Last updated: September 2, 2026
This Privacy Policy explains what information Zabi SL ("we", "us") collects, why, and how it's handled. Zabi SL is an end-to-end encrypted messaging app currently in beta.
Registered accounts: a username, an optional email address, a hashed password (we never store your password in plain text), gender, age, and country.
Guest accounts: a display name (chosen by you or auto-generated), gender, age, and country. No password or email is required.
Messages: your messages are encrypted end-to-end in your browser before they ever leave your device. Our servers store only the encrypted ciphertext — we cannot read your message content, and never see it in plain text.
Push notification subscriptions: if you enable notifications, your browser gives us a subscription (a delivery endpoint and encryption keys assigned by your browser, not by us) so we can send you a notification when you receive a new message. See Section 7 for details on what that notification actually contains.
Technical data: we log IP addresses and basic request metadata solely to prevent abuse (rate limiting, spam, and account creation abuse). Online/presence status is visible to other users while you're connected.
Messages are encrypted using keys generated in your browser. Your private key never leaves your device and is never sent to or stored on our servers. A new key pair is generated each session, which means we — and anyone who might gain access to our database — cannot decrypt your conversations.
If you sign in as a guest, your conversations remain available for as long as you stay signed in to that session. Once you sign out, that guest identity is gone for good — signing in again as a guest creates an entirely new, unrelated identity with no access to previous conversations.
Registered accounts retain message history (in encrypted form) until you delete your account or request deletion.
Push notification subscriptions are deleted at the same time as the rest of your guest data — on sign-out, or automatically if your session is ended for inactivity.
We do not use your data for advertising, and we do not sell your information to third parties.
We use a single functional session cookie to keep you signed in. This cookie is required for the app to work and is not used for advertising or cross-site tracking.
We use Umami, a privacy-focused analytics service, to understand overall traffic and usage — for example, how many people visit, roughly where from, and whether people complete sign-up. Umami does not use cookies and does not track you individually across websites. It never has access to your messages, since those are end-to-end encrypted and never touch our analytics at all.
If you allow notifications, we send one when you receive a new message while you have no open tab on Zabi SL. That notification only ever says who it's from — it never contains your message content, since our servers never have access to it in the first place (see Section 2). Notifications are delivered through your browser's own push service (for example, Google's for Chrome, or Mozilla's for Firefox), which necessarily sees the delivery endpoint but not what the notification says. You can turn notifications off at any time in your browser's site settings.
Zabi SL lets you block other users and report abusive behavior. When you submit a report, we record who reported whom and when, so it can be reviewed. Reports do not include your message content, since we cannot read it.
We do not sell or rent your personal information. The only outside parties involved in running Zabi SL are Umami (analytics, Section 6) and your own browser vendor's push service (notification delivery, Section 7) — neither ever has access to your message content. We may disclose limited information if required to comply with a valid legal request, or to protect the rights, safety, and security of Zabi SL, its users, or the public.
You can request access to, correction of, or deletion of your personal data. For registered accounts, this includes deleting your account and associated data. Guest account data, by design, disappears automatically once you sign out.
Zabi SL is intended for users aged 18 and older. We do not knowingly collect information from anyone under 18.
We use industry-standard practices to protect your data, including end-to-end encryption for message content and hashed password storage. That said, no online service can guarantee absolute security, and Zabi SL is currently in beta — we recommend against sharing highly sensitive information until the service has matured further.
We may update this policy as the app evolves. Material changes will be reflected by updating the "Last updated" date above.