Privacy Policy

• Account details. Your name and email address. If you sign up with email we also store your password as a salted hash, never the password itself. If you sign in with Google we receive your name, email address and profile picture from Google.
• What you put into Zarello. Your niche, audience, content pillars, goals, timezone and any writing samples you add; the platform handles you enter; your brief (a description of you, your stories, opinions, what you offer, words you use and avoid, and how you sound on each platform, plus the text you paste in to fill it); and your ideas, drafts (hooks, captions, hashtags and scripts), schedule and the performance numbers you log; the hooks, calls to action and snippets you save to your library; your visual style (colours, fonts, mood and what to avoid, with the pictures you pick as references); and the prompts you write for AI image and video tools, with the conversation that changed them.
• Images you upload. Screenshots and photos you add to your library or to a draft (JPEG, PNG or WebP), with the title, description, tags and alt text you or the AI give them. The files are kept in private storage that has no public address; they are shown to you through links that expire within minutes.
• Technical records. To keep you signed in and protect your account we store session records, including the IP address and browser details (user agent) of the device you signed in from. We also record when you make AI requests, so we can apply usage limits.
• Your AI key, if you add one. If you bring your own API key for an AI provider (see section 4), we store it encrypted. Only the last four characters are ever shown back to you.

We don't use advertising trackers or third-party analytics. The only things we keep in your browser are the cookie that keeps you signed in and your light or dark theme preference.

• To run the service you asked for: your ideas, calendar, drafts, results and weekly reviews.
• To sign you in and keep your account secure.
• To email you verification codes and password resets, and post reminders if you have them turned on.
• To generate AI suggestions when you ask for them (see section 4).
• To apply fair-use limits and to answer your support requests.

We don't sell your data or use it for advertising.

When you use an AI feature (generating ideas, writing a draft, rating a hook or writing a weekly review), the relevant content is sent to an AI provider to produce the result. By default that is Google's Gemini API. Depending on the feature, the content can include your niche, audience, pillars and goals, up to six of your writing samples (shortened), your brief (shortened if it is long), the hook, idea or caption you're working on, and, for weekly reviews, the numbers you've logged. If you use “Ask Zarello” (the help chat), only the question you type and your last few messages are sent, along with Zarello's own written guide. Your chat history is kept in your browser only. If you use “Organise it” on your brief, the text you pasted is sent too, so paste only what you are happy for your chosen AI provider to read. The same goes for “Ask me first” (the questions and the answers you give), and for “Make it sound like me” (the caption you ask it to rewrite).

Images are sent to the AI only when you ask it to read them: “Describe” on an image in your library, “Suggest” for alt text, “Write from these images” on a draft, “Describe my style” on your visual style (up to six pictures), or “Upload what you got” in the visual prompt studio (the one picture you upload, together with the prompt and your visual style). Then the picture itself, shrunk in your browser to at most 2,048 pixels on its longest side, goes to your AI provider along with the other content above. Everything else (planning, rewriting, ideas, and writing a visual prompt) uses only the text description of an image, never the picture again. The model has to be one that can read images; otherwise Zarello tells you so. Anything written on a picture, or any person in it, is processed by the provider like the rest of the content, so only upload what you are happy for them to see.

The microphone button next to an answer, where your browser offers one, uses your browser's own speech recognition. Zarello never receives the audio, only the text that ends up in the box, but some browsers (such as Chrome and Edge) send the audio to their own speech service to turn it into text, under that company's terms.

You can instead bring your own API key in Settings, from Google, OpenAI, Anthropic, OpenRouter or OpenCode Zen. When you do, your AI requests go to the provider you chose, using your key, and are billed to your account with that provider. If you pick OpenRouter or OpenCode Zen, they may pass the request on to the company that runs the model you select. We store your key encrypted, use it only to make your own requests, and you can remove it at any time.

We do not send your name, email address or account ID with these requests. The provider handles that content under its own terms and privacy policy. AI output can be wrong or generic, so please review it before you use it.

• Google for sign-in (if you choose it) and, by default, the AI features above.
• The AI provider you choose, if you add your own key: Google, OpenAI, Anthropic, OpenRouter or OpenCode Zen.
• Resend to deliver our emails, which means it receives your email address and the content of each message we send you.
• Our hosting, database and image-storage providers, who store and serve the data described above, including your image files, on our behalf.

We may also disclose information if the law requires it.

We keep your data while your account is active. Email verification and password reset codes expire after 10 minutes.

You can delete your account yourself in Settings: you type your email to confirm, and your account and everything linked to it (profile, brief, ideas, drafts, plans, saved hooks, numbers, reviews, your AI key and sessions) is deleted from our database, and the image files you uploaded from our storage, straight away. If anything goes wrong, or you cannot sign in, email us at [email protected] from the address on your account and we will do it within 30 days. You can also delete any image yourself at any time from Your brief, and it is removed from storage straight away.

We use reasonable technical measures to protect your data, including hashing passwords, encrypting any AI key you add, and limiting how often sign-in and AI requests can be made. No system is perfectly secure, so please use a strong, unique password.

Zarello isn't intended for children under 13, and we don't knowingly collect their information.

If we change this policy in a meaningful way we'll update the date at the top. For anything about your data, contact [email protected].