Privacy Policy
This policy explains what personal information ZeroPix collects, why we collect it, who can see it, how long we keep it, and the choices and rights you have. It applies to everyone who visits or uses the Service, with or without an account.
Who we are and scope #
ZeroPix (“ZeroPix”, “we”, “us”) runs the photography social network at zeropix.in (the “Service”). We operate from India, and the Service is intended for use in India and is governed by Indian law.
We act as the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) for the personal data we process about you.
For any privacy question or request, write to privacy.zpx@gmail.com. Other ways to reach us are in How to reach us.
In plain words We collect what’s needed to run a photo network, we publish what you choose to post, and we don’t sell your data.
Information we collect #
We collect information you give us, information created as you use the Service, and basic technical information from your device and browser.
| Category | What it includes |
|---|---|
| Account details | Email address (verified with a one-time code), username, display name, and a password. Passwords are stored only as salted one-way hashes — we can’t read them. |
| Optional profile details | Profile photo, bio, location (free text you type), website, phone number, date of birth and gender. All are optional. Your email, phone number, date of birth and gender are not shown on your public profile. |
| Content you post | Photos (up to 5 per post), captions, alt text, hashtags, location text, collaborator tags, comments and replies. Photos are re-encoded in your browser before upload, which drops most embedded metadata. We store the camera, lens, aperture, shutter speed, ISO and focal length when available, and each photo’s dimensions. |
| Messages | Message text, image attachments, replies, likes, pins, edits, message requests, and delivery, read and typing status. |
| Activity and settings | Follows, likes, comment likes, saved posts (private), hidden posts, blocks, mutes, notifications, and your mention, tag and message privacy settings. |
| Reports and applications | Reports you file (reason and up to 250 characters of detail), blue tick applications (category, statement and up to three links), and anything you send us by email. |
| Technical and security data | IP address (used to rate-limit sign-in attempts and recorded in staff audit logs), browser and operating system (used to label saved logins), session identifier, sign-in and last-active times, and post-view records (which post, on what day, and by your user ID — or a session identifier if you’re signed out). |
| Link previews | When you paste a web address in a message, our server fetches that page to build a title, description and image preview, which we cache for up to 7 days. |
| Emails | We send only service emails — verification codes, password resets and security or policy notices. We don’t send marketing email. |
What we don’t collect
- Your device’s location. The location on posts and profiles is text you type; we don’t read GPS from your device or from your photos.
- Your contacts or address book, or access to your camera roll beyond the photos you choose to upload.
- Face-recognition or other biometric data, government ID numbers, or payment details.
Photos can reveal sensitive things about the people in them. Please only post images you’re entitled to share, and see the Community rules.
How we use information #
We use personal information only for the purposes below.
| Purpose | Examples |
|---|---|
| Provide the Service | Creating your account, showing your posts, delivering messages and notifications, building your feed, showing you insights about your own posts. |
| Keep the Service safe | Rate-limiting sign-ins, blocking spam and disallowed content, investigating abuse, protecting accounts. |
| Moderation and enforcement | Reviewing reports, removing content, suspending accounts, handling appeals and blue tick applications. |
| Service communications | Verification codes, password resets, security alerts, notices about these documents. |
| Maintain and improve | Fixing bugs, capacity planning, and aggregate statistics that don’t identify you. |
| Optional profile details | Phone number, date of birth and gender — given with your consent. We use your date of birth only to check the minimum age. Remove the detail from your account any time to withdraw consent. |
| Legal compliance | Responding to lawful requests, meeting record-keeping duties, establishing or defending legal claims. |
Under the DPDP Act, we process personal data based on your consent, given when you create an account and provide information, and for the “legitimate uses” the Act recognises, such as complying with the law.
What we don’t do
- We don’t sell your personal information or use it for advertising.
- We don’t use your photos or messages to train machine-learning models.
- We don’t build interest profiles about you or rank your feed by engagement.
