Last updated: September 23, 2026
This Privacy Policy explains what information Zabi (zabi.world, "we", "us") collects, why, and how it's handled. Zabi is an end-to-end encrypted messaging app currently in beta.
Registered accounts: a username, an optional email address, a hashed password (we never store your password in plain text), gender, age, and country.
Guest accounts: a display name (chosen by you or auto-generated), gender, age, and country. No password or email is required.
Messages: your messages are encrypted end-to-end in your browser before they ever leave your device. Our servers store only the encrypted ciphertext. We cannot read your message content, and never see it in plain text.
Push notification subscriptions: if you enable notifications, your browser gives us a subscription (a delivery endpoint and encryption keys assigned by your browser, not by us) so we can send you a notification when you receive a new message. See Section 7 for details on what that notification actually contains.
Technical data: we log IP addresses and basic request metadata solely to prevent abuse (rate limiting, spam, and account creation abuse). Online/presence status is visible to other users while you're connected.
How you use Zabi: for each guest session we record your device and browser type, whether Zabi was opened as an installed app, whether private browsing appeared to be in use (an estimate, since browsers don't reveal it), your notification settings, and who you chatted with (their display names, whether they were real people or Zabi's virtual users, and how many messages were exchanged), so we can understand and improve the app. None of this includes what your messages said.
Messages are encrypted using keys generated in your browser. Your private key never leaves your device and is never sent to or stored on our servers. A new key pair is generated each session, which means that neither we nor anyone who might gain access to our database can decrypt your conversations.
If you sign in as a guest, your conversations remain available for as long as you stay signed in to that session. Once you sign out, that guest identity is gone for good. Signing in again as a guest creates an entirely new, unrelated identity with no access to previous conversations.
Registered accounts retain message history (in encrypted form) until you delete your account or request deletion.
Push notification subscriptions are deleted at the same time as the rest of your guest data, either on sign-out or automatically if your session is ended for inactivity. The one exception is a reminder you ask for (see Section 7): it is kept after your session ends, linked to our record of the guest session in which you asked for it, unless you choose to remove it when you sign out. It is deleted automatically if you don't visit Zabi for 14 days. Your messages are never part of it.
We do not use your data for advertising, and we do not sell your information to third parties.
We use a single functional session cookie to keep you signed in. This cookie is required for the app to work and is not used for advertising or cross-site tracking.
We use Umami, a privacy-focused analytics service, to understand overall traffic and usage, such as how many people visit, roughly where from, and whether people complete sign-up. Umami does not use cookies and does not track you individually across websites. It never has access to your messages, since those are end-to-end encrypted and never touch our analytics at all.
If you allow notifications, we send one when you receive a new message while you have no open tab on Zabi. That notification only ever says who it's from. It never contains your message content, since our servers never have access to it in the first place (see Section 2). Notifications are delivered through your browser's own push service (for example, Google's for Chrome, or Mozilla's for Firefox), which necessarily sees the delivery endpoint but not what the notification says. You can turn notifications off at any time in your browser's site settings.
Reminders. If you ask Zabi to remind you when it goes live, or to tell you when someone comes online, we store your browser's push endpoint, which of those you asked for, whether to tell you about men or women coming online (the opposite of the gender you signed up with), and your browser type. The reminder stays linked to our record of the guest session in which you asked for it (your display name, gender and age, when you joined and left, your IP address and device, whether you used the installed app or private browsing, and which notifications you opted into), so we can understand how reminders are used; your messages are never part of it. Reminders say only that Zabi is live or that someone has come online, never who. If you have a reminder on, you may also receive occasional updates from Zabi, such as a special live evening. You can turn all of this off in Settings, remove it when you sign out, or block notifications in your browser. A reminder is deleted automatically if you don't visit Zabi for 14 days, and daily live reminders pause after five in a row that you don't come back for.
Zabi lets you block other users and report abusive behavior. When you submit a report, we record who reported whom and when, so it can be reviewed. Reports do not include your message content, since we cannot read it.
We do not sell or rent your personal information. The only outside parties involved in running Zabi are Umami (analytics, Section 6) and your own browser vendor's push service (notification delivery, Section 7). Neither ever has access to your message content. We may disclose limited information if required to comply with a valid legal request, or to protect the rights, safety, and security of Zabi, its users, or the public.
You can request access to, correction of, or deletion of your personal data. For registered accounts, this includes deleting your account and associated data. Guest account data, by design, disappears automatically once you sign out.
Zabi is intended for users aged 18 and older. We do not knowingly collect information from anyone under 18.
We use industry-standard practices to protect your data, including end-to-end encryption for message content and hashed password storage. That said, no online service can guarantee absolute security, and Zabi is currently in beta, so we recommend against sharing highly sensitive information until the service has matured further.
We may update this policy as the app evolves. Material changes will be reflected by updating the "Last updated" date above.