Privacy Policy

Version 2.1, last updated 12 October 2026.

1. What this covers

This policy describes what ZI² Books collects on the web at e.zi2.app and in the ZI² Books apps for iPhone, iPad, Android and Mac, why, who else handles it, and how long it is kept. The controller is Zenith Intelligence Technologies Inc., PO Box 1, Hagerstown, MD 21741, USA, reachable at [email protected].

2. What is collected

• Readers and buyers. The email address you buy or sign in with, your orders and licenses, gift details you enter, the shelves you make, your reading position and reader settings, the notes you save, the reviews you post, and messages you send to a publisher.
• Publishers. The imprint name, account email, password (stored only as a salted scrypt hash), passkeys if you add them, uploaded files, listings, and the ledger of sales and payouts. Publishers who connect payouts give their details to Stripe, not to us.
• Newsletter subscribers. The email address, language and date of signing up.
• Security records. When you sign in with a one-time link or code, open a license, or reveal an unlock phrase, the time and network address are recorded in a tamper-evident audit log. The web server also logs each request with its network address.
• Site statistics, only with your consent. If you accept analytics in the privacy banner, the site records page views and simple events: the page address with any codes or tokens removed, the page title, the site that referred you, browser language, device type, screen width, time zone, an approximate location (country, region and city) derived from the network by Cloudflare, and random visitor and session numbers. Reading events record the book title and chapter. No statistics are recorded until you choose, and you can change your choice at any time from "Your privacy choices" at the foot of every page.

No card numbers are ever collected: payment happens on Stripe's own pages.

3. How it is used

To run the service: deliver purchases, keep your library and reading in sync across devices, keep ledgers honest, send license and sign-in emails, answer support, protect the service from abuse, understand how the site is used (with consent), and meet legal duties. Nothing is sold or rented to anyone, and there is no advertising.

4. Email

Buyers receive the emails their purchase needs: the license, receipts, and sign-in links. Buyers may also receive a small number of follow-ups about a purchase, such as a thank-you, a reminder about an unfinished checkout, a review request, or news of related books, and subscribers receive the newsletter. Every one of those carries an unsubscribe link, and unsubscribing puts the address on a do-not-email list that is always honoured.

5. Who else handles your data

• The publisher you buy from receives your email address and order details for its own sales, so it can support you and keep its records. Each publisher handles that data under its agreement with the Platform and may not sell it.
• Stripe processes payments and, where it applies, sales tax. It receives your email, the purchase details and, when tax applies, your billing address. Stripe's privacy policy governs what it holds.
• Cloudflare carries the site's traffic and runs the bot check on public forms, which sees your network address and basic browser signals.
• Our email provider delivers the messages we send.
• Optional tools. Integrations such as Google Analytics are switched off. If one is ever switched on, it loads only after you accept analytics.
• Apple, Google and other app stores handle downloading the apps under their own policies.

6. The apps

The apps contain no advertising, analytics or crash-reporting software. On your device they keep your sign-in token and unlock phrases in the system's secure storage, plus your downloaded books, a copy of your library list, and your reading positions, bookmarks and notes. Reading position, settings and notes are synced to your account so they follow you; bookmarks stay on the device. Read-aloud uses your device's own speech engine. Signing out removes the downloads and phrases from the device.

7. Cookies

The site uses a small number of cookies to keep you signed in, remember your language and record your privacy choice, and, only with consent, to count visits. The cookie policy lists each one.

8. How long data is kept

• Account and reader data: while the account exists, until you delete it.
• Orders and ledgers: as long as tax and accounting law requires. After an account is deleted they are kept without the email address.
• Site statistics: 400 days. Privacy choices: about three years, so a choice can be shown to have been respected.
• One-time sign-in links: they stop working after fifteen minutes and are removed afterwards.
• Security records and server logs: as long as needed to investigate abuse and meet legal duties.

9. Your rights

You can see, export, correct or delete your data. The fastest way to export or delete is your data page: enter your email and a private link arrives that shows what is held, downloads it, and erases it. In the app, use Account, then Delete account. The account deletion page explains exactly what is erased and what is kept. You can also object to any use of your data or ask anything by writing to [email protected], and requests by email are answered within thirty days. You may complain to your data protection authority.

10. Children

The service is not directed to children under 13 and they should not create an account. Publishers must be at least 18.

11. Security and transfers

Traffic is encrypted, passwords are stored only as hashes, and sign-in cookies cannot be read by page scripts. Data may be processed in countries other than yours by the providers above, under their own safeguards.

12. Changes

The current version, with its date, always lives at this address, and material changes are announced on the site.