Privacy Policy

Last updated 14 October 2026

This policy explains what Zukiru collects, why, and what you can do about it. Zukiru is operated by Zukiru Technologies of Tulcea, Romania, which is the data controller for the personal data described here. For anything in this policy, write to [email protected].

1. What we collect

What you give us

  • Account details — your email address, username and password.
  • Profile — display name, bio and avatar image, all optional but the name.
  • Content — your posts, replies and reposts, and any images or videos you upload with them.
  • Social graph — who you follow, who follows you, and who you have blocked.
  • Purchases — if you buy zubits, we record that the purchase happened and what it credited. Your card details are typed on the payment provider's own pages and never reach us: we neither receive nor store a card number.
  • Promotions — if you promote a post, how many views you bought, what it cost and how many have been delivered.
  • Reports — when you report a post or an account, we store what you reported, the reason you chose and any details you type.

What we collect automatically

  • Session records — each time you sign in we record the IP address and browser user-agent string of the device, and the time. You can see this yourself, for every signed-in device, under Sessions.
  • Reading activity — which posts in your feeds reached your screen, where they sat in the feed and roughly how long they stayed visible. We use it only to rank your feeds, so they stop repeating posts you have already seen. It is never used to choose promoted posts.
  • Server logs — ordinary request logs kept for security, abuse prevention and debugging.

What we do not collect

Zukiru carries no analytics and no third-party tracking scripts. Nothing on the site profiles you in order to target advertising, and no data is sold or shared with advertisers.

Zukiru shows promoted posts, and they work differently from most advertising. A promotion is bought by another Zukiru user with zubits, over a post they wrote themselves. There is no advertising network, no third party and no external ad server involved: a promoted post is an ordinary Zukiru post that someone paid to have shown more widely.

Which promoted post you see is picked at random from the campaigns currently running. It is not chosen from your profile, your posts, who you follow or anything else about you. The only things that change what you are shown are the people you have blocked, who are excluded in both directions, and your own promoted posts, which you are never shown.

When a promoted post is served to you, that counts as one view against the campaign that paid for it, and that is the whole of what is recorded. The promoter is told how many views their campaign has delivered — a number — and is never told who saw it. Every promoted post carries a Why this ad? link that explains this in the app.

2. What is stored in your browser

Zukiru sets no cookies. It stores exactly three items in your browser's local storage:

  • zukiru.session — the tokens that keep you signed in. Clearing it, or signing out, removes them.
  • zukiru.theme — whether you chose the light or the dark theme.
  • zukiru.feed — which feed you chose to open the app on.

3. What is public

Zukiru is a public service. Your username, display name, bio, avatar, posts, replies, reposts and your follower and following lists are visible to anyone, signed in or not, and may be indexed by search engines.

Images, videos and avatars are served from our media host by id. Those addresses are not access-controlled: anyone holding the link can open the file directly, and it stays reachable while it is hosted. Your email address and your session records are never public.

4. Why we use it

  • to create and run your account, and to keep you signed in;
  • to show your posts to other people, and theirs to you;
  • to send you service email — address verification, password resets, email-change confirmation;
  • to keep the service secure, and to investigate abuse and enforce our terms;
  • to comply with legal obligations.

5. Legal bases

Where the GDPR or a similar law applies, we rely on:

  • Performance of a contract — running the account and delivering the service you asked for.
  • Legitimate interests — security, abuse prevention, moderation and keeping the service working, balanced against your rights.
  • Legal obligation — where we must retain or disclose something by law.
  • Consent — where we ask for it, and which you can withdraw at any time.

6. Who we share it with

We share personal data only with service providers acting on our instructions — hosting, storage, email delivery, and payment processing — and only as far as they need it to provide that service. We also disclose data where we are legally required to, or where it is necessary to protect the safety of a person or the integrity of the service. We do not sell personal data.

Payments. Buying zubits is optional, and it is the only part of Zukiru that involves money. When you buy a pack we hand you to a payment provider, which shows the price, takes the payment on its own pages and tells our server that it cleared. What you type there — card or account details, and whatever billing information it asks for — goes to that provider under its own privacy policy, not to us. Nothing about a purchase is shown on your profile or to anyone else.

7. International transfers

We are established in Romania and your data is processed within the European Economic Area wherever we can arrange it. Where a provider processes data outside the EEA, we rely on an appropriate safeguard for the transfer, such as an adequacy decision or the European Commission's standard contractual clauses.

8. How long we keep it

Your content stays until you delete it or your account. Session records last until that session is revoked or expires.

Deleting your account hides everything at once and revokes every session, but is reversible: signing in again within 30 days restores the account and its content. After 30 days the account is not restorable. Your email address and username stay reserved indefinitely so they cannot be registered again by someone else.

An account that never verifies its email address has its username and email address released after a grace period.

Records of purchases are kept for as long as accounting and tax rules require, which can be longer than the account they belong to.

Reading activity is kept for 3 days.

Backups and logs are kept for a limited period on their own retention schedule.

9. Your rights

Depending on where you live, you have the right to access your data, correct it, delete it, object to or restrict how we use it, and receive a copy in a portable form.

Some of these are self-service and take effect immediately:

For anything else, write to [email protected]. We may need to verify that the request comes from you.

If you are unhappy with how we handle it, you can complain to a supervisory authority. Ours is the Romanian one — Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28–30, Sector 1, 010336 Bucharest, dataprotection.ro. If you live elsewhere in the European Union, you may complain to the authority in your own country instead.

10. Security

Traffic to Zukiru is encrypted in transit. Passwords are stored hashed, never in the clear. Sign-in tokens are short-lived and rotate when they refresh, and every session can be revoked individually from your settings. No service can promise perfect security, but if a breach affects you we will notify you as the law requires.

11. Children

Zukiru is not for people under 16, which is the age Romania applies under Article 8 of the GDPR. We do not knowingly collect data from them, and we delete such an account when we learn of it. If you believe a child has an account, tell us at [email protected].

12. Changes to this policy

We may update this policy. The date at the top always reflects the current version, and we will make a reasonable effort to tell you before a material change takes effect.

13. Contact

Privacy questions and data requests go to [email protected]. Other ways to reach us are on the contact page, and our terms of service cover the rest of the relationship.