- We don’t combine your information with data bought from third parties.
What is public and what is private #
Public
Your profile (username, display name, profile photo, bio, location, website, verified status, and your followers and following) and everything you post (photos, captions, alt text, location text, camera details, hashtags, collaborators, comments and likes) are public. Anyone can see them, including people without an account.
Because public content is open to the web, it can be found by search engines and copied by others. Deleting something from ZeroPix doesn’t remove copies people or search engines have already made.
Private to you
Your email, phone number, date of birth and gender; your saved posts; hidden posts; blocks and mutes; notification and privacy settings; saved logins; and your insights are visible only to you (and to staff where needed to operate the Service, as described below).
Messages
Messages are visible to the people in the conversation. Message text is encrypted at rest (AES-256-GCM) in our database, but this is not end-to-end encryption: our server holds the key, so it can decrypt a message to deliver it to you. A conversation may be opened for review only by senior staff, and only when it has been reported, or where needed to investigate serious abuse or comply with law — each such access is recorded in an audit log.
You can delete a message for everyone within 30 minutes of sending it. Deleting a chat later removes it from your view only; the other person keeps their copy unless they delete it too.
Cookies and local storage #
We use a small number of cookies and browser storage items. All are essential to the Service or to a preference you set.
| Name | Purpose | Lifetime |
|---|---|---|
PHPSESSID |
Session cookie. Keeps you signed in, protects forms against forgery (CSRF), holds sign-up and email-change steps, and counts unique daily post views for signed-out visitors. HttpOnly, Secure, SameSite=Lax. | Until you close the browser |
zp_remember |
Set only if you choose “Save login info”. Lets you return to, and switch between, up to 5 saved accounts on this browser. The matching secret is stored hashed on our server. | Up to 365 days, or until you remove it |
zeropix-theme |
Local storage item that remembers your light or dark theme. | Until you clear site data |
We don’t use advertising, analytics or cross-site tracking cookies, so there is nothing to opt out of and we don’t show a cookie banner. If that ever changes, we’ll ask for your consent first where the law requires it. You can block or delete cookies in your browser, but the Service won’t work without the session cookie.
International transfers #
ZeroPix is operated from India, and your information is processed on servers we or our hosting provider control. The Service is intended for users in India, so in the ordinary course your information is processed in India. If our hosting or infrastructure provider processes information outside India, the DPDP Act permits transfers outside India except to countries the Government of India has restricted, and we choose providers who protect your information to a comparable standard.
How long we keep information #
| Information | How long we keep it |
|---|---|
| Account and profile | While your account exists. A deactivated account is hidden but kept so you can reactivate it by signing in again. |
| Posts, comments and photo files | Until you delete them or your account. Photo files are removed from storage when a post is deleted. |
| Messages | Until deleted by you (within 30 minutes, for everyone) or until the conversation is removed. When an account is deleted, its conversations are deleted for the other person too. |
| Verification codes | Valid for 10 minutes, then unusable. |
| Sign-in attempt records | Only as long as needed to enforce sign-in limits; cleared after a successful sign-in. |
| Saved logins | Up to 365 days, or until you remove them or log out of that account. |
| Link preview cache | Reused for up to 7 days, then refreshed. |
| Post-view records | With the post. When an account is deleted, its view records are detached from the account. |
| Reports, moderation and audit logs | As long as needed for safety, accountability and to establish or defend legal claims, and longer where the law requires. |
| Backups | Deleted information may remain in backups for a limited period (we aim for no more than 30 days) before being overwritten. |
We may keep information longer where we’re legally required to, or where it’s needed for a pending legal claim or investigation.
Your rights and choices #
Tools in the app
You can do much of this yourself. In Settings you can edit your profile and contact details, decide who can mention, tag or message you, manage blocked accounts and saved logins, and deactivate or permanently delete your account. You can delete your own posts, comments, messages and chats, download a copy of any chat you’re in, and export the insights for your posts.
