Zaky — Privacy Policy

Last updated 2026-09-18 · بالعربية

1. Who we are

This service is operated by NexAI Solutions FZ LLC, Compass Building, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. For anything in this policy, including a request to see or delete your family's data, write to samer@economies.com.

A parent or legal guardian holds the account. Children do not have their own accounts and cannot create one: a child's device joins a family that an adult has already set up.

2. What we collect

From the parent

When you sign in with Apple or Google we receive and store the stable user identifier those providers give us, and the email address and name they release to us. We never receive your Apple or Google password. We also store the parent PIN as a salted hash, and a record of each device signed in to the account.

About the child

The first name or nickname you enter, a chosen handle, the birth year (used to set age-appropriate defaults, not stored as a full date of birth), the avatar the child assembles from fixed choices, and a time zone.

What the child makes and does

• Conversations with Zaky — the text of what the child asks and what Zaky answers, kept so a parent can read it.
• Photographs — of a homework page, of something the child wants explained, of something to build a story around, and of anything the child chooses to share with an approved friend.
• Short videos — up to 15 seconds, with sound, recorded in the app. The camera roll is never read; there is no way to import an existing photo or video.
• Voice notes to approved friends.
• Drawings and scenes the child composes in the app.
• Progress — stars earned, activity days, and counters we use to keep the daily budget a parent has set.

What we deliberately do not collect

No location. No contacts. No advertising identifier. No device fingerprint. No browsing history. Photographs are re-encoded on upload so that EXIF metadata — including GPS coordinates and camera serial numbers — does not survive; we never store it. Voice and video calls between approved friends are end-to-end encrypted and are never recorded: the call record holds who called whom and for how long, and there is no field in it that could hold what was said.

3. Why we hold it

To run the service the parent asked for: to let Zaky answer a child's question, to let a parent read what was said and approve what is shared, to enforce the daily limits and bedtime a parent sets, to screen images before another child sees them, and to keep the account working across devices.

Our legal basis is the performance of the contract with the parent, and — for the screening described below — our legitimate interest and legal obligation in child safety. Where consent is the basis, the parent gives it during setup and can withdraw it by deleting the account.

4. Screening — and what a human may see

Every image a child uploads is checked before it can reach anyone: matched against hashes of known child sexual abuse material, checked by an automated vision model, and read for text. Short videos are additionally checked against a transcript of their audio.

Content the automated checks are unsure about is held and placed in the parent's review queue. It is not shown to any other child in the meantime. A confirmed hash match is escalated to our operators and may be reported to the relevant authorities; where that happens, the file is retained as evidence for as long as the report requires and not as part of the child's account.

5. Who else processes it

We use a small number of processors. They act on our instructions and may not use your family's data for their own purposes.

Where a processor is outside your country, the transfer is covered by that provider's standard contractual clauses and equivalent safeguards.

6. How long we keep it

Retention is short and depends on what the thing is. These periods are enforced by an automatic nightly sweep that deletes the actual bytes, not just the database row.

When a file is deleted we keep an audit stub — that something was screened, what the verdict was, and when — with the child's pixels and audio removed. We can show what we did without keeping the thing we did it to.

7. What a parent controls

• See everything. The parent dashboard shows the child's conversations, their posts, their friends and everything waiting for approval.
• Approve or refuse every friendship — both parents must agree — and, for younger children, every post before it is shared.
• Turn the camera off for a child. It is off until a parent turns it on.
• Export the child's data as a JSON file.
• Delete a child, which erases their conversations, photographs, voice notes and their whole social footprint in both directions.
• Delete the whole account from inside the app. Every child in it is erased first, then the account, its devices and its sessions. This cannot be undone.

You can also ask us to do any of these by writing to samer@economies.com. We answer within 30 days.

8. Security

Session tokens are stored hashed, so a stolen database backup does not hand anyone a live session. Voice notes are encrypted at rest; deleting one destroys both the audio and the key that would open it. Calls are end-to-end encrypted. Photographs are stripped of metadata on upload. Access to production data is limited to the people who need it to operate the service.

9. Your rights

Depending on where you live you have the right to access, correct, export, restrict or erase your family's data, and to object to processing. In Saudi Arabia these rights arise under the Personal Data Protection Law (PDPL); in the EEA and the UK under the GDPR; in the United States, this service is designed to meet COPPA, which is why an account can only be created by a verified adult and why a child cannot make their data public.

To exercise any of them, use the controls in the app or write to samer@economies.com. If you are not satisfied with our answer you may complain to your national data protection authority — in Saudi Arabia, the Saudi Data & AI Authority (SDAIA).

10. Changes

If we change this policy in a way that affects what we collect or who receives it, we will tell the parent in the app before the change takes effect, and the date at the top of this page will change.