Legal
Privacy Policy
Last updated
1Who we are
bzzd is run by AGP Software Solutions Inc. ("AGPSoft", "we", "us"), agpsoft.com, which decides how and why the information below is used. Questions, requests and complaints go to [email protected].
2What we collect, and why
- Your account
- Your email address and a one-way hash of your password (never the password itself), your user key, your plan, and when you signed up and confirmed your email. We need these to sign you in, send you account emails and apply your plan.
- Your devices
- The name and type of each phone or computer you add, and the push subscription its browser gives us: an address at the browser's push service and the keys to encrypt notifications for it. Without these, notifications can't reach the device.
- Your messages
- What your apps, scripts and services send: title, text, link, image, priority, which app sent it, and when it was read or deleted. We store messages to deliver them and to show them in your inbox. Things that look like passwords and tokens are hidden before a message is saved.
- Apps, checks and sharing
- Your apps' names, icons, tokens and integration types; your heartbeat checks' names and schedules, and the time of their latest ping; who you've shared an app with. The owner of a shared app sees the email address of each member.
- Usage and security
- How many messages your account sent each month, to apply your plan's limits. IP addresses of requests, kept briefly to limit abuse (for example too many sign-in attempts or wrong tokens), and in short-lived server logs to fix problems.
- Payments
- When you buy a plan, Stripe collects your payment details. We get back what we need to run your subscription, such as your plan, its status and the last four digits of your card, never the full card number.
- Signing in with Google
- If you choose to sign in with Google, Google tells us your email address and whether it's confirmed, and we use only that to sign you in.
We process this information to provide the service you asked for, as our Terms describe, and, for security and abuse prevention, because we and our users have a legitimate interest in a safe service.
3What we don't do
- We don't sell or rent your information, or share it for advertising.
- We don't read your messages, except when you ask us to help with a problem or the law requires it.
- We don't use your messages to train AI models or build profiles of you.
- We don't send marketing emails. The emails we send are about your account: confirming your address, resetting your password, and important changes to the service.
5Who helps us run bzzd
These providers process information on our behalf, only as needed for the service:
- Cloudflare
- Carries all traffic to bzzd.io and protects it from attacks. Its Turnstile check guards sign-up and password reset against bots.
- netcup
- Hosts the servers that run bzzd.
- Neon
- Hosts the database where accounts and messages are stored.
- Amazon Web Services
- Sends our account emails (Amazon SES).
- Push services
- Apple, Google, Mozilla and Microsoft run the push services that carry notifications to browsers. Each notification is encrypted for your device before it leaves us, so they can't read it; they see only that a notification is going to your device.
- Stripe
- Handles payments for paid plans.
- Signs you in, only if you choose Sign in with Google.
Some of these providers process information in the United States and other countries. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses.
We may also disclose information when the law requires it, or to protect the rights and safety of our users, the public or bzzd.
6How long we keep it
- Messages are deleted automatically after your plan's history period: 7 days on Free, 30 days on Pro. Messages you delete are removed for good within two days.
- Sign-ups that are never confirmed are deleted after 7 days.
- Your account and its apps, devices and checks are kept until you delete them or ask us to delete the account. We then delete it within 30 days, apart from what the law requires us to keep, such as payment records.
- Backups of the database are kept for a short time to recover from failures, then overwritten.
7Security
Everything travels over HTTPS. Passwords are stored as one-way hashes, notifications are encrypted for each device, and access to our systems is limited to the people running bzzd. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.
8Your choices and rights
You can see and change most of your information in the app: remove devices, delete messages and apps, and reset your tokens and user key. You can also ask us to:
- give you a copy of your information;
- correct it;
- delete your account and its information;
- stop or limit some processing, or object to it.
Write to [email protected] from your account's email address; we answer within 30 days. Depending on where you live (for example in the European Union, the United Kingdom or California), the law gives you these rights, and you may also complain to your data protection authority.
9Children
bzzd isn't meant for anyone under 16, and we don't knowingly collect their information. If you think a child has an account, tell us and we'll delete it.
10Changes to this policy
When this policy changes, we'll update the date at the top. If a change matters, we'll email you or show a notice in the app before it takes effect.