Privacy policy
Version 2026-11-07
We keep only what we need to sign you in, sell and check your licence, and stop abuse.
Who we are
ZYFT is run by Kian Ayache. Questions about your information: workwithkiyan@gmail.com.
What we store, and why
- Your email address: to send your one-time sign-in codes, to tie your purchases and licences to your account, and to answer you.
- A hash of your device id: the app makes a one-way hash of your PC's hardware id on your PC and sends only the hash. We use it to count the 2 PCs a licence allows. The raw hardware id never leaves your PC. When the app sends the PC's name, it is stored with it so you can tell your PCs apart.
- Licence and order records: your tier and licence status, and from Stripe the amount, currency, date and payment reference. We never see or store card numbers: Stripe handles card details.
- Your consent record: which versions of the Terms and this policy you accepted, and when.
- Audit entries: a log of actions on accounts and licences (for example a licence issued, a PC added or removed, an account deleted), kept to investigate problems and abuse.
We do not store your IP address. When you ask for a sign-in code, we keep a one-way keyed hash of the network address that asked for it with that code, and delete it with the code: when the code is used or replaced, or soon after it expires (codes last 10 minutes). To stop abuse we also count requests in short-lived counters keyed by one-way hashes; old counters are cleared automatically within a day. Our host keeps database backups for 7 days, so these hashes can remain in a backup for that long. No analytics and no tracking cookies: the only cookie is your website sign-in session.
Who processes it for us
- Cloudflare runs this website and the licence server, and stores the database and the update files.
- Stripe takes payments and makes refunds.
- Resend sends sign-in and account emails.
Your information may be processed outside Canada by these companies.
How long we keep it
- Sign-in codes expire after 10 minutes. A website sign-in expires after 7 days, and an app sign-in after 30 days without use.
- Order records are kept for 6 years for tax purposes, also after you delete your account, with your email removed.
- Everything else is kept while your account exists.
When you delete your account, your email is removed from it and from its orders, your PCs and stored sign-in codes are deleted, and your licences and sign-ins are ended. Audit entries stay, because the log cannot be edited. They name your account by an internal id, not by your email, except a record of an admin searching for your email, which contains it.
Your rights
In the app you can download a copy of everything we store about you, and you can delete your account. You can also email workwithkiyan@gmail.com to ask for either, or with any question about your information.
If there is a breach
If a breach of our security involving your information creates a real risk of significant harm to you, we will tell you and report it to the Office of the Privacy Commissioner of Canada.
Changes to this policy
Each version of this policy has a date. When it changes, the app asks you to accept the new version.
Contact
Kian Ayache, workwithkiyan@gmail.com