Privacy Policy

Effective date: 2026-10-13

This policy explains what personal information Zmina collects, why, and what you can do about it. It covers the Zmina website at zmina.app, our optional product-updates email list (which anyone can join), purchases of the Zmina app, and the app itself.

Who we are

Zmina is developed and sold by Mykhailo Onikiienko, a sole proprietor in British Columbia, Canada.

For privacy questions or requests, contact privacy@zmina.app.

What we collect and why

We keep this short on purpose: we collect as little as possible, and only where there is a clear reason.

If you joined the waitlist

Before launch we ran an email waitlist. On 2026-10-13 we deleted the list and every address on it.

Anyone can choose to receive occasional product-update emails (new releases, notable features, new add-ons), whether or not you own Zmina. This is optional and self-service: you sign up only if you want to, and it is never required to buy or use the app.

If you opt in, we collect:

Your email address
Your IP address and a timestamp, as the record of your consent (required under CASL and GDPR)
The page or referrer you came from, when available

That is all we keep about you on this list.

Your subscription is confirmed by a double opt-in: before we add you, you open the link in a confirmation email and press the button on that page. You can unsubscribe from any email at any time, with a one-click link in every message.

If you buy Zmina

Your purchase is handled by Kelviq, our payment provider and Merchant of Record (see “Who else can see your information”). When you buy, Kelviq sends us the details of the order, such as your name, email address and billing address, the country your IP address is in, the page you came from, the price, any discount code, and your order identifiers. We keep only your email address, your order identifiers, and which product you bought, and use them to generate and deliver your license and to keep a record of the sale. If something goes wrong while we process your order, the order details are sent to our support inbox so we can finish it by hand.

We never receive or store your card number or full payment details. Those are collected and handled by Kelviq under its own privacy policy.

If you use the license recovery page at zmina.app/recover, the email address and order number you enter are used to find and re-send your license. To limit abuse, recent recovery requests are remembered for a short time (minutes, not days).

When you use the Zmina app

The Zmina app collects nothing and sends nothing about you. It runs on your device, with no account, no telemetry, and no analytics.

There is one exception, and it is under your control: the app’s updates. Update checks are on by default, the app tells you about them the first time you run it, and you can turn them off at any time in the app’s settings. When on, the app downloads a couple of small static files from releases.zmina.app, the version information and any security advisory for your version, and checks them on your own device. By default it goes one step further: when a newer version exists, the app downloads the signed release and installs it the next time you quit, so you stay current without doing anything (you can switch this to manual in the app’s settings, in which case the app only tells you an update is ready). Every one of these requests, the version check, the advisory, and the release download, carries no information about you or your license. Your IP address is visible to our content delivery network (Cloudflare) as it would be for any web request; like any site host, Cloudflare can count requests in aggregate, but nothing in a request identifies you, and we do not use these logs for analytics. If you turn update checks off, the app stops making network requests on its own. A “Check for updates” button stays in the app’s settings so you can still fetch a security advisory deliberately; nothing is sent unless you press it.

Your license file is stored only on your device. It contains your email address, unencrypted, so the app can show “Licensed to you” in its settings. That file never leaves your computer, and we do not receive it.

If you email us

Writing to any of our addresses at zmina.app (support@, privacy@, security@, or a personal one like mykhailo@) sends us your email address and whatever your message contains. We use it only to answer you, and you can ask us to delete it at any time (see “Your rights”). If you attach the app’s bug-report bundle, it carries technical logs only; the app never writes what you copy into its logs, and you can open the bundle and remove anything before sending.

When you visit the site

Like any website, zmina.app is served by a hosting provider, Cloudflare, which handles every request to the site. Cloudflare keeps technical logs of those requests: the page or address requested, the page that linked to it, your IP address, your browser’s user agent and language, and an approximate location worked out from the IP address. Cloudflare keeps them for a limited time, which Cloudflare decides, and then deletes them. We do not keep copies. We look at these logs only to keep the site running and to find faults, with one exception: each day we record how many times the Zmina installer was downloaded, and from which countries. Cloudflare adds these up before we see them, so we get totals only, with no IP address and nothing else about who downloaded it, and we keep those totals. We do not build a profile of you from any of this.

