Zalfol is built for people who already carry enough. We collect the minimum data needed to make the app work, we never sell your data, and the sensitive things you log — your emotions, urges, and private messages — stay locked to your account. This policy explains exactly what we collect, why, and the limited data we share with the services that run the app.
1. Who We Are
Zalfol (زالفول) is operated by Eslam Osama Elgwaily, an individual developer based in Egypt. "We," "us," and "our" refer to Eslam Osama Elgwaily operating under the Zalfol name.
Contact: korion.x@gmail.com
2. What We Collect
Account information
When you sign up, we collect your email address and any display name you choose. This is used to identify your account, send you transactional emails (password resets, subscription receipts), and nothing else.
App usage data
We store the data you create inside Zalfol — projects, tasks, goals, and other content you enter. This data lives in your account and is used only to provide the app's functionality to you.
Some of what you log is sensitive — your emotions and "Heart" entries, urge/impulse logs, and messages to an accountability sponsor. We treat these with extra care: they are private to your account, never sold, never used for advertising, and used only to provide the features you chose to use.
Payment information
Payments are processed by LemonSqueezy. We do not see, store, or have access to your credit card number or any raw payment data. LemonSqueezy handles all payment processing and is subject to their own privacy policy. We receive only confirmation that a payment was made and your subscription status.
YouTube data (optional)
With your consent, the Zalfol Chrome extension reads the channel/topic of YouTube videos you watch to show an "alignment" signal for your chosen learning field, and records a minimal log (video id, channel, your field, timestamp) to compute that score over time. This is only active when you install the extension and connect your account. We do not access your comments, private playlists, or account settings. You can disconnect at any time and request deletion of this log.
Separately, if you connect your YouTube account inside Disciple Mode via Google OAuth, we request read-only access to your YouTube subscriptions (youtube.readonly scope) to calculate the same alignment score. We do not store your subscription list beyond the duration of that calculation. You can revoke this access at any time from your Google Account settings.
Analytics
We use Google Analytics and PostHog to understand how the app and blog are used (page views, sessions, general usage patterns) so we can improve them. These tools collect usage and device data subject to Google's and PostHog's privacy policies.
3. Ask Zalfol (the assistant)
Ask Zalfol is an optional assistant that answers questions about ADHD and about Zalfol, grounded in our own published articles. When you use it, we store your conversation (your messages and its replies) linked to your account, so your history is available to you across the app, blog, and extension, and so we can monitor quality and improve the assistant and our content. Your conversations are private to your account, are never sold, and are not used for advertising. We may review conversations in aggregate and de-identified to find gaps and fix poor answers; we do not browse individual users' chats for any other purpose. You can delete your conversations, or your whole account, at any time (see Your Rights). Ask Zalfol runs on Anthropic's Claude API and a Cloudflare text-search service; messages are sent to these providers to generate answers and are governed by their terms (and are not used to train their models under those terms).
4. What We Do Not Collect
- We do not collect your location beyond the country level
- We do not sell, rent, or trade your personal data to any third party
- We do not send marketing emails — only transactional messages related to your account
- We do not use the content you create — your projects, notes, emotions, or Ask Zalfol conversations — to target advertising
5. How We Use Your Data
- To create and maintain your account
- To provide, operate, and improve the Zalfol app, blog, and extension
- To process payments and manage your subscription through LemonSqueezy
- To send transactional emails (account-related only)
- To calculate your YouTube alignment score when you connect YouTube or the extension
- To power Ask Zalfol and to improve its answers and our content
- To understand aggregate usage patterns via Google Analytics and PostHog
- To measure whether our ads lead to sign-ups, via the Meta and Reddit pixels (see below)
6. Advertising & Conversion Measurement
We use the Meta (Facebook) Pixel and the Reddit Pixel to measure whether our ads and posts lead to sign-ups and subscriptions. These tools send limited event data (e.g. that a registration or purchase occurred, plus device/browser identifiers) to Meta and Reddit, who process it under their own privacy policies. We do not upload your name, email, or the content you create to these platforms. You can limit this tracking through your browser settings and your Meta/Reddit ad preferences.
7. Data Storage and Security
Your data is stored securely using Supabase, a cloud database provider. Data is encrypted in transit (TLS) and at rest. Supabase operates infrastructure subject to industry-standard security practices.
We take reasonable technical and organizational measures to protect your data. No system is completely secure, but we treat your data with the seriousness it deserves.
8. Third-Party Services
Zalfol integrates with the following third-party services, each governed by its own privacy policy:
- Supabase — database and authentication hosting
- LemonSqueezy — payment processing
- Google OAuth / YouTube API — optional YouTube alignment feature
- Google Analytics — aggregate usage analytics
- PostHog — product analytics (usage events, session data; US-hosted)
- Meta Platforms — advertising / conversion pixel
- Reddit — advertising / conversion pixel
- Cloudflare — AI text-embedding for the Ask Zalfol search feature
- Vercel — app hosting and deployment
- Resend — transactional email delivery
- Anthropic Claude API — AI features, including Ask Zalfol (your project data and Ask Zalfol messages may be sent to Anthropic to generate responses; this data is not used to train Anthropic's models under their API terms)
9. Your Rights
You have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — ask us to correct inaccurate data
- Deletion — request deletion of your account and associated data, including your Ask Zalfol conversations
- Revoke YouTube access — disconnect YouTube or the extension at any time via Google Account settings or from within the app
To exercise any of these rights, email us at korion.x@gmail.com. We will respond within 30 days.
10. Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain certain records (e.g. financial transaction records, which LemonSqueezy retains on their side).
11. Children's Privacy
Zalfol is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us and we will delete it promptly.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Zalfol after changes are posted constitutes acceptance of the updated policy. For significant changes, we will notify active users by email.
13. Contact
Questions about this policy or your data:
Eslam Osama Elgwaily
korion.x@gmail.com
This policy was last updated on June 9, 2026.