Your Privacy and Choices

Privacy Policy

Last updated: September 9, 2026

Zamily is a product of Xelora PTY LTD, an Australian company committed to protecting your family's privacy. At Zamily, privacy isn't an afterthought—it's the foundation of everything we build. We understand that sharing your location with family requires an enormous amount of trust, and we take that responsibility with the utmost seriousness. This Privacy Policy explains exactly what data we collect, how we use it, and—most importantly—how we protect it.

Our Core Privacy Principles

What Information We Collect

We are transparent about every piece of data we collect. Here's exactly what we gather and why:

1. Location Information

Location data is the core of our service. When you use Zamily, we collect:

• Real-time GPS coordinates — To share your current location with your family (as shown in the app)
• Background location updates — Only when you grant permission, to keep your family updated even when the app isn't open
• Place (geofence) events — When you enter or leave saved zones (e.g. home, school)
• Trip data — Routes, start/end times, and duration when automatic trip tracking is enabled
• Speed information — To detect driving mode and provide driving safety alerts

Retention: Trip history is retained according to your plan—7 days on the free tier and up to 90 days for Premium (as implemented in the service). Other location-related data may be stored only as long as needed to operate features you use.

2. Account Information

• Email address — Required for account creation, login, and important communications
• Name — Displayed to members of your family in the app
• Profile photo (optional) — Only if you choose to upload one
• Phone number — Collected at registration and used for account and safety features as described in the app
• Family memberships — Who you've invited and who has invited you (see Settings → Family)

3. Device Information

We collect minimal technical data to ensure the app functions properly:

• Device type and OS version — For compatibility and troubleshooting
• Device ID — To link your account to your device securely
• Battery level — Shared with your family so they know if your phone is low on charge
• App version — To provide updates and support

4. Diagnostics & product improvement

We may process aggregated or technical data to keep the app reliable and improve features (for example, performance metrics or error diagnostics). Where we can, we minimise personal identifiers. Exact tooling may change over time; we do not use this for third-party advertising.

5. Optional family and emergency information

You may choose to save emergency contact names and phone numbers, medical information and notes in your profile. A parent or guardian may add a child profile with a date of birth and emergency contact information. We store these fields on our servers for family and safety features; relevant family members may see them according to their role. These fields are optional. Only provide information you are entitled to share, and tell your emergency contacts how their details are used. You can clear optional fields in the relevant profile and save your changes.

6. Family and direct messages

We collect the text you send to your family group or to an individual family member, together with sender, recipient, timestamp and reply information. Messages are transmitted over HTTPS and stored on api.zamily.app until the sender deletes them. This is server-stored messaging, not end-to-end encrypted messaging. Messages are used to deliver conversations, not for advertising or tracking. Notification delivery may send the sender name, identifiers and a short message preview through Firebase Cloud Messaging, as described below.

Profile photos remain optional. Photo attachments in family conversations are currently disabled in the release; the disabled feature does not upload message photos.

What We DO NOT Collect

Just as important as what we collect is what we deliberately do NOT collect:

• Contacts from your phone — We don't access your address book
• Photos or media — Only your optional profile photo
• SMS and email contents — We do not read your phone's SMS inbox or email inbox. Messages sent within Zamily are collected as described above
• Browsing history — We don't track what websites you visit
• Biometric data — No fingerprints or face scans. Optional medical information is described above
• Street-address profiles — We do not require you to type a full postal address. Location is based on GPS coordinates; the app may show approximate labels (for example, road or area names) using reverse geocoding for display only

How We Use Your Information

1. To Provide Our Core Service

The primary purpose of data collection is to share your real-time location with your designated family members in the app. This enables:

• Live location sharing on the map
• Arrival and departure notifications
• SOS alerts in emergencies
• Place (geofence) entry/exit alerts
• Trip history and driving summaries

2. To Improve the App

We use aggregated or technical information (as described under "Diagnostics & product improvement" above) to:

• Identify and fix bugs
• Understand which features are most valuable
• Optimize battery usage and performance
• Plan new features based on user needs

3. To Communicate With You

We may send you:

• Security alerts — If we detect suspicious activity on your account
• Service notifications — Important updates about the app
• Support responses — Replies to your inquiries
• Product updates — Information about new features, improvements, or changes to Zamily

4. Marketing Communications (From Xelora PTY LTD Only)

With your consent where we ask for it, or as otherwise allowed under applicable law, Xelora PTY LTD may occasionally send you information about:

• New apps or software products developed by Xelora PTY LTD
• Related family safety services or features
• Special offers or promotions for Xelora PTY LTD products

Important: These marketing communications come exclusively from Xelora PTY LTD about our own products. We never share your email address or personal information with third parties for their marketing purposes. Service-provider processing is described below.

Opt-Out: You can unsubscribe from marketing emails at any time by clicking the "Unsubscribe" link in any email or by contacting us at Email Privacy. Even if you opt out of marketing, you'll still receive essential service communications (security alerts and, when in-app purchases are available, billing-related notices).