Legal basis

For the product-updates list, our basis is your consent, established when you confirm your subscription (CASL; GDPR Article 6(1)(a) for EU and UK residents). You can withdraw it at any time using the unsubscribe link in any email, or by emailing privacy@zmina.app.
For purchases, our basis is performance of our contract with you, to deliver and support your license (GDPR Article 6(1)(b)), and legal obligation, to keep the sales records that tax and business law require (Article 6(1)(c)).
For the app’s updates (the check, and the automatic download and install of new versions), our basis is legitimate interest (GDPR Article 6(1)(f)): keeping software you installed secure and up to date, which the GDPR itself (Recital 49) recognizes as a legitimate interest in network and information security, and which covers applying updates, not just checking for them. These requests send no identifiers, and you can object at any time by turning them off in the app’s settings, after which the app initiates no request of any kind. (A manual “Check for updates” button remains available so that objecting never costs you access to a security advisory. It acts only when you press it.)
For email you send us, our basis is our legitimate interest in reading and answering it (GDPR Article 6(1)(f)).

Who else can see your information

We rely on a small number of providers to operate:

Kelviq, Inc. (payments), our Merchant of Record, processes your purchase and receives the information needed to complete and tax it. It is an independent controller of that payment information under its own privacy policy: https://www.kelviq.com/buyer-privacy/.
Emailit (email delivery) receives your email address and the content of each email we send you: confirmation, launch, and product-update emails, and your license when we deliver or re-send it. It also delivers the notices our server sends us when an order needs fixing by hand, which can include your order details.
Purelymail (our mailbox provider) stores the email you send to any @zmina.app address, our replies, and the notices our server sends us when an order needs fixing by hand, which can include your order details and license.
Cloudflare (hosting, database, and content delivery) stores our data and serves the site and downloads on its infrastructure.

None of these sells your data or uses it for advertising. We do not share your information with anyone else.

Where your information is processed

We operate from Canada, which the EU recognizes as providing adequate protection for data handled in commercial activity. Our email provider, Emailit, is based in the European Union and states that it does not move personal data outside it. Cloudflare and Kelviq are United States companies, so data they handle can be processed in the United States and other countries: Cloudflare under its data processing terms with us, which include the EU’s standard contractual clauses, and Kelviq as an independent controller under its own privacy policy. Our mailbox provider, Purelymail, is also a United States company, so our email can be processed in the United States.

How long we keep it

Product-updates list: kept until you unsubscribe, after which your record is deleted within 30 days. Unconfirmed signups are deleted automatically after 7 days.
Purchase records: kept for as long as Canadian tax and business-records law requires (generally six years from the end of the relevant tax year), then deleted. We keep these even if you unsubscribe from emails, because we are legally required to.
License records: kept for as long as your license is valid, so we can re-send your license if you ever lose it. For a perpetual license that means we keep it until you ask us to delete it, which you can do at any time, understanding that we then cannot recover a lost license for you.
The app: we hold nothing. Your license file stays only on your device.

Children

Our site and email list are not directed at children under 16, and we do not knowingly collect their information. If you believe a child has subscribed, email privacy@zmina.app and we will delete the record.

What we do not do

We want to be specific, because it is the point:

No analytics tools. No Google Analytics, Plausible, Fathom, or anything like them, anywhere on this site. The only count we keep is the daily installer download total described above.
No tracking cookies. This site uses no cookies for tracking. Any cookie that exists is there only to make the site work.
No advertising and no ad pixels. No Facebook pixel, no Google tags, no LinkedIn insight tag, nothing of that kind.
No hidden or pre-checked sign-ups. Our only marketing list is the optional product-updates list, and you are on it only if you asked to be and then confirmed from the email we sent you. We never pre-check a box, auto-subscribe you after a purchase, or buy or rent email lists. If you would rather follow Zmina with no email at all, the changelog has an RSS feed that needs no address.
No selling or trading of personal information.
No telemetry in the app. The app never sends data about you or how you use it. Its only network activity is the update cycle described above, the check plus the download and install of new versions, none of which carries identifiers, and all of which the app stops doing on its own if you turn it off.

Your rights

Under CASL, GDPR, and BC’s Personal Information Protection Act (PIPA), you have the right to:

Access the personal information we hold about you
Correct inaccurate information
Receive a copy of the information you gave us, in a portable format
Delete your information (subject to records we must keep by law, such as purchase records)
Withdraw consent to further email
Restrict our use of your information while a request is being resolved
Object to specific uses

To exercise any of these, email privacy@zmina.app. We respond within 30 days, at no charge.

You also have the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your local data protection authority.

Changes to this policy

If we change this policy in a way that materially affects how we use your information, we will note it here with a new effective date. Where a change affects an active email subscription, we will tell affected subscribers by email and give you the chance to withdraw consent first.

Smaller, non-material changes (clarifications, contact updates) are reflected here with a new effective date.

Contact

privacy@zmina.app for anything about this policy or your personal information. Mykhailo Onikiienko is the designated privacy officer for Zmina.

For general inquiries: support@zmina.app.

Zmina · developed and sold by Mykhailo Onikiienko · British Columbia, Canada