Privacy Policy
Last updated: 30 October 2026
This policy applies to the Zinsta Android and iPhone apps, the websites zinsta.org and zinsta.app, and related services, published by Zinsta, Pakistan ("Zinsta", "we"). Zinsta lets adults share posts, reels and messages, watch lives, and use a rupee wallet for optional coins, gifts and creator payouts. This policy explains what we access, collect, use and share, how long we keep it, and how you can delete it. Contact for privacy questions: zinsta.org@gmail.com.
What we collect
- Account details: name, username, email or phone number, date of birth (to confirm you are 18+), password (stored hashed). If you sign in with Google or Apple we receive your name, email and profile picture from them. If you sign in or reset your password with your phone number, we send a one-time code by WhatsApp or SMS to that number and keep the number so one person cannot hold many accounts. We never see your Google, Apple, WhatsApp or Facebook password.
- Creators also: public profile, ID card images and number, and payout account details for identity checks and payments.
- Chat and call content: direct messages (stored encrypted) and call metadata. Voice and video (including lives) are carried by our provider LiveKit and are not recorded by us.
- Payments and Z Coins: what you buy, gift, receive and cash out: pack, amount, date, your coin balances, the gifts you send and receive, and holds. For purchases made through Google Play we receive and store the Google order number and purchase token, the product and whether the purchase was later refunded or cancelled. We never see or store your card, bank or Google payment details; Google handles them under its own privacy policy.
- Payout details (creators): the bank account account name and number you give us to receive cash-outs, your cash-out requests and their results. We use them only to pay you and to check that the account is in your own name.
- Advertising measurement (Android app): so we can tell which advertisements lead to installs, the app uses the TikTok App Events SDK. It sends TikTok the event (app installed, app opened, account created, coins bought with the amount and currency) together with your phone's advertising ID, app version, device model, language and approximate network location. We do not send your name, email, phone number or messages. You can reset or delete your advertising ID, or opt out of ad personalisation, in your phone's Settings > Privacy > Ads. TikTok handles this data under its own privacy policy.
- Fraud and abuse signals: unusual activity such as many purchases in a short time, gifts between linked accounts, repeated refunds or chargebacks, fake votes or views, and accounts from the same device or network. We keep a record of these checks and the action taken.
- Earn Z contest: the reels you enter, votes you cast (without telling others who voted), results, prizes and the device information used to stop fake votes.
- Device & usage: device id, app version, push token, IP address and basic product events, used for security, fraud prevention and improving the app.
- Posts and feed activity: photos and reels creators upload, and what you do with posts: which ones you see, how long you watch, replays, skips, likes, comments, shares, saves, follows and "Not interested".
- Reel audio: the sound track of a reel you post is saved separately as an "Original audio" other creators can use under their reels, shown with your name. It is removed from the sound library when you delete the reel.
- Rewards: your invite code, who joined with it, watch-reward and Creator Rewards records.
- Profile and connections: the bio and city you add, who you follow and who follows you. Your name, photo, bio, city and follower counts are visible to other users.
- Approximate location: the city and region your internet (IP) address points to, worked out on our own servers. We never use GPS and never know your exact location. We also keep a scrambled code (hash) of the network you connect from, so people who often share a network, like family at home, can be suggested to each other.
- Contacts (only if you choose): when you tap "Find friends from your contacts", the app reads only the phone numbers in your address book, not names, photos or other details. They are sent securely and turned into scrambled codes (hashes) on our server. We use them only to find your friends on Zinsta and suggest people you may know.
- Direct messages: free messages between people who follow each other, stored encrypted and screened for abuse like other chats.
- iOS waitlist: if you ask to be told when the iPhone app launches, we store the email address you type on zinsta.org, the date, and a coarse network address used only to stop spam. We use it only to send that one launch notice, then you can unsubscribe from the email.
How we use it
- To run your account, process payments, deliver coins you bought, send gifts, hold and release received coins, and pay creators.
- To handle refunds and payment problems: we check Google Play purchase records, your order number and our own ledger to find what happened, and may reverse coins from a purchase that was refunded or charged back.
- To prevent fraud, scams and money laundering: we compare payment, gift, cash-out and device activity, hold or cancel suspicious transactions, verify your identity and payout account before paying, and keep evidence. Some of these checks are automatic; a person can review the decision if you write to us.
- To send you the one-time codes you ask for, by WhatsApp or SMS, and to tell you about purchases, cash-outs and contests.
- To keep the community safe: screening messages for scams, abuse and contact-sharing, handling reports and preventing fraud.
- To check photos and videos for adult content: posts, reels, profile pictures and chat photos are analysed automatically by a model running on our own servers before others can see them. Clear adult content is deleted at once; we keep only the check result (scores, time and whether it was removed), not the file. Borderline items stay hidden until a moderator reviews them.