Rights we extend to everyone
You can ask us to: access the personal information we hold about you and get a copy; correct or complete it; delete it; restrict or object to certain uses; withdraw consent you gave (this doesn’t affect what we did before); and receive your information in a portable format.
Your rights under the DPDP Act
Under India’s DPDP Act you may obtain a summary of the personal data we process and to whom it’s disclosed, ask us to correct, complete, update or erase it, use our grievance process, and nominate another person to exercise these rights if you die or become unable to. If you’re unsatisfied after using our grievance process, you may complain to the Data Protection Board of India.
How to make a request
Email privacy.zpx@gmail.com from the address on your account, or use the tools above. We may ask you to confirm it’s you — for example by replying from your registered email — and won’t ask for more than we need to do that. We acknowledge and respond within 30 days. There’s no charge unless a request is clearly unfounded or excessive.
Account deletion
You can deactivate your account yourself any time from Settings — this hides your profile and content and is reversible by signing back in. You can also permanently delete your account and data yourself, any time, from Settings › Delete account — this removes your profile, posts, photo files, comments and other content from our live systems immediately and can’t be undone. If you can’t sign in, email privacy.zpx@gmail.com (or see Help & Support) with your username, from the email address on your account, and we’ll process the request within 30 days, subject to the retention notes above.
Children #
ZeroPix is for people aged 13 and over. We don’t knowingly collect personal information from anyone younger than 13. If you believe a child under 13 has an account, tell us at privacy.zpx@gmail.com and we’ll delete it.
India’s DPDP Act treats anyone under 18 as a child. If you’re between 13 and 18, you may use the Service only with the permission of a parent or legal guardian, who is bound by these documents on your behalf. We don’t show advertising, track children’s behaviour for advertising, or build profiles of them.
Parents and guardians can contact us at privacy.zpx@gmail.com to review, correct or delete a child’s information.
Security and breaches #
We use measures suited to the risks, including:
- Encryption in transit (HTTPS with HTTP Strict Transport Security) and Secure, HttpOnly, SameSite session cookies.
- Message text encrypted at rest (AES-256-GCM) in our database.
- Salted one-way password hashing, and hashed one-time codes and saved-login secrets.
- Protection against cross-site request forgery, and sign-in rate limiting with temporary lockouts.
- Role-based staff access, re-authentication for sensitive administrative actions, and audit logs of staff actions.
- Restrictions on what uploaded files can be and how they’re served, plus hardened response headers.
No online service is perfectly secure. Use a strong, unique password, and sign out on shared devices.
If something goes wrong. If a personal-data breach is likely to put you at risk, we’ll notify you, and CERT-In and the Data Protection Board of India, within the time limits Indian law requires.
Automated systems and moderation #
Some things are decided automatically, and none of them has a legal or similarly significant effect on you on its own:
- Content filters. When you post or set a name, we check the text against rules for disallowed language, sexual content, illegal activity and spam. If something is blocked, you’ll be told. If you think it was a mistake, contact us.
- Flood and duplicate limits slow down accounts that post or message in bursts.
- Feed and suggestions. Your home feed is the posts of people you follow, newest first, with some discovery posts mixed in. Discovery, Explore and “suggested” people are chosen from recent, sufficiently high-quality posts and recently active accounts, excluding accounts you follow, block or mute and posts you’ve hidden or already viewed. They are not chosen by profiling your interests.
Decisions to suspend or remove an account are made by people.
Links and third-party services #
The Service can link to other websites and shows previews of links people share. We don’t control those sites, and this policy doesn’t cover them. To build a preview, our server requests the linked page, so the site you link to may see a request from our server — not from you. Please read the privacy policy of any site you visit.
Changes to this policy #
We may update this policy. We’ll change the “last updated” date and version above and record the change in the version history. For material changes, we’ll give you notice in advance, by email or in the app, and where the law requires it we’ll ask for your consent again.