Zyra
Sign in Open Zyra

Privacy policy

Draft for legal review. Prepared from the product specification for review against Singapore's PDPA and, for visitors from the EU, UK and Switzerland, the GDPR. Not in force until reviewed and dated. Last drafted 13 October 2026.

Who we are

Zyra is operated by [legal entity name, UEN, registered address — to be completed]. Our Data Protection Officer can be reached at support@zyra.sxingxian.com.

What we collect and why

  • Your account: name, username, email address and, if you add one, a profile photo. Needed to provide the service.
  • What you put into Zyra: shifts, availability, swap requests, chat messages, photos and notices in the teams you belong to. Visible to the members of that team.
  • Security records: when you sign in, the kind of device and browser, app version and IP address, kept in a tamper-evident audit log for 365 days to protect accounts and investigate misuse.
  • Device verification: when you confirm a new phone or browser, we keep a random identifier for that device (we store only a scrambled form of it), a label such as “Chrome on Mac”, and when it was last confirmed. You can remove remembered devices in the app at any time.
  • Notifications: if you turn on notifications, the push address your browser or phone gives us, so we can send swap requests, roster changes and notices.
  • Payments: if you buy a plan, whether you are subscribed and until when. Card details are entered on Stripe's page and never reach our servers.
  • Privacy choices: your answer to the ads question, its version and date, to show we asked.

We don't ask for sensitive information such as religious beliefs or health, and we ask teams not to store it in Zyra.

Advertising (free plan only)

People on the free plan see one ad on the home screen. Ads are provided by Google AdSense. Before any ad loads we ask whether you allow personalised ads:

  • Personalised ads (only if you agree and confirm you are 18 or older): Google may use cookies or device identifiers to show ads based on your interests. See how Google uses information from sites that use its services.
  • Non-personalised ads (the default): based on the general context only, though Google may still use cookies to limit how often you see an ad and to prevent fraud.

Ads never appear in team chat, rosters or anywhere your teammates' information is shown, and we never give advertisers your name, email or team data. You can change your choice under Your account → Privacy. Paid and team-plan members see no ads.

Who processes data for us

  • Supabase (database, sign-in and file storage) — hosted in Singapore.
  • Cloudflare (website hosting, security checks against bots).
  • Stripe (card payments) — may process data in the United States.
  • [Email provider, e.g. Resend] (sign-up emails and verification codes) — may process data in the United States.
  • Google (ads for free-plan members; push delivery on Android/Chrome) and Apple (push delivery on iPhone and iPad).

Where data leaves Singapore, we rely on contractual protections comparable to the PDPA. [Legal review: confirm transfer mechanism and list.]

Who can see your information

Teams are visible only to their own members. Zyra staff can open a team's conversation only to investigate a report or respond to a legal request; each access needs a written reason and is recorded in a tamper-evident log.

How long we keep it

  • Audit logs: 365 days.
  • Chat and comments: while the team is active, then 90 days after it is archived.
  • Verification codes: one day. Remembered devices stop being recognised after the re-verification period, and you can remove them at any time.
  • Payment records: as required by tax law [legal review: period].
  • Deleted accounts: removed after a 14-day grace period. Messages you sent stay with your team but show “Former member”.

Your choices and rights

You can see and change your details, remove remembered devices, turn notifications off, change your ads choice and delete your account in the app. You can also ask us for a copy of your data or to correct it by writing to our Data Protection Officer. People under 18 can use Zyra with their organisation's and, where required, a parent's consent; they are only shown non-personalised ads.

Contact and complaints

Write to support@zyra.sxingxian.com. If you're not satisfied with our answer, you may contact the Personal Data Protection Commission of Singapore (or your local data protection authority).