DzenQ Privacy Policy

Updated 2026-10-12

In short

DzenQ is an app for digital thank-yous and tickets. The keys that sign your thanks are created and kept only on your device. We never see or store your 12 recovery words.
We don't sell data, show ads or track you.

An anonymous sign-in (Firebase Authentication), so only you can change your data. No name or e-mail.
Your public profile: the name you chose, photo, cover, your coins (categories). Anyone who knows your identifier can see it.
The public key log (KEL) and period seals: public keys and digests (hashes) of thanks — no text, names or addresses. It lets anyone verify a thank-you.
Addresses people can find you by (e-mail, phone, GitHub, GitLab, Discord, Telegram accounts) — only those you proved. For search we keep a protected digest (HMAC with a server secret), not the address. For proved e-mails and accounts the address or username is kept so you can see what is linked.
Thank-you letters waiting for someone at an address, and letters in your in-app mailbox. They are encrypted: the key is only in the link or with the recipient.
A notification token (Firebase Cloud Messaging) to tell you about new thanks.
Files you upload: profile pictures, encrypted backups.
Request counters (to prevent abuse).

Keys, contacts, thanks, tickets, notes. Backups you keep in Google Drive or Dropbox are encrypted on the device.
Address book: read only with your permission and only on the device, to help you pick a person. We don't upload it. Only the address you search for or thank goes to the server.
Camera: only to scan QR codes. No pictures are kept or sent.

Google Firebase (Authentication, Firestore, Storage, Cloud Functions, Cloud Messaging, Crashlytics) — Google LLC; data in europe-west1 (Belgium) and Google's infrastructure.
Firebase Crashlytics collects crash reports: device model, Android version, the error's stack. We keep personal data out of them.
Sign-in with Google, GitHub, GitLab, Discord, Telegram — only when you link an account. We see its id and username and drop the access tokens right away.
The Telegram bot @dzenqbot receives your Telegram id when you use it.

So you can send and receive thanks, people can find you by the addresses you allowed, and anyone can verify a thank-you.
Legal basis: your consent and providing what you ask the app to do.

Until you delete the data or the account. Delete the account in the app: «Me» → «Delete account». How it works: /legal/delete.
The public key log and period seals stay after deletion: without them thanks you gave others can't be verified. They hold no personal data.

To see, correct and delete your data, withdraw consent (e.g. hide an address from search), and get a copy (backup in the app).
To complain to a supervisory authority.

DzenQ is not meant for children under 16.

Questions and data requests: liubomyr.ivanitskyi@gmail.com