How We Protect Your Data

Encryption Standards

Access Controls

• Only you and members of your family group in the app can see your shared location as designed
• Operational and support access is limited to what is needed to run the service and comply with law
• Administrative access is limited to essential personnel only
• Operational logs help us investigate errors and security incidents

Data Retention & Deletion

Data Type	Free Users	Premium Users
Trip history (Driving tab)	Up to 7 days	Up to 90 days (as implemented in the service)
Places (saved zones / geofences)	Up to 4 Places	Unlimited Places (as implemented in the service)
Account Data	Until account deletion, subject to the retention exceptions on our account deletion page

Your Rights & Controls

You have complete control over your data. You can:

Access Your Data

You may request a copy of personal data we hold about you by emailing Email Privacy. We will respond within a reasonable time and as required by applicable law (typically within 30 days where the Australian Privacy Act applies).

Correct Your Data

Update your display name and phone number under Settings → Profile. Changing your sign-in email may require contacting support if not available in the app.

Delete individual data without deleting your account

In a conversation, long-press a message you sent and choose Delete. You can also clear optional medical information, notes and emergency contacts in your profile and save the changes. These actions do not require deleting your account. A recipient may already have seen a notification, copied the message or taken a screenshot; deleting from Zamily cannot remove those copies. For help with a deletion request, email Email Privacy and identify the information you want removed without sending unnecessary sensitive details.

Delete Your Account

Permanently delete your account and all associated data:

• All location history will be permanently erased
• Your profile and account information will be deleted
• You'll be removed from every family you're connected to in the app
• Backup and legally required retention exceptions are explained on our account deletion page

To delete your account: Open the Settings tab, scroll to the bottom, and use Delete Account (not available for child accounts managed by a parent), or email Email Privacy

Export Your Data

If you need a structured export, ask us at Email Privacy. The mobile app may not include a full self-serve export button in every version.

Control Location Sharing

• Adjust location permission in your device settings (e.g. "always" vs "while using")—this affects how often we can update your position
• Leave a family or adjust membership from Settings → Family where your role allows
• On Premium, configure Quiet Hours (under Settings) to reduce non-emergency notifications during chosen times

Children's Privacy

Zamily includes parent-managed child profiles and location sharing. Parents and guardians should review the data collected and the people in their family group before enabling these features:

• Children under 13 cannot create accounts independently
• Parents or legal guardians must create and manage accounts for children
• Child profiles and devices can provide location and other information needed for enabled family features
• Parents can review, delete, or refuse further collection of their child's data
• To exercise parental rights, contact us at Email Privacy

Third-Party Services

The following services process data when you use the relevant features:

Cloud infrastructure

Our backend runs on secured cloud infrastructure with access controls appropriate to the data we process. Specific providers may change; we use data processing arrangements that require protection of personal information.

Payment Processing

We do not sell subscriptions or take payment on zamily.app—you cannot enter a card number or pay for Zamily on this marketing site.

When Premium is a paid service, purchases are completed inside the mobile app through the platform store: Google Play on Android and the App Store on iOS (when available). We never see or store your full payment details; billing is handled by Google or Apple under their respective payment and privacy terms.

Push notifications (Firebase Cloud Messaging)

The Android app uses Google Firebase Cloud Messaging (FCM) to deliver push notifications. Google processes device tokens and notification payloads needed to route messages. Payloads can include sender names, identifiers, avatar references and message previews or family-event details. Notifications may appear on your lock screen depending on your device settings; see Google's Privacy Policy for how Google handles data.

Google Maps on Android

The Android app uses Google Maps SDK for Android to display maps and traffic. The SDK automatically sends request and device metadata, crash stack traces and metrics, IP addresses and a Maps-specific pseudonymous identifier to Google. Map interactions such as panning and zooming may also be processed when camera APIs are used. Google uses this technical information to maintain and improve its services. This processing is separate from the family messages stored on our servers.

See Google Maps SDK data disclosures and Google's Privacy Policy.

Phone verification (Firebase Authentication)

When you verify a phone number, Firebase Authentication processes the number and technical verification information to authenticate it and prevent abuse. Google may send a verification SMS. This processing is covered by Google's privacy information linked above.

Legal Disclosure Exceptions

We will only disclose your information in the following limited circumstances:

• Legal Requirement: If required by law, court order, or legal process
• Emergency: If we believe disclosure is necessary to prevent imminent harm
• Business Transfer: If Zamily is acquired, users will be notified before any data transfer

International Data Transfers

Your data is stored on secure servers. As an Australian company, we primarily operate within Australia and comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are located outside Australia, your data may be transferred to and processed in Australia or other jurisdictions where our service providers operate. We ensure appropriate safeguards are in place for all international transfers in compliance with Australian privacy laws.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes:

• Through the app notification system
• By email (for material changes)
• By updating the "Last updated" date at the top of this page

Where a change requires your consent, we will request it separately. This policy describes our processing and does not replace any consent required by law.

Contact Us

If you have any questions about this Privacy Policy, your data, or your rights, please contact our privacy team: