Privacy Policy

Last updated: 26 October 2026

1. Who is responsible

Zenow is run by Paolo Navatta, an individual based in Italy, who is the data controller for the personal data described here. Write to [email protected] about anything to do with your data, including the requests in section 11.

If Zenow becomes part of a company, that company will take over as controller. We will update this page and tell you by email before it happens.

2. What we collect

Only what the features you use need:

• Account: your email address; a password, stored only as a one-way hash, or the Google or Microsoft account you sign in with; the month and year you were born and your country. If you are under the age of consent where you live, also a parent’s email address and when they agreed.
• School and study: the calendar, homework, tests, grades, timetable, subjects, notes, study plans and materials you add or import, including your teachers’ names and notes on how they test.
• What you send Chrono: your messages, the photos and files you attach, and the homework, plans and grades Chrono needs in order to answer.
• Spoken practice: while a session is open, sound from your microphone is streamed to our AI provider to be understood and answered live. Neither we nor the provider keep the recording. We keep the transcript, the notes Chrono writes, what was on the whiteboard and the result.
• Payments: handled by Stripe. We keep your plan, its status and Stripe’s reference numbers, never your card details.
• Accounts you connect: a calendar, a to-do app, Notion or your school’s online register. We keep the access they need to sync, encrypted, and use it only for what you asked.
• People you share with: if you send a parent or tutor a summary, their email address and whether they confirmed.
• Technical: server logs (IP address, time, pages requested, browser) and error reports, to keep Zenow working and safe. Error reports leave out who you are, your IP address, cookies and anything you typed.
• Waiting list: if you sign up, your email and which of Zenow’s two presentations you saw, only to write when there’s room. If you then make an account, that presentation stays with it, to learn which works better: only the first message you read changes. Ask us to remove it at any time.

We do not collect your location, your contacts, or anything for advertising.

3. Why we use it

Each use rests on a legal basis under the GDPR:

• Running Zenow for you, Chrono, plans, reminders and sync included: to perform our contract with you (art. 6(1)(b)). If you are under the age of consent where you live, on your parent’s consent (art. 6(1)(a) and art. 8).
• Security, preventing abuse and fixing errors: our legitimate interest in a safe, working service (art. 6(1)(f)).
• Emails about your account, security, payments, and the reminders you turned on: our contract with you. We do not send marketing emails.
• Legal duties, such as tax records and proof of a parent’s consent: legal obligation (art. 6(1)(c)).

Chrono’s plans, readiness estimates and practice marks are produced automatically. They are suggestions for your own study, with no legal or similarly significant effect on you: you can change or ignore any of them, and no school sees them unless you share them.

4. AI and Chrono

Chrono is an AI, not a person. It runs on OpenAI’s models, through OpenAI’s paid API. For each request we send only what that request needs, with a coded identifier instead of your name or email. Under OpenAI’s API terms, OpenAI does not use it to train or improve its models, and keeps it for at most 30 days to detect abuse. If you are under the age of consent where you live, your requests go to OpenAI only with zero data retention: nothing is kept.

When you ask Chrono to look something up on the web, the search runs through OpenAI’s web search.

AI can be wrong. Check anything important with your teacher or your books.

We do not use your data to train AI models, ours or anyone else’s.

Before Chrono answers a chat message, OpenAI’s moderation checks it. If it suggests you may be thinking of hurting yourself, Zenow answers itself, with a helpline you can call, and counts only that it happened, without keeping what you wrote.

5. Children and parents

Below a certain age, a student cannot agree to Zenow alone. The age is set by the law where they live: 13 in the United States and the United Kingdom; between 13 and 16 in the European Union (14 in Italy and Spain, 15 in France, 16 in Germany); 16 anywhere we have not set it more precisely.

Everyone gives their month and year of birth and their country when signing up. Below that age, the account waits. We keep only the student’s email, the parent’s email, the birth month and the country; we send the parent one email explaining what Zenow collects and why, and ask them to agree. If they say no, or do not answer within 14 days, all of it is deleted.

Once a parent has agreed, they get a link of their own. From it they can, at any time, see and download everything we hold about their child, or delete the account, which also stops any further collection. They can also write to [email protected].

We collect from children only what the features they use need, never ask for more as a condition of using Zenow, and disclose it only to the service providers in section 6, who process it for us alone.

United States (COPPA). For children under 13 we follow the Children’s Online Privacy Protection Act: a parent’s consent, verified by email with a confirmation sent after they agree, and the rights above. If we learn that we collected a child’s information without that consent, we delete it.

If you think a child is using Zenow without the consent they need, write to [email protected] and we will act on it.

6. Who we share it with

We never sell or rent personal data, and never share it for advertising. It goes only to:

• Render (application hosting) and Supabase (database), where Zenow runs and your data is stored;
• OpenAI (models, web search and moderation), for Chrono;
• Stripe, for payments; Stripe’s own privacy policy covers what you enter at checkout;
• Resend, to send emails;
• Sentry (servers in Germany), for error reports without your identity;
• services you connect (Google, Microsoft, Apple, Notion, Todoist, TickTick, your school’s register), only when you connect them; their own policies apply;
• people you choose: a parent or tutor you send a summary to, and, on a Family plan, the payer, who sees only your name and email and, in a class you join, your classmates, who see your first name and the orals marked in the class while you take part: who was questioned, in which subject and on which day, what on and the questions the teacher asked (never grades, notes, answers or chats) and whoever you ask to pay for a pass, who sees your first name and, once, a week before the pass ends, the tests of those months with how ready you were (the grades only if you share them with a parent);
• authorities, only where the law requires it; and a successor if Zenow becomes part of a company or is transferred, under this same policy and after telling you.

Every provider that processes data for us does so under a data processing agreement and only on our instructions.

7. Data outside Europe

Some of these providers are in the United States or may process data there. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses, with extra safeguards where needed. You can ask us for a copy.

8. Cookies and your device

One cookie, connect.sid, keeps you signed in. It is strictly necessary, so it needs no consent.

Your browser also keeps some settings (such as language, theme and the last view you opened) and an offline copy of the app. They stay on your device and are not used to track you.

No advertising, analytics or tracking cookies, and no third-party trackers. Fonts and scripts are served by Zenow itself. A video you choose to open plays from YouTube’s privacy-enhanced domain, and a web page you open in the reader is fetched by our server.

9. How long we keep it

• Your account and content: until you delete them or the account. When an account is deleted, its data leaves the live database at once and the backups within 30 days.
• Chrono conversations: 7 days on the free plan; on a paid plan, for as long as you keep them.
• Spoken practice: the audio is never kept; transcripts, notes and results stay with your account until you delete it.
• A parent’s request nobody answered: deleted after 14 days. Proof of a parent’s consent: kept as long as the account exists.
• Server logs: up to 30 days. Error reports: up to 90 days. Screenshots attached to bug reports: 180 days.
• Billing records: as long as tax law requires (10 years in Italy). Sign-in sessions expire after 30 days.

10. Security

All traffic is encrypted (TLS). Passwords are stored only as a slow one-way hash (scrypt). Access to the services you connect is encrypted at rest (AES-256-GCM). You can turn on two-factor authentication. Only the people who run Zenow can reach the production systems, and only when they need to.

If a breach puts your data at risk, we notify the supervisory authority within 72 hours and you without undue delay, as the law requires.

11. Your rights

Wherever you live, you can:

• see your data and get a copy of it (Settings → Download my data);
• correct it;
• delete it, or the whole account (Settings → Delete account);
• take it elsewhere, in a machine-readable format;
• object to, or restrict, processing based on legitimate interest;
• withdraw consent at any time (a parent does it by deleting the account from their link), without affecting what was done before.

For anything you cannot do in Settings, write to [email protected]. We answer within one month and never charge for it. We may ask you to confirm it is you.

You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the one where you live.

12. United States residents

We do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of; we also honor Global Privacy Control signals. We use sensitive personal information only to provide the Service.

Depending on your state (for example California, Colorado, Connecticut, Virginia, Utah, Texas or Oregon), you have the right to know what we collect and why, to access, correct and delete it, and to receive it in a portable format. Use these rights as in section 11, yourself or through an authorized agent, without being treated differently for doing so. If we decline a request, you can appeal by replying to our answer.

Categories we collect, in the terms of California law: identifiers (email); account and commercial information (plan, purchases); education-related information you add (calendar, homework, grades); audio, processed live and not recorded; inferences (study suggestions); internet activity (server logs). Sources: you, the services you connect, and your parent if you are a child. Purposes and recipients: sections 3 and 6.

13. Changes

If we change this policy in a way that matters, we tell you by email or in the app at least 30 days before, and ask again where consent is the basis. The date at the top shows the latest version.

14. Contact

Paolo Navatta (Zenow), Italy. Email: [email protected].

This policy is written in English; translations are provided for convenience. If they differ, the English text prevails, unless the law where you live says otherwise.