Zeni — Privacy Policy

Last updated: October 27, 2026
Application: Zeni for iOS and Android
Privacy and support: support@luminadigital.app
Data controller: 61.406.285 Guilherme Magalhaes da Silva, CNPJ No. 61.406.285/0001-50, responsible for the app under the Lumina Digital brand. Headquarters: Brasília, Federal District, Brazil.

1. Our priority: protecting children and families

Zeni helps parents and guardians organize missions (chores and habits), rewards chosen by the family, stars, activity records, and routines. It has separate parent/guardian and child experiences with family supervision. This Policy describes what information is processed, the differences between device and cloud storage, access, and available rights.

Children's and adolescents' best interests, protection, data minimization, and appropriate involvement of their parents or guardians guide our practices. We encourage adults to explain this Policy to children in age-appropriate language.

2. Who uses Zeni and who manages information

An adult parent or guardian manages the account and family organization. The initial family setup requires guardian authentication in the version described here. Following setup, core functionality is designed to continue locally, including without an internet connection, subject to limitations of cloud-dependent features.

Child profiles and pairing codes do not replace the adult account or grant administrative authority to children. Adults determine profiles, missions, rewards, whether approval or photo evidence is required, and whether a child device may be linked to the family.

3. Information that may be processed

Depending on the features used, the service processes:

• Adult account: email address, optional display name, account/authentication identifiers, session information, and the selected sign-in provider (email/password, Google, or Apple). Initial registration or sign-in requires a connection.
• Family and member data: family name, names or nicknames, avatars, relationships, permissions, and identifiers of families, profiles, and linked devices.
• Child activities: missions, descriptions, assignments, frequency, completion records, approval requests and decisions, rewards, requests, history, streaks, and star transactions.
• Mission evidence photos: photos captured with the camera, stored on the device and potentially uploaded to private cloud storage. They may include people or details from the home; avoid faces, documents, identifying school uniforms, visible locations, and intimate or third-party information.
• Pairing and security: six-character pairing codes, pairing identifiers, anonymous Supabase session identifiers for child-device mode, device-link status, PIN-related technical data, and whether biometric authentication is enabled. Face/fingerprint verification is performed by the operating system; Zeni does not need a biometric image.
• Accessibility choices: language, theme, text size and font, text-to-speech, vibration, notifications, reduced motion, and other preferences.
• Adult subscription data: the authenticated account identifier used for subscription association, product/package identifiers, monthly or annual plan, store-provided price and currency, Zeni Pro entitlement status, and dates of purchase or expiry when returned through RevenueCat. These are separate from children's content and photos.
• Technical and support information: what is needed for synchronization, troubleshooting, security, and voluntary support requests. The on-device diagnostics panel does not automatically transmit its report to support.

We do not require health records, diagnoses, or medical reports for accessibility features. Avoid putting sensitive information in free-text mission fields or photos.

4. Why information is used

Data is used to authenticate the guardian, organize a family, manage child profiles and missions, rewards, star histories, approvals, accessibility, authorized device pairing, security, customer support, and, where applicable, sync, backup, and restoration. Subscription information supports store offerings, localized pricing, purchase, restoration, and Zeni Pro access verification.

Stars are a family organization and encouragement mechanism. They are not money, a bank account, or an automated academic, medical, or behavioral assessment. Zeni does not use a child's history for personalized advertising, sale of profiles, or significant automated decisions about children.

5. Device and cloud storage (Supabase)

Zeni retains operational data on the device and supports some offline use after initial setup. It is not entirely offline: initial guardian authentication, child-device pairing, synchronization, remote photo access, remote account deletion, and some restorations require internet access.

Supabase provides authentication (including an anonymous session for child-device mode), database, synchronization, restoration, pairing codes, evidence photo storage, and cloud deletion. Remote records may include family members, children, missions, rewards, completion events, requests, star transactions, and required identifiers. Mission photos may be stored in the private mission-evidence bucket and accessed via signed URLs valid for 300 seconds. Expiration does not replace access controls or care when sharing links.

Sync may not be immediate; the app does not promise realtime multi-device collaboration or automatic merging of divergent histories. Restoration may cover only some categories. Local star balances must not simply be overwritten from an unchecked remote balance.

Signing out does not delete device data. Clearing local data does not by itself remove cloud copies. Review the specific result shown for each action.

6. Google and Apple sign-in

When selecting Sign in with Google or Sign in with Apple, the identity provider may send an account identifier, email address, name, or other authorized information to Zeni. Apple's private email relay may be used. Zeni does not receive your Google password or Apple ID password.

Google and Apple also process information under their own policies and settings. Disconnecting Zeni does not automatically remove the external account.

7. Subscriptions and RevenueCat

Zeni uses the RevenueCat SDK to integrate subscriptions offered by the Apple App Store and Google Play. After identifying a valid adult account, Zeni uses that account's stable identifier as the RevenueCat user ID. Anonymous child-mode sessions are not used to initiate this subscription integration.

