a tagged link, we keep the first campaign source to understand which invitations work.
We do not show advertising, embed advertising trackers or sell personal data. Plugins never receive your email, password, sign-in cookie or internal ID; they see only a display name, language, time zone and membership tier.
More activity and safety data
We also keep game runs and claims, event properties, counter logs, listening position (document hash and title, never PDF text), solitude durations, usage quotas and time grants. Risk checks may keep heartbeat logs, scores, evidence and human review notes. Tags inform discovery; marketing use is disabled. Ranking visibility preferences and exclusions, profile cards, public shares, moderation reports, takedown notices, exhibition characters, memory choices, seats, waitlists and venue code redemption are stored when used. Payment events are stored only if payment is enabled; payments are disabled by default.
AI and private reflections
Board threads and messages are stored privately. A safety check runs before replies and may pause role-play to show crisis resources. Replies portray historical figures, not their actual views. Private threads have no routine human review. The gateway uses a mock text provider by default. If an external provider is configured, Board text and conversation context are sent to it for a reply. The gateway records job usage and sizes, not prompt text. Public content can enter an operator moderation queue.
Location, camera and documents
This moment requests device location only when you choose it. Coordinates are rounded in your browser before a weather lookup; precise coordinates are not stored. The weather service is Open-Meteo by default and receives the coarse coordinates or region for that lookup. A general region works without device location. A configured AI provider may receive the region, weather and time of day. Time-lapse camera frames and video stay on your device; only duration is sent if you opt to record it. PDF text in Listen stays on your device. Its title, hash and progress may be synced.
When you save a soundscape, its words, language, coarse region, weather and time of day are stored privately with your guest or account identity. You can remove saved soundscapes; account export and deletion include them. Replaying a saved soundscape uses your browser's voice and synthesized sound without a new AI request. Precise coordinates and voice recordings are not saved.
Visit statistics
To see how ZenClub is used, we count visits with Cloudflare Web Analytics / Plausible (p.070122.xyz): the page address, the referring site, country, browser and device type, and how fast pages load. It sets no cookies, stores nothing on your device, does not build a profile of you and does not follow you across other sites. If your browser sends Global Privacy Control or Do Not Track, we do not load it at all.
Cookies and browser storage
zc_guest identifies a guest and zc_auth keeps an account signed in (up to 30 days each). zc_device is a separate random, signed device continuity cookie (up to one year) used to carry guest allowances across a cleared guest cookie; it rotates on sign-in. zc_oauth holds the temporary Google or Apple sign-in flow (up to 10 minutes to start and 5 minutes to finish). Production cookie names have a __Host- prefix. All are HttpOnly. One more small cookie is set by the page itself, so it is not HttpOnly: zc_city (up to one year) remembers only your time-zone offset and whether the site follows your clock or stays light or dark, so the home page opens at the right time of day. It holds no identifier. Guest, device and account cookies are SameSite=Strict; OAuth uses SameSite=Lax for Google and SameSite=None with Secure for Apple. We use a daily salted hash of the network's approximate address block to limit new guest creation and detect unusual guest churn. We do not use a hardware fingerprint. Local browser storage holds encrypted device saves, appearance, listening and driving preferences, a play reminder and a drive text cache; tab storage holds encrypted tagged arrival details. A non-sensitive appearance and visual style hint stays readable so the page can draw without a flash. zc_lang remembers a language you choose with the language switcher for up to one year; it is readable by the page, holds only the language code and is not used for tracking. If you dismiss the offer to read the site in your browser’s language, browser storage remembers that too. These are functional, not advertising cookies. The exact limits and retention period await product and legal review.
Your personal city
City recording is your choice. When you enable it, we store a small set of agreed decoration results from supported games, their first earned dates, and your selected city appearance. Your city is visible only to you. Games report fixed decoration keys and cannot receive your email, account identity, or login credentials. We do not use this feature to store individual actions, photos, text, precise location, or physical breathing data, or to create advertising profiles or public rankings. These are client-reported or explicitly imported appearance results, not verified competitive scores. You can pause recording, restore the base appearance, export the records, or clear city growth. Clearing city growth does not delete original game saves. When signing in, you may choose to merge guest decorations into your account. Account city records remain until you clear them or delete your account. Guest city records are cleared after 180 days without activity; they depend on the current browser guest identity, and clearing browser data may lose access. Short-term duplicate-request receipts expire within seven days.
Export, retention and deletion
My space offers a version 2 data export and account deletion. The export includes activity, Board conversations, tags and moderation records, plus markers that trust review and device continuity records exist. It excludes password and token hashes, AI prompts, payment provider IDs, risk scores, detector evidence and network hashes. Deletion removes owner-linked account data and share links; remove device-only files on your device. Limited anonymous payment, AI cost and operator audit records may remain. Automatic cleanup of sessions, receipts, revoked shares, email tokens and guest network signals runs only when enabled with configured periods. Final periods are pending.
Age
ZenClub is not directed at children. You must be at least 16 years old, or the higher minimum age in your country, to create an account. We do not personalise recommendations for minors.
Transfers and contact
The operator identity, address, privacy contact, hosting locations and any international transfer safeguards will be published before launch. This service is not a medical or crisis service. In immediate danger, contact local emergency services.
Contact and feedback
Contact messages include your email, category, message, and account or guest link. Operators can read messages and add private handling notes. We may forward a copy to the configured support mailbox and send you a receipt through our email service. Account export includes your linked messages and their status; account deletion erases those messages and operator notes from ZenClub. Email copies require separate handling by support. Contact us to request deletion of guest messages or email copies. Do not include passwords or unnecessary sensitive information. This form is not an emergency service.