Privacy Policy
This is an earlier version, in force until 20 September 2026. The current policy is at /privacy/.
Last updated: 30 August 2026
The short version. ZeroPercent exists for one thing: if a phone dies, gets lost, or is stolen, its owner can still reach the people they trust. To do that we store the minimum we need: your name, phone number, date of birth, battery level, and your chosen trusted contacts. We never track your location. We never show ads. We never sell your data.
1. Who we are
ZeroPercent is a trading name of OppBox Ltd, a company registered in England & Wales under the company number 17351386 ("we", "us"). We are the data controller for the personal information described in this policy. You can reach us at [email protected].
This policy covers the ZeroPercent iOS app, the website at zeropercentapp.com, and the rescue sign-in at zeropercentapp.com/rescue.
2. What we collect and why
| Data | Why we need it |
|---|---|
| Name | So your family and trusted contacts see who you are. |
| Mobile number (verified by SMS code) | Your number is your account. It is also the first factor of the rescue sign-in, and how trusted people recognise you. |
| Date of birth | Age rules: from 16 you can create an account on your own; at 13–15 you can only join a family a parent or guardian invites you into; under-13s can't have an account at all; and creating a family is 16+, and a family with anyone under 16 in it must include an adult (18+). Your date of birth is also part of the rescue sign-in. |
| Rescue PIN | The third factor of the rescue sign-in. Stored only as a salted cryptographic hash, and we cannot read it back. |
| Battery level and charging state | The core of the product: your family can see your battery is low before your phone goes dark. iOS shares this in 5% steps. |
| Trusted contacts (names, numbers, relationship) | Who you would reach from a borrowed phone. Visible only to you. Family members see only how many you have, never who. |
| Family membership and role | Connects guardians and members so battery visibility and approvals work. |
| Device info (model, OS version, app version) | Diagnostics and making sure battery reporting works on your device. |
What we deliberately do not collect: your location, your browsing, your messages outside a rescue session, your contacts book (unless you explicitly pick someone as a trusted contact), advertising identifiers, or any data for marketing profiles.
3. Rescue sessions
When your phone dies and you sign in from a borrowed phone, we verify your number, date of birth, and PIN, then show your trusted contacts with partly masked numbers. Messages you send are relayed through our telecommunications provider (Twilio). Your trusted contact sees the relay and your name, and the borrowed phone keeps nothing after the 15-minute session ends. Failed sign-in attempts are rate-limited and logged (identifiers only) to protect against guessing.
4. Children and families
ZeroPercent has a minimum age of 13, and there is no version of it for under-13s. From 16 you can create an account by yourself. Between 13 and 15 you can't: a parent or guardian creates the family and sends you an invite code, and that invitation is the only way in. Anyone under 18 who joins a family as a member is approved by an admin of that family before their membership becomes active. Admins are 16 or over, and any family containing someone under 16 must also include an admin aged 18 or over.
Accepting an invitation into a family is how you agree to that sharing, and it covers whoever is in the family — including anyone added later, since admins can invite and approve new members. Leaving the family ends it.
We designed data visibility narrowly: admins see a member's battery and readiness. Never their trusted contacts, and never any location, because we don't collect it.
5. Who we share data with
We share personal data only with the service providers who run ZeroPercent, under contracts that limit what they may do with it:
- Supabase: our database and authentication provider (hosting in the EU).
- Twilio: sends SMS verification codes and relays rescue messages and calls.
- Resend: sends account emails, if you add an email address.
- Cloudflare: hosts our website and rescue page.
- Apple: App Store distribution and, if you subscribe to Pro, payment processing. We never see your payment details.
We do not sell or rent personal data to anyone. We do not share data with advertisers or data brokers. We may disclose data if the law requires it, or to protect someone's life or safety.
Mobile numbers and text message consent. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Twilio carries our messages as a processor acting on our instructions, which is not sharing for marketing, and it may not use the numbers for any purpose of its own. How each kind of text works, and how to stop them, is set out in our text message terms.
6. How long we keep data
- Account data: for as long as your account exists.
- Battery history: rolling recent history only, enough to show "last known" honestly.
- Rescue sessions: session tokens expire after 15 minutes. Messages sent during a rescue, their delivery status, and any replies from your trusted contacts are held only for the session and deleted shortly after it ends; audit records keep identifiers only.
- Deleted accounts: deleting your account in the app (Settings → Delete account) permanently removes your profile, contacts, battery history, and family records. Backups age out within 30 days.
7. Your rights
Under UK and EU data protection law you can ask us to access, correct, delete, or export your personal data, restrict or object to processing, and withdraw consent at any time. Most of this you can do directly in the app; for anything else email [email protected] and we'll respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
8. Security
All traffic is encrypted in transit. Every database row is protected by row-level security so users can only ever read what this policy says they can. Rescue PINs are stored as salted hashes. Rescue sign-in gives identical responses for every kind of failure, so an attacker learns nothing about which detail was wrong.
9. International transfers
Our primary hosting is in the European Union. Where a provider processes data outside the UK/EU (for example Twilio routing an SMS), we rely on that provider's standard contractual clauses and equivalent safeguards.
10. Changes to this policy
If we make material changes we'll tell you in the app before they take effect, and update the date at the top of this page.
11. Cookies
The app sets no cookies. On this website we use only what is needed to make it work, plus anything you have actively agreed to. What each category is for, and how to change your mind, is set out in our cookie policy.
12. Contact
OppBox Ltd (trading as ZeroPercent), company number 17351386. [email protected]