Your Privacy.
Our Priority.

Only the minimum needed to run the service. No phone number, no email, no real name — ever.

• Username and ZQ-Username (chosen by you)
• ZQID (system-generated 7-digit number)
• Bcrypt hash of your password and PINs — never the plaintext
• Encrypted message bodies (X25519 + AES-GCM ciphertext only)
• Encrypted file blobs from the Lock / Unlock vault
• Login metadata: IP address, user-agent, timestamp — for security and abuse prevention
• Device fingerprints for trusted device recognition
• Optional avatar image if you upload one

We do not collect: your real name, phone number, email address, contact list, location (beyond IP-derived hints), photos (beyond avatars you upload), or payment card details (handled by our payment processor).

Your identity inside ZEQAT is a 7-digit ZQID and a chosen username. There is no field for your phone number or email — the registration form doesn't have them.

• No phone number required
• No email address required
• No real name required
• Sign in with username, ZQ-Username, ZQ-zq_username, or ZQID
• Recovery uses a 24-word phrase, not a phone number or email

Two different encryption systems protect two different kinds of data. Here is exactly what's encrypted, and with what.

• Messages: X25519 key exchange + AES-GCM. Private key is generated in your browser and never sent to the server.
• Files (Lock / Unlock): AES-256-CBC via OpenSSL. The key is derived from the password you set — we never see it.
• Passwords & PINs: bcrypt (password_hash()). We cannot recover them, only verify them.
• In transit: TLS 1.2+ on every request. HSTS is enabled via Cloudflare.
• At rest: Passwords, PINs, messages and vault files are encrypted on disk. Metadata (usernames, timestamps, IPs) is stored plain.

We cannot read your messages or your Lock/Unlock files. We can see metadata: who you message, when, how often, and from what IP.

You control who you connect with. There's no contact-book upload, no phone-number lookup, and no address-book sync.

• Friend requests via ZQID or username
• No phone-number lookup
• No contact book upload
• Both parties must accept before messaging begins
• You can remove any friend at any time

A two-folder system: Lock encrypts a file and gives you a downloadable encrypted container; Unlock takes that container back, decrypts it with your password, and returns the original file. Only you hold the password.

• Lock: upload a file or take a photo, set a password, receive an encrypted .zip
• Unlock: upload the encrypted .zip, enter the password, download the original
• AES-256-CBC — key derived from your password, never sent to the server
• Original filename is embedded in the encrypted payload and restored on decrypt
• Both the upload and any decrypted temp file auto-delete after 1 day
• You can delete any file manually at any time
• We cannot open your files. No password, no key, no backdoor.

A short, concrete list of things we don't do — because most privacy policies hide this part.

• We don't sell your data
• We don't run advertising
• We don't use Google Analytics or Facebook Pixel
• We don't profile you for ads
• We don't read your messages
• We don't open your Lock/Unlock files
• We don't recover your password or 24-word phrase

The two external services ZEQAT uses: Cloudflare (network protection, CDN) and OneSignal (push notification delivery, receives a device token — not message content).

Multiple independent layers protect your account. Compromising any single layer does not compromise the account.

• Bcrypt hashing on all passwords and PINs
• Prepared statements (ATTR_EMULATE_PREPARES=false) — no dynamic SQL
• CSRF tokens on every state-changing request
• Strict CSP, X-Frame-Options DENY, nosniff, referrer policy
• Brute-force throttling at per-IP, per-username, and per-PIN levels
• Sliding CAPTCHA after 2 failed password attempts from the same IP
• Device binding for PIN login — a stolen PIN is useless without the trusted device
• Session rotation on login, HttpOnly + SameSite=Lax cookies

You have full control over your data at any time. There is no "email us and we'll think about it" step for most of these.

• Access — everything you've stored is visible in the app
• Delete your account — Settings → Account → Delete Account. Removes your user row, files, and avatar.
• Delete individual content — any message, file, or room you own
• Destroy on demand — arm destruction actions and trigger them from the login screen
• Revoke devices — any trusted device in one tap
• Sign out everywhere — Logout All invalidates every session at once
• Contact us — privacy@zeqat.com for any privacy question or concern

Account deletion removes data from the live system. We can't guarantee that pre-existing backups are purged, and we can't recover deleted data on request.

If we change this policy in a way that materially affects what data we handle or how we handle it, we'll notify you inside the app before the change takes effect. Continued use of ZEQAT after the change means you accept the updated policy.

Current version: September 2026

Questions about this policy? Email privacy@zeqat.com.