ZapKoda Privacy Policy
Last updated: 25 October 2026
Who we are
ZapKoda keeps your contacts on your own phone and sends only what is needed to our servers to run credits and AI text. ZapKoda is an Android app published by AppKoda ("we", "us").
This policy explains what data ZapKoda uses, where it is stored, who processes it and for how long. Questions or requests: wattibuilds@gmail.com.
Data stored only on your device
Your contacts stay on your phone. ZapKoda does not automatically send contact names or phone numbers to AppKoda or OpenAI.
Stored locally in ZapKoda's own storage on your device:
- Contact names and phone numbers you add
- Each contact's status (In, Unknown, Out) and where permission was recorded
- Opt-outs, which stay remembered even if you remove the contact
- Your sender name, message drafts, chosen language, country and settings
- Progress of a running Turbo-Zap session
You add contacts yourself: by typing, pasting, importing an Excel/CSV file, or sharing contacts from your Contacts app to ZapKoda ("Share > ZapKoda"). ZapKoda does not ask for permission to read your address book; it only receives the contacts you choose to share. Clearing ZapKoda's app data or uninstalling the app deletes this local data.
If Android backup is turned on for your phone, Android may include ZapKoda's local data in your own device backup in your Google account. That backup is managed by Google and your Android settings; AppKoda has no access to it.
Data processed on our servers
Our servers (Google Firebase) hold only what is needed to run your credits, AI text and security. You do not need to give us your name or email address.
- Anonymous account. ZapKoda signs you in with an anonymous Firebase account. It has a random user ID (UID) and is not linked to your name.
- Credits. Your free and purchased credit balance, the current month and simple usage counters (for example, how many AI requests in the last minute) are stored with your UID.
- AI requests. For each AI text request we store a request ID, its status, the credit type used, timestamps and the generated text. The text you type in "Describe" is not stored. These records are set to expire 30 days after they are created and are then deleted automatically. The actual deletion can take place some time after the expiry date.
- Turbo-Zap sessions. We store technical session data: your UID, a session ID, the number of credits reserved and used, status and timestamps. No contact names, phone numbers or message texts are sent to our servers.
- Purchases. Credit purchases go through Google Play and are verified on our server. We store your UID, the product, the credits added, the Google Play order ID, whether it was a test purchase and its status. The purchase token is stored only as a one-way hash. We never receive your payment card details.
- Security checks. Firebase App Check with Google Play Integrity checks that requests come from the real ZapKoda app on a genuine device.
- Technical logs. Google Cloud keeps technical server logs (such as UID, time of a request and error details) for security and troubleshooting, for a limited period (by default about 30 days).
AI text (OpenAI)
When you tap Generate, only the text you typed in "Describe" and the chosen language are sent, through our server, to OpenAI to write the message.
- Sent to OpenAI: your Describe text, the chosen language and our fixed writing instruction.
- Not sent automatically: ZapKoda does not automatically send contact names, phone numbers or your sender name. Information you choose to type in Describe is sent as entered.
- Kept by us: the generated text, until it expires after 30 days (see above). Your Describe text is not stored by us.
- Kept by OpenAI: OpenAI processes this data under its API terms. Under its current API data policy, inputs and outputs may be kept for a limited period (currently up to 30 days) for abuse monitoring unless the law requires longer, and are not used to train its models by default. See OpenAI's privacy policy.
Please do not type personal or sensitive information about other people in "Describe".
Turbo-Zap, WhatsApp and SMS
ZapKoda does not send messages itself. Turbo-Zap opens WhatsApp, WhatsApp Business or your SMS app on your phone with the message ready, and you press Send yourself.
The personalised message and the phone number are handed directly from ZapKoda to that app on your device; they do not pass through our servers. Once you send, the message is handled by WhatsApp or your SMS provider under their own privacy policies. Contacts marked Out are always skipped.
Service providers, ads and tracking
Our main service providers are Google and OpenAI.
| Provider | What for |
|---|---|
| Google (Firebase, Google Cloud, Google Play) | Anonymous account, credit balance, server functions, security checks, logs, app distribution and purchases |
| OpenAI | Writing the AI message from your Describe text |
Our servers run in the United States (Google Cloud region us-central1), so data may be processed outside your country. Google and OpenAI provide safeguards for such transfers, such as the EU Standard Contractual Clauses.
ZapKoda shows no advertisements, contains no analytics or crash-tracking tools, and we do not sell or rent personal data. The app's font is built into the app, so no font is loaded from the internet.
How long we keep data
AI records expire after 30 days and are then deleted automatically. Technical logs are retained according to Google Cloud's applicable retention periods. Account and purchase records stay as long as they are needed.
| Data | Where | Kept for |
|---|---|---|
| Contacts, statuses, drafts, settings | Your device | Until you delete them, clear app data or uninstall |
| Describe text | Not stored by us | Not stored (OpenAI: limited period, see above) |
| AI requests and generated text | Our server | Expire after 30 days, then deleted automatically (deletion can take a little longer) |
| Technical server logs | Google Cloud | Limited period (by default about 30 days) |
| Credit balance and Turbo-Zap session records | Our server | Until you ask us to delete them |
| Purchase records | Our server | As long as required by law (for example up to 7 years for accounting records) and for fraud prevention |
Your rights and choices
You can ask us to access or delete the data linked to your account by emailing wattibuilds@gmail.com. Purchase records that we must keep by law are kept for that period, even after a deletion request.
- Legal basis. We process data to provide the service you ask for (credits, AI text, purchases) and for our legitimate interest in keeping ZapKoda secure and preventing fraud.
- Your rights. Depending on where you live (for example under the EU GDPR), you may have the right to access, correct, delete or restrict your data, to object, and to complain to your data protection authority.
- Deleting your data. Data on your phone you can delete yourself at any time by clearing ZapKoda's app data or uninstalling the app. Uninstalling does not delete the server records of your anonymous account. Because that account is anonymous, we may ask for details to find it, for example the Google Play order ID of a purchase or the approximate date you used the app.
- Children. ZapKoda is built for personal, professional and productive communication and is intended for users aged 18 and older. It is not directed to children.
- Your contacts. You decide who you message. Only send messages to people who expect them, and respect opt-outs.
- Changes. If we change this policy, we will update the date at the top of this page.
Contact: AppKoda · wattibuilds@gmail.com