- To send notifications you allow (messages, calls, likes and comments), and to email people on the iOS waitlist once when the App Store app is live.
- To personalise your Home feed and Reels: we learn which creators and topics you enjoy from your feed activity. You can tap "Not interested" on any post, and "Why am I seeing this?" explains each suggestion.
- To suggest people you may know and show people nearby, using mutual follows, synced contacts, your approximate city, shared networks, similar interests and people you talk with in comments. Suggestions say why they are shown, never reveal your exact location, and you can turn each signal off in Settings → Privacy ("Suggest my account to others", "Nearby", "Let contacts find me", "Who can message me").
- To count real views, show creators statistics about their own posts (never who you are individually, except public likes and comments), and calculate Creator Rewards, watch rewards and invite rewards, including checks against fake views and fake accounts.
Who we share it with
Service providers that help us run Zinsta: hosting (DigitalOcean), file storage and DNS (Cloudflare), sign-in (Sign in with Apple, Google), TikTok (ad measurement, see above), Google Play (to take payment for Z Coins and to confirm purchases and refunds), WhatsApp / Meta (to deliver one-time codes to your phone), push notifications (Google Firebase and Apple Push Notification service), calls (LiveKit), SMS/email delivery, payment gateways and the banks that receive creator cash-outs, and AI services that help screen messages for scams and abuse. Text sent to these providers is used only to provide that service. City-level location comes from the IP to City Lite database by DB-IP (licensed under CC BY 4.0); lookups happen on our own servers and nothing about you is sent to DB-IP. We may disclose information when the law requires it or to protect people from harm. We share payout and identity details only with the bank or wallet that pays you, and fraud details only with payment providers, FIA or other authorities when the law requires it or to stop a crime. We do not sell your personal data and we do not share your phone number, email or payment details with advertisers.
How long we keep data
- Account and profile: while your account is active. After you request deletion the account is deactivated at once and all personal data is permanently deleted after 30 days.
- Chat and direct messages: while your account is active, then deleted with the account.
- Synced contacts: until you remove them (Find people → Contacts → Remove synced contacts, or Settings → Privacy → Synced contacts) or delete your account.
- Approximate location and network codes: your current approximate city is updated as you use the app; network codes not used for 60 days are deleted automatically. Both are deleted with your account.
- ID documents (creators): deleted about 90 days after review.
- Payment, coin, gift and cash-out records, including Google Play order numbers: kept after your account is deleted for as long as the law requires for accounting, tax, refunds, disputes and fraud prevention. After deletion they are no longer linked to your name, photo or contact details.
- Payout account details: kept while your account is active and removed with the account, except what the bank or wallet record already holds.
- One-time codes: deleted or expired within minutes.
- Fraud signals and records of banned accounts: kept for a limited period so that banned users cannot come back to cheat again.
- Safety reports and evidence: kept as long as needed to protect users and meet legal duties, including reports to the authorities.
- iOS waitlist emails: until you ask us to remove them, or 12 months after the iOS launch notice, whichever is sooner.
Prominent notices
Before we collect your ID documents (creators only) or ask for camera, microphone, contacts or notification access, the app tells you why and asks for your permission. You can refuse; the related feature (for example video calls or becoming a creator) then will not work.
Your choices
- Delete your account in the app (Profile → Delete account) or at zinsta.org/delete-account. It is permanently deleted after 30 days.
- Download a copy of your data in the app (Profile → Settings → Download my data), or ask by emailing zinsta.org@gmail.com from the address on your account. We reply within 30 days.
- Turn notifications off at any time in your phone's settings (Settings > Apps > Zinsta > Notifications).
- Refuse camera or microphone access; only voice and video calls stop working.
Permissions the app asks for
- Camera and microphone: for posts, lives, voice and video calls you join, and for taking a profile or ID photo.
- Photos: only the pictures you choose to upload.
- Notifications: to tell you about messages, calls, likes and comments.
- Contacts (optional): only when you choose to find friends from your contacts; only phone numbers are read. If you refuse, everything else keeps working.
Age
Zinsta is only for people aged 18 or older. We do not knowingly collect data from anyone under 18 and close such accounts. See our safety standards.
Security
Data is sent over encrypted connections. Chat messages and identity documents are stored encrypted. Access by our staff is limited and logged. Payments are verified with Google on our servers, so a fake receipt cannot add coins.
Keep yourself safe from scams
Zinsta will never ask you for your password, a one-time code, a PIN or your card or bank details, and never sells coins outside the app. If anyone asks, do not share it and tell us at zinsta.org@gmail.com. See the Payments and Refund Policy.
Your rights over payment data
You can ask to see, correct or delete your data (see Your choices). Payment, tax and fraud records that the law tells us to keep cannot be deleted before that period ends, but we remove your identity from them. You can also complain to us first; if you are not satisfied, you can contact the competent authority in Pakistan.