Privacy Policy

This Privacy Policy explains how MOKAYSA LLC ("ZenFrame", "we", "us") collects, uses, and shares information when you use the ZenFrame mobile application, the web product at app.zenframe.app and the website at zenframe.app (together, the "Service").

ZenFrame is built so that we know as little about you as possible: there is no sign-up form, we never ask for your name or email address, and the photos you add are used only to produce the results you asked for.

1. Your account and identifiers

No registration. ZenFrame creates an anonymous account for you automatically the first time you open the app. We do not ask for, and do not collect, an email address, phone number, real name, or social profile. Your account is identified by a random user ID.

Device identifier. The app reads the identifier your operating system gives to the app (a vendor-scoped device ID) so that the free starter credits can be granted once per device and so that activity recorded before your account existed can be attached to it. It is not an advertising identifier and is not shared with advertisers.

Session storage. Your session is stored in your device's secure keychain so that you stay signed in to the same account between launches.

Push notifications. If you allow notifications, the app registers a device push token with Firebase Cloud Messaging (Google) and stores it with your account so that we can tell you when a creation is ready. The token identifies the app on your device, not you. It is deleted when you turn notifications off in the app or delete your account, and you can withdraw the permission at any time in your device settings.

2. Photos you provide

Your photo. To use the creative tools you add at least one photo of yourself. You choose it from your photo library or take it in the app; nothing is uploaded until you act. Depending on the tool you may also add a second photo (for paired styles) or a photo of a garment.

What we do with it. Your photo is stored with your account and sent to our AI infrastructure providers at the moment you start a generation, solely so they can produce the result you requested and return it to us.

What we never do with it. We do not use your photos to train AI models, we do not sell them, we do not use them to advertise to anyone, and we do not show them to other users.

Photos of other people. If a photo you add shows someone other than you, you are the one who decides to process their image: you must have their informed, valid consent before you add it, and you remain responsible for that use and for the result (see Section 6 and 8 of the Terms of Use). We process such a photo only on your instruction and only to produce the result you requested. If you cannot show that consent, do not add the photo.

Face data. ZenFrame does not collect biometric identifiers. We do not run facial recognition, we do not extract facial geometry, landmarks, templates, or any "faceprint", and we never use face data to identify a person. The only face-related data we handle are the ordinary photographs you choose to provide and the images and videos generated from them.

3. Content you generate

The images and videos produced from your inputs are stored with your account so that you can view, save, and share them again. Your Activity list shows the jobs from the most recent period; the files themselves remain available to your account until you erase them or delete your account.

4. Automated safety screening

Before a generation starts, every photo you add is automatically screened by a vision model to detect images of minors. Uploads that appear to depict a minor are rejected and no generation runs.

The screening verdict is recorded in an abuse-prevention log. Because this log exists precisely to prevent repeat abuse, it is retained after account deletion — but it is de-identified at that point, so it can no longer be linked to you (see Section 9). Repeated attempts to generate content from photos of minors lead to permanent blocking.

5. Credits and purchases

ZenFrame runs on virtual credits. We store your credit balance and a ledger of the credit movements in your account (grants, spending, refunds).

Credit packs and the ZenFrame Plus subscription are sold through the Apple App Store. The purchase is processed by Apple and validated for us by our subscription provider (Adapty). We never receive or store your payment card details. What we receive is the transaction record needed to deliver what you bought and to honour restores.

On the web product at app.zenframe.app, and in some in-app offers that open a browser checkout, credit packs are sold as one-time purchases processed by Stripe. Stripe collects your payment details directly; we receive only the confirmation, the amount and a reference for the purchase so that the credits can be added to your account.

6. Advertising and attribution

If you install ZenFrame after seeing one of our ads, the ad link carries campaign parameters (campaign, ad set, ad, creative, and source identifiers). The app reads them once, on first launch, so that we can tell which campaigns work and, in some campaigns, show you the catalog the ad promised. Attribution never grants or withholds paid features.

When the parameters are not carried by a deep link, we match your first launch against the click log kept by our ad landing pages, using the IP address of the request and the platform. Our ad landing pages (go.zenframe.app) load the Meta Pixel; the main website at zenframe.app does not.

