Legal

Privacy Policy

Effective August 5, 2026

This policy covers both this website and the ZENO desktop application. ZENO is developed and operated by Plamen. For support or inquiries regarding this policy, please contact support@zenoapp.net

1. Who we are

ZENO is a desktop application developed and operated by Plamen IT. This policy explains what data the website and the desktop app process, why, and what rights you have over it.

2. The desktop application

2.1 What stays on your machine

Everything you create — vault entries, boards, cards, notes, calendar events, transactions, links and canvases — is written to a single encrypted SQLite database in your operating system's per-user application data directory. We have no server that receives it, and no ability to read it.

The database is encrypted at rest with a key held in your operating system's keychain (DPAPI on Windows, Keychain on macOS, libsecret on Linux). Vault entries are additionally protected by a master password that only you know. We cannot recover that password, and we cannot decrypt your data.

2.2 What the app collects, and what it never does

The desktop app shares anonymous usage statistics with our analytics provider, TelemetryDeck: a random identifier generated on your device (not your name, email, or an account — there is no account), your app version, operating system, architecture and language, and which of a small set of signals occurred (the app was installed, opened, or is still in regular use). This is on by default, disclosed the first time you open the app, and can be turned off anytime in Settings → Privacy — the change takes effect immediately.

What is never collected, sent, or included in that data: your vault, boards, notes, finances, links, canvases — anything you create — or any file path, filename, or command you run.

There is no account to create and no identifier tied to your name or email. The application window itself is prevented at the process level from making network requests of its own — every connection described below is made from the application's main process, never the interface you interact with.

2.3 Connections the app makes, and what triggers them

• Anonymous usage statistics — sent automatically, on by default, to TelemetryDeck. See 2.2 for exactly what this includes and how to turn it off.
• Update checks — periodically, the app checks our download server for a newer version. This request includes your app version and operating system and nothing else. Downloading and installing an update always require your say-so.
• S3-compatible storage backup — only if you configure one. You supply your own endpoint, bucket and access keys for a provider of your choosing (Cloudflare R2, Backblaze B2, AWS S3, and similar all work). Snapshots are encrypted before upload; that provider stores ciphertext.
• SFTP backup — only if you configure it. Snapshots are encrypted before transfer and sent to a server you specify and control.
• Favicons — when you save a link, the app may fetch that site's icon from that site. This reveals your request to that website, as visiting it would.
• Exchange rates — if you use the finance module with more than one currency, the app fetches public reference rates. No account data is sent.
• Opening a link — launching a bookmark hands the URL to your browser, exactly as clicking it anywhere else would.

Usage statistics and update checks are the two connections the app makes on its own; the first can be turned off in Settings, the second never downloads or installs anything without your action. Backup destinations are off until you configure one; favicon fetching and exchange rates are incidental to using those features.

3. This website

The website is a set of static pages. It sets no cookies, runs no advertising, and does not build a profile of you.

The site is hosted on Vercel and installers are served from Cloudflare R2. As with any web host, those providers process standard server request data (IP address, user agent, requested URL, timestamp) in order to deliver the page and the file. We do not combine that with anything else or use it to identify you.

The download buttons detect your operating system in your browser, purely to highlight the right installer. That detection never leaves your device.

4. Legal basis and retention

We hold no data tied to your identity — no name, no email, no account. The anonymous usage statistics described in §2.2 are processed on the basis of our legitimate interest in understanding how the app is used and improving it, are handled by TelemetryDeck as our sub-processor for that purpose, are retained according to TelemetryDeck's own retention policy, and are not re-identifiable back to you. Server logs held by our hosting providers are retained according to their own standard periods.

5. Your rights

Under the GDPR and similar regimes you have rights of access, rectification, erasure, restriction, portability and objection. Because we do not hold personal data about you, most of these have no data to act on. Your ZENO data is in your possession: you can export it, back it up, or delete it by removing the application's data directory. If you believe we hold data about you, write to support@zenoapp.net.

6. Children

ZENO is not directed at children under 13, and we do not knowingly collect data from them.

7. Changes to this policy

If this policy changes materially, the effective date above will change and the updated version will be published on this page.