Privacy Policy

The short version

• Your photos never leave your device. The app captures, stamps and saves them into your phone storage and gallery.
• No account. No email, no password, no access to your contacts.
• Location is used only to stamp the photo and to fetch local weather. There is no journey tracking and no background location collection.
• Only when you tap Share does the stamped text (time, coordinates, address, note) go to our server so the recipient can verify it — still without the image itself.
• Payments are handled by the App Store and Google Play. The app never sees or stores your card details.
• No advertising. The app shows no ads in any tier and embeds no advertising or advertising-tracking SDK.

1. Who is responsible for your data

The Z-TimePhoto app (package vn.com.zsoft.ztimephoto) and the website z-timephoto.z-cloud.com.vn are published and operated by Z-Soft Co., Ltd., Vietnam.

For any question, deletion request or privacy complaint, write to support@z-cloud.com.vn.

2. Where your photos live

Photos taken with the app are written to your device storage and to the system photo gallery. They remain entirely under your control: uninstall the app or delete the photos and they are gone — we hold no copy.

The app does not back photos up to any cloud, does not send them to us and does not send them to third parties. A photo leaves your phone only when you choose to share it with another app (messenger, email…), and it then travels directly from your device to that app.

3. Data processed only on your device

The following never leaves your phone:

• The camera feed — to take and stamp the photo.
• Photos you pick from the gallery — when used as a virtual background or to replace a photo background. Subject segmentation runs with ML Kit entirely on-device, no network needed.
• GPS position and street address — to print them onto the photo.
• Your settings — stamp layout, company logo, notes, saved delivery points, alarms.

4. Data the app sends to our server

The app contacts z-timephoto.z-cloud.com.vn in three situations only:

• Checking for updates and licence status when you open the app: it sends a device code (a random string generated by the app for this installation — not your IMEI, not your phone number) and the app version.
• Registering a photo verification code when you tap Share — see section 5.
• Fetching the support group link if you tap the "join support group" button.

As with any web server, access logs record IP address, request path and timestamp. They are used for troubleshooting and abuse prevention and are deleted after 90 days at most.

5. Photo verification codes and the /s/<code> page

Every photo the app produces carries a 14-character code printed along its right edge. When you tap Share, the app sends us the stamped text of exactly those photos and appends a link https://z-timephoto.z-cloud.com.vn/s/<code> to the shared message, so the recipient can still verify the details if the image is cropped or edited.

That text consists of: the photo code, capture time, time zone, coordinates and address (if you enabled location), the note you typed, the device model name (e.g. "Samsung SM-A566E"), the app version and the device code.

The server never receives and never stores the image. Each record is signed with an Ed25519 key so any later tampering with our own storage becomes detectable.

Please note: anyone holding the link can open the /s/<code> page — no password is required, that is the point of it. So do not type confidential information into the note field of a photo you are about to share. If you would rather no record be created at all, turn the verification code off in the stamp settings or share the photo another way.

To have a registered record deleted, send the photo code to support@z-cloud.com.vn; we remove it within 7 business days.

6. Payments

The Pro plan is sold through the Apple App Store (iOS) and Google Play Billing (Android). The whole payment flow happens inside Apple’s or Google’s interface: the app never sees, receives or stores your card or bank details. It only receives the store’s answer to "is this purchase still valid". Apple’s and Google’s handling of your data is governed by their own privacy policies.

We never receive or store any payment transaction. Our server does not sit in the payment flow, receives no bank statements and keeps no transfer details about you.

7. Third-party services

• Apple App Store (StoreKit) — payment and subscription status on iOS.
• Google Play (Billing & Play Services) — payment and subscription status on Android.
• Open-Meteo — weather at the capture location. The app sends rounded coordinates and no identifiers.
• OpenStreetMap — map imagery for the map picker and for the verification page.
• Android/Google location services — turning coordinates into a street address (the on-device Geocoder).
• Telegram — creating an invite link to the user support group, only if you tap the join button.

When the app calls these services, that provider sees your IP address, as with any ordinary Internet request.

Beyond that list, the app integrates no ad network, advertising SDK or advertising tracker, and builds no advertising identifier or behavioural profile of you.

8. Permissions and why they are needed

• Camera — to take photos. Required for the core function.
• Location (precise / approximate) — to stamp coordinates, address and weather. Read only while the capture screen is open; if you decline it the app still takes photos, just without location.
• Storage / photo library — to save stamped photos and to read the picture you choose as a background.
• Notifications — for alarms and foreground service notices.
• Exact alarms, vibration, wake lock, start at boot — for the wake-up alarm feature.

The app does not request access to contacts, messages, call history or the list of installed apps.

9. How long we keep data

• Photo verification records — for as long as the link should keep working, at most 5 years, or until you ask us to delete them.
• Device and licence records — for the life of the licence plus 24 months for accounting and warranty purposes.
• Server logs — 90 days at most.

10. Who we share data with

We do not sell, rent or trade your data. It leaves our systems in three cases only: (a) the service providers listed in section 7, limited to what they need to do their job; (b) where a competent authority requires it under applicable law; (c) when you yourself share a photo verification link with someone.

11. Security

All traffic between app and server is HTTPS — the app refuses unencrypted connections. Verification records are signed with Ed25519. Our servers are located in Vietnam, with rate limiting and abusive-address blocking. No system is perfectly secure, however, so please do not put sensitive information into a photo note.

12. Your rights

Under Vietnam’s Decree 13/2023/ND-CP on personal data protection (and under the GDPR if you are in the EU/EEA), you have the right to:

• know what data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted — including photo verification records;
• withdraw consent: revoke the location permission in system settings, or uninstall the app;
• lodge a complaint with the competent data protection authority.

Send requests to support@z-cloud.com.vn; we reply within 30 days. Since the app has no accounts, please include your device code (shown in the app’s settings screen) or the photo code so we can find the right record.

13. Children

The app is aimed at working adults, is not directed at children under 13, and we do not knowingly collect children’s data. If you believe a child has sent data to our server, tell us at support@z-cloud.com.vn and we will delete it.

14. Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects your rights, the app shows a notice the next time you open it. Continuing to use the app after the new version takes effect means you accept it.

15. Contact

Z-Soft Co., Ltd. — support@z-cloud.com.vn
Website: z-timephoto.z-cloud.com.vn