We report aggregate conversion events (such as an install or a purchase) to Meta so that ad delivery can be measured and optimised. On iOS, the app asks for your permission through Apple's App Tracking Transparency prompt before any tracking that requires it; you can change your answer at any time in iOS Settings.

7. Product analytics

We record product-analytics events — which screens you open, which tools you start, whether a job succeeded — tied to your random user ID, so we can find broken flows and improve the app. This runs on our own backend. We do not embed third-party analytics or advertising SDKs for this purpose, and these events do not contain your photos.

8. The website

The website at zenframe.app is a static site. It sets no cookies, runs no analytics, and does not profile visitors. As with any website, our hosting provider records basic technical request data (such as IP address and user agent) for delivery and security.

The web product at app.zenframe.app is different: it is the same lab in a browser. It creates an anonymous account for you on your first visit, keeps a random device identifier in your browser's local storage so that the welcome credits are granted once, and records the IP address of that first visit for the same reason. It records the same product-analytics events as the app (Section 7) and, on its checkout page, a page session identifier used only to measure that page. It sets no advertising cookies.

9. Retention, erasure, and account deletion

Erase your content. From Settings you can erase your photos and results. Erased items stop being reachable through ZenFrame and are no longer shown to you or used by any tool; any generation still running is stopped and its held credits are returned.

Delete your account. Deleting your account removes your account record and the sign-in identity behind it. The operational records that must survive for accounting and abuse-prevention purposes — job logs, safety-screening logs, analytics events, advertising-attribution rows — are re-keyed to a random surrogate identifier that cannot be traced back to you or to any new account you create.

Credit ledger. The credit and purchase ledger is retained for accounting and fraud-prevention purposes as required by law, and resolves deleted owners through that surrogate identifier.

Storage paths. Uploaded and generated files are stored under unguessable, account-scoped paths on our storage provider. Once the records that point to them are erased or de-identified, the files can no longer be reached through the Service.

10. Who we share information with

We work with a small number of providers who process data on our behalf:

• Supabase — database, anonymous authentication, and serverless functions (our backend).
• Bunny.net — storage and delivery of your photos, your results, and the catalog media.
• xAI — the automated safety screening described in Section 4. It receives each photo you add, once, to check that it shows an adult.
• Runware — image and video generation, running image and video models from Google and Alibaba. It receives the photo(s) for a single request, to produce that result.
• ZenCreator — generation of some motion styles, on the same terms.
• Adapty — validation and management of App Store purchases and subscriptions.
• Apple — payment processing and subscription billing.
• Stripe — payment processing for purchases made on the web (Section 5).
• Google (Firebase Cloud Messaging) — delivery of push notifications, if you allow them (Section 1).
• Meta — measurement of our advertising campaigns (conversion events and, on our ad landing pages, the Meta Pixel).
• Cloudflare — hosting and delivery of our websites.

These providers are bound by contract to process data only on our instructions. We do not sell personal information and we do not share it for cross-context behavioural advertising beyond the campaign measurement described in Section 6.

11. International transfers

We operate from the United States and our providers may process data in the United States, the European Union, and elsewhere. Where a transfer requires it, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.

12. Your rights

Depending on where you live — including under the GDPR, the UK GDPR, Turkish KVKK, and US state privacy laws such as the CCPA/CPRA — you may have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to its processing, to withdraw consent, and not to be discriminated against for exercising these rights.

The fastest route for erasure is in the app itself (Settings → erase content, or delete account). For anything else, write to support@zenframe.app and we will respond within the period the applicable law requires. Because ZenFrame accounts are anonymous, we may need information from the app (such as your user ID, shown in Settings) to locate your data. You may also lodge a complaint with your local data-protection authority.

13. Security

All traffic is encrypted in transit. Database access is protected by row-level security so that only your own account can read your rows; credits are managed exclusively server-side; files are stored under unguessable, account-scoped paths; and internal access follows least privilege. No system is perfectly secure, but we apply industry-standard safeguards throughout.

14. Children

ZenFrame is not directed at children. You must be at least 18 years old to use the Service, and photos of minors may never be added (Section 4). If you believe a person under 18 has provided us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the Service. The current version is always available at https://zenframe.app/privacy.

16. Contact and data controller

The data controller is:
MOKAYSA LLC
131 Continental Dr, Suite 305
Newark, Delaware 19713
United States
Email: support@zenframe.app

← Back to ZenFrame