The app can retrieve store-configured offers, product and package identifiers and titles, localized price and currency, numerical price and monthly equivalent. To validate Zeni Pro it may receive entitlement state, store source, original purchase date, and expiry when available. Purchases and restorations grant access only after the entitlement is confirmed for the relevant authenticated account.

Payments are processed by the relevant app store. RevenueCat and the stores handle transaction information under their respective terms. Zeni does not directly request full payment-card details. Subscription cancellation, refunds, and management take place through the original store; deleting a Zeni account does not automatically cancel the subscription. Specific RevenueCat processing regions, retention, and subprocessors should be confirmed against its currently applicable documentation before final legal approval.

8. Mission photos: additional care

Evidence photos are intended only to help the family review missions, not for public social posting. The current flow uses the device camera, not gallery selection. The image may be kept locally and uploaded to the private Supabase mission-evidence bucket; remote viewing uses signed URLs with a 300-second lifetime and profile-based permissions.

Prefer photos of the result of an activity and avoid faces, documents, other people, location data, and sensitive information. The guardian should supervise photo use and choose a no-photo alternative when appropriate and available. Submitting a photo does not remove the need for parental review or approval. Requests to remove an inappropriate photo may be sent to support. Removal from active storage, technical copies, or backups follows the applicable technical process and legal retention requirements.

9. Pairing codes and family controls

An adult can generate a six-character remote pairing code. A child device uses an anonymous Supabase session to redeem it, so pairing needs internet. Share codes only with authorized people; do not publish them. Review linked devices and revoke unused or unauthorized access where the app permits. Pairing does not give children administrative rights.

10. Text-to-speech (TTS) and accessibility

TTS reads interface and mission text using operating-system voices. It is not a recording of a child's voice and does not itself require microphone access. Zeni prioritizes offline-capable voices when available, but certain languages, voices, or devices may use manufacturer services or network connectivity; offline TTS cannot be guaranteed in every case.

Fonts for dyslexia, text sizing, themes, reduced motion, and other features are intended to facilitate access without requiring disclosure of a diagnosis or health condition.

11. Security and protection limits

Measures include account authentication, family access separation, cloud authorization rules, sessions, PIN/biometrics for protected areas, and secure infrastructure connections. No service is absolutely secure. Device settings, credential protection, and pairing-code handling also matter. We do not claim universal end-to-end encryption. Relevant security incidents will be managed and notified as legally required.

12. Who may receive information

Information may be accessed as needed by authorized family members; technical service providers including Supabase and its subprocessors; Google or Apple for sign-in and store operations; RevenueCat for subscriptions; and competent authorities when legally required. We do not sell children's information or authorize personalized advertising using it. Mission photos are not public by default. New providers require assessment and updates to disclosures.

13. International transfers

Hosting, authentication, and subscription services may process data outside Brazil, depending on supplier infrastructure and configuration. Applicable international-transfer requirements are observed. We do not assert a particular processing region for RevenueCat or the stores without checking current supplier terms.

14. Legal bases and rights

Processing follows the Brazilian General Personal Data Protection Law (LGPD), as appropriate to each purpose, including contract performance, legal obligations, legitimate interests where demonstrated, and consent when required. Children's best interests require an independent assessment regardless of legal basis.

Data subjects and their lawful representatives may request, as provided by law, confirmation, access, correction, information on sharing, anonymization/blocking/deletion, portability where regulated, information and withdrawal of consent, objection, and applicable reviews. Contact support@luminadigital.app without sending unnecessary child documents.

15. Retention, account deletion, and copies

Personal data is kept only while needed for a legitimate purpose, subject to legal obligations, security, rights, and backup lifecycles. There is no single deletion period for all data types. Store and RevenueCat retention policies are determined by those providers and require verification.

Guardians can start account deletion inside the app using the typed confirmation EXCLUIR CONTA and authenticated server-session validation. Remote deletion proceeds in resumable stages and considers ownership and families with multiple guardians, potentially deleting Storage files, database records, and Supabase Auth identities within the authorized scope. Local data is cleared automatically only after verified remote completion (stage: complete). Lost responses or errors must not be treated as successful deletion. Removing a Supabase Auth identity does not itself revoke external Google or Apple authorizations.

Local data removal is different from cloud deletion, and signing out is not local deletion. Before transferring a device to someone else, ensure family data has been removed from it.

16. Permissions, notifications, and choices

Guardians can manage supported notifications, TTS, visual preferences, and camera permissions in the app or operating-system settings. Refusing camera access may prevent adding mission evidence photos but should not block unrelated features. Notifications depend on device permissions and delivery conditions.

17. Updates and contact

We may update this Policy to reflect changes in features, security, law, and suppliers. Material changes will be communicated through suitable channels. Last updated October 27, 2026.

Privacy and support: support@luminadigital.app
Legal controller and address: 61.406.285 Guilherme Magalhaes da Silva, CNPJ No. 61.406.285/0001-50, responsible for Zeni under the Lumina Digital brand. Headquarters: Brasília, Federal District, Brazil.