Privacy Policy
Last updated: 30 August 2026
The short version. ZeroPercent exists for one thing: if a phone dies, gets lost, or is stolen, its owner can still reach the people they trust. To do that we store the minimum we need — your name, phone number, date of birth, battery level, and your chosen trusted contacts. We never track your location. We never show ads. We never sell your data.
1. Who we are
ZeroPercent is a trading name of OppBox Limited, a company registered in the United Kingdom ("we", "us"). We are the data controller for the personal information described in this policy. You can reach us at [email protected].
This policy covers the ZeroPercent iOS app, the website at zeropercentapp.com, and the rescue sign-in at zeropercentapp.com/rescue.
2. What we collect and why
| Data | Why we need it |
|---|---|
| Name | So your family and trusted contacts see who you are. |
| Mobile number (verified by SMS code) | Your number is your account. It is also the first factor of the rescue sign-in, and how trusted people recognise you. |
| Date of birth | Age rules: under-18s must belong to a family and under-13s need a parent or guardian to set things up. Your birth month and year are also part of the rescue sign-in. |
| Rescue PIN | The third factor of the rescue sign-in. Stored only as a salted cryptographic hash — we cannot read it back. |
| Battery level and charging state | The core of the product: your family can see your battery is low before your phone goes dark. iOS shares this in 5% steps. |
| Trusted contacts (names, numbers, relationship) | Who you would reach from a borrowed phone. Visible only to you — family members see only how many you have, never who. |
| Family membership and role | Connects guardians and members so battery visibility and approvals work. |
| Device info (model, OS version, app version) | Diagnostics and making sure battery reporting works on your device. |
What we deliberately do not collect: your location, your browsing, your messages outside a rescue session, your contacts book (unless you explicitly pick someone as a trusted contact), advertising identifiers, or any data for marketing profiles.
3. Rescue sessions
When your phone dies and you sign in from a borrowed phone, we verify your number, birth month and year, and PIN, then show your trusted contacts with partly masked numbers. Messages you send are relayed through our telecommunications provider (Twilio) — your trusted contact sees the relay and your name, and the borrowed phone keeps nothing after the 15-minute session ends. Failed sign-in attempts are rate-limited and logged (identifiers only) to protect against guessing.
4. Children and families
ZeroPercent is a family product with a minimum age of 13. Under-18s can only use ZeroPercent inside a family created by an adult guardian, who approves them joining. We designed data visibility narrowly: guardians see a member's battery and readiness — never their trusted contacts, and never any location, because we don't collect it.
5. Who we share data with
We share personal data only with the service providers who run ZeroPercent, under contracts that limit what they may do with it:
- Supabase — our database and authentication provider (hosting in the EU).
- Twilio — sends SMS verification codes and relays rescue messages and calls.
- Resend — sends account emails, if you add an email address.
- Cloudflare — hosts our website and rescue page.
- Apple — App Store distribution and, if you subscribe to Pro, payment processing. We never see your payment details.
We do not sell or rent personal data to anyone. We do not share data with advertisers or data brokers. We may disclose data if the law requires it, or to protect someone's life or safety.
6. How long we keep data
- Account data: for as long as your account exists.
- Battery history: rolling recent history only — enough to show "last known" honestly.
- Rescue sessions: session tokens expire after 15 minutes. Messages sent during a rescue, their delivery status, and any replies from your trusted contacts are held only for the session and deleted shortly after it ends; audit records keep identifiers only.
- Deleted accounts: deleting your account in the app (Settings → Delete account) permanently removes your profile, contacts, battery history, and family records. Backups age out within 30 days.
7. Your rights
Under UK and EU data protection law you can ask us to access, correct, delete, or export your personal data, restrict or object to processing, and withdraw consent at any time. Most of this you can do directly in the app; for anything else email [email protected] and we'll respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Security
All traffic is encrypted in transit. Every database row is protected by row-level security so users can only ever read what this policy says they can. Rescue PINs are stored as salted hashes. Rescue sign-in gives identical responses for every kind of failure, so an attacker learns nothing about which detail was wrong.
9. International transfers
Our primary hosting is in the European Union. Where a provider processes data outside the UK/EU (for example Twilio routing an SMS), we rely on that provider's standard contractual clauses and equivalent safeguards.
10. Changes to this policy
If we make material changes we'll tell you in the app before they take effect, and update the date at the top of this page.
11. Contact
OppBox Limited (trading as ZeroPercent) — [email protected]