Privacy Policy

Last updated: August 2026

zenow ("we", "us") provides a study-planning service ("the Service"). This policy explains what personal data we collect, why, and what rights you have. It applies to everyone who visits or uses zenow.

1. What data we process

• Account data — your email address and a hashed password (we never store passwords in plain text).
• Content data — the calendar events, academic items, study plans, lists, and preferences you create in the Service.
• Billing data — payment processing is handled by Stripe. We store only what we need to manage your subscription (plan, status, identifiers), never your card details.
• Technical data — basic server logs (IP address, time, requested pages) and error reports (via Sentry) used to keep the Service reliable and secure.

2. Cookies

We use one essential cookie (connect.sid) to keep you signed in. It is strictly necessary for the Service to work, is httpOnly and sent over HTTPS only. No consent is required for it.

We do not use advertising, analytics, or tracking cookies. We do not sell or share your data with advertisers.

3. Why we use your data

• To provide the Service — creating and syncing your calendar and study plans (contract).
• To keep the Service secure and improve its reliability (legitimate interest).
• To process payments and send transactional emails (contract / legal obligation).

4. Third parties

• Stripe — payment processing. Their privacy policy applies to payment data.
• Resend — transactional emails (account confirmation, password reset, notifications).
• Sentry — error monitoring. No personal data beyond technical context is intentionally collected.
• Database & hosting provider — where your account and content data are stored.

5. Retention

We keep your account and content data until you delete your account, then remove it within 30 days. Session data expires automatically after 30 days. Billing records are kept as long as required by tax law.

6. Security

All traffic is encrypted with TLS. Passwords are hashed with bcrypt. Session cookies are httpOnly, SameSite=Lax, and scoped to the Service.

7. Your rights

Under the GDPR and other applicable laws, you may:

• Access a copy of your data.
• Ask us to correct inaccurate data.
• Ask us to delete your data (including deleting your account).
• Receive your data in a portable format.
• Restrict or object to processing where it relies on legitimate interest.
• File a complaint with your local data protection authority (in Italy, the Garante per la protezione dei dati personali).

To exercise any of these rights, contact us at [email protected]. We respond within 30 days.

8. Contact

Questions about this policy? Email [email protected].