Privacy Policy

Last updated November 7, 2026. Version 2026-11-05-10. This is the same policy you agree to in the app.

1. Summary

BezOo helps two adults talk about boundaries before an intimate encounter and keeps a private record on their phones. Most information stays on your phone. Apart from the agreement and transfer records described in section 3, we do not run a server that stores your information. We do not sell your data or use it for advertising.

Your name, date of birth and user ID are also sealed into the encounter record kept on the other person's phone. Nobody can open that sealed information on either phone. It can be opened only by an attorney, and only if the person holding the record sends it to Zoomy together with a valid court order. Zoomy then forwards the request to the attorney.

Zoomy cannot open sealed information. Neither Zoomy nor the attorney has any access to it unless a user sends the record to Zoomy directly, together with a valid court order.

BezOo does not verify anyone's identity or age, and it does not prove that consent was given. Its records are not a guarantee of legal protection.

2. Who can use the app

The app is for people aged 18 and over. We check your date of birth and, on iPhones that support it, Apple's Declared Age Range. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.

3. What we collect and where it is kept

• Account. Your name, date of birth and a user ID that the app creates for you. Your date of birth cannot be changed. These are stored on your phone in the iPhone's secure storage (Keychain). The account is protected by a key in the phone's Secure Enclave.
• BezOo log. The stop requests and respectful notes you send and receive, with their date and time, the activities you both agreed to, the approximate location of each phone (about 100 metres, and only when the encounter starts, once you've both shared your answers), whether each person confirmed they were not under the influence of alcohol or drugs and were consenting freely, and any labels you add. The log is encrypted on your phone. Opening it needs Face ID or your passcode. Individual entries cannot be edited or deleted.
• Your choices (yes, maybe, no). During an encounter, your choices are sent encrypted to the other person's phone so the app can work out where you both agree. The other phone shows only the matches. Both phones erase the choices when the encounter ends.
• BezOo profiles. Profiles you save (a name and your usual yes, maybe and no answers) are stored on your phone, in its secure storage. They are never sent anywhere. Only the answers you choose to share in an encounter are sent, as described above.
• Stops. When you stop an encounter, the other phone shows a stop screen, with an alarm unless you chose to stop quietly. When the other person taps I understand, their phone tells yours that the stop was seen. That confirmation contains nothing else and is not stored.
• Sealed identity record. When two phones connect, each phone seals its owner's name, date of birth and user ID, together with the encounter and the time, and sends it to the other phone. The record is encrypted to a key held by the attorney. Neither person can read it on the other phone. It is kept in that phone's encrypted log.
• Policy proof. Each end-of-encounter message (stop, respectful note, or age concern) includes the full Privacy Policy text, its version and fingerprint, your agreement receipt, and a signature from your device. The other person's phone uses these to check that you agreed to this version of the policy, and that the text is exactly the text you agreed to. Each proof is valid only for that encounter.
• Agreement record. When you agree to this policy, the app sends the agreement server your user ID, the policy version and its fingerprint, the device key that signed the agreement, the signature, and the time given by the server. It contains no name or date of birth.
• Account transfer. When you move your account to a new phone, the account, BezOo log, labels, BezOo profiles, credits and free-BezOo status are sent directly from your old phone to your new phone, over an encrypted connection between the two phones. They are not sent to our server. The old phone's copy is erased once the new phone confirms. The server records only that the account's key has moved: the user ID, the old and new device keys, the signature made by the old phone, and the time. It holds no name, date of birth or log content.
• Face ID. Face ID runs on your device, through Apple. The app receives only whether the check succeeded. We never see or store your face.
• Purchases. Apple handles payments. We receive confirmation of your purchases, which tells the app whether you have a membership or credits. Credits are stored on your phone and move with your account when you transfer it.
• Time checks. When you schedule account deletion, and when a scheduled deletion falls due, the app asks our agreement server for the current time over an encrypted connection. These requests contain no personal information.
• Requests to our server. When the app records an agreement or a transfer, or checks the time, it contacts our agreement server. The server can see your phone's IP address, as with any website. It is used only for a moment, to limit how many requests one address can make, and is not stored.
• Nearby connection. Phones find each other over Bluetooth and local Wi-Fi. Their messages, including encounter messages and account transfers, are encrypted end to end.
• Touching phones to connect. On iPhones that support it, the app uses Apple's Nearby Interaction to measure the distance between the two phones, so you can connect by touching them together. The measurement is used only to confirm the phones are touching. It stays on the phones and is not stored.

4. How we use information

We use this information to run encounters, record them, check age, handle purchases, let you move or delete your account, and respond to court orders. We do not use it for advertising, and the app currently contains no analytics or advertising software.

5. Opening sealed information: court orders only

Sealed identity information can be opened only by an attorney, and only in these circumstances:

• The person holding the encounter record exports it from the app and sends it to Zoomy, and
• that request is accompanied by a valid court order that covers the record.

Zoomy does not open the record. It forwards the request to the attorney, who opens only what a valid court order covers. Zoomy cannot open a sealed record, and neither Zoomy nor the attorney can open one in any other way. Nobody can open it from the app or from our systems. Every opening is recorded in a tamper-evident log, and the attorney gives the court or authority only the information the order requires. Where the law permits, the person affected will be told. [Lawyer to confirm the approval process.]

6. Who we share information with

• Apple, for payments, age checks and App Store services.
• The other person in an encounter, as described in section 3.
• The other phone of your own account, when you move the account to a new phone, as described in section 3.
• Zoomy, the attorney and authorities, only when a user sends a record together with a valid court order, as described in section 5.

We do not sell information, and we share nothing else.

7. How long we keep information, and deletion

• Deleting your account. In the Account tab you can request deletion. There is a 7-day waiting period, and you can cancel during it. When it ends, your account, BezOo log, labels, BezOo profiles and encryption keys are erased from your phone.
• Moving your account. When the new phone confirms, the old phone's copy of the account, log, labels and credits is erased at once. No waiting period applies.
• Copies on other phones. We cannot reach phones other than your own. Records already held on other people's phones, including your sealed identity record and encounter messages, are not erased when you delete your account. They remain encrypted, and can be opened only by the attorney under a court order.
• Agreement and transfer records are kept for 31 years from the time they are made. Deleting your account does not erase them, because they hold only your user ID, not your name or date of birth.
• Information opened by the attorney is given only to the court or authority named in the order. Zoomy keeps no copy, and the attorney keeps it only as long as the law requires.
• The court-order log is kept for 31 years. It records when each request was handled and the court order reference, but not the opened information.

8. Security

Information on your phone is encrypted and protected by Apple's hardware security, including the Secure Enclave. Sealed records are encrypted to a key held by the attorney, which is protected by a passphrase. Records sent during a transfer are encrypted end to end between the two phones. No system is completely secure. You help protect your information by keeping your phone locked and up to date.

9. Your rights and choices

Most of your information is on your phone, so you can view it, move it to a new phone and delete it in the app. For other requests, including rights under privacy laws where you live, contact us at [contact method]. We will respond within the time the law requires.

10. Changes to this policy

We will post changes in the app and update the date above. For material changes, we will ask you to agree again before you can use the app.

11. Contact

Zoomy. [Contact method]