Privacy Policy

Last updated: 10 October 2026

1. Who we are

ZeroPercent is a trading name of OppBox Ltd, a company registered in England & Wales under the company number 17351386 ("we", "us"). We are the data controller for the personal information described in this policy, and we are registered with the UK Information Commissioner's Office under registration number C2039038. You can reach us at [email protected].

This policy covers the ZeroPercent iOS app, the website at zeropercentapp.com, the web app at zeropercentapp.com/me, the pages where someone agrees to be reached (zeropercentapp.com/c/), and the rescue sign-in at zeropercentapp.com/rescue.

2. What we collect and why

What we deliberately do not collect: your location, your browsing, your messages outside a rescue session, your contacts book (backup contacts are typed in; the app never reads your address book), advertising identifiers, or any data for marketing profiles.

Why we are allowed to use your data

Data protection law requires us to have a reason for each thing we do with personal data. Ours are:

• To provide the service you signed up for (your account, your people, rescue sign-in and relaying your messages). If you are 16 or over, this is because we have a contract with you. If you are 13 to 15, we rely on legitimate interests instead: yours, in being able to reach help, and ours, in providing that.
• Family battery sharing, battery check-ins and low-battery alerts: legitimate interests. People in a family have an interest in knowing a phone is about to die, and the person whose phone it is has an interest in someone noticing. You can turn alerts about you off yourself, in the app; the people who run your family can turn them off too, and see when you have; if you are 18 or over, you can also switch off Check now for your phone; and you can leave a family at any time.
• Your date of birth, for the age rules: legitimate interests, so that we can follow the UK's code of practice for services used by children.
• Holding a backup contact's number, asking them to agree, and texting them (or, on Pro plans, calling them) during a rescue: legitimate interests. Someone in trouble has an interest in reaching the people they chose, and those people have agreed to it on our page. The same applies to people on the same plan reaching each other: each of them ticked to agree when they joined, or, for someone under 16, the adult(s) who run the family agreed when they approved them. The tick box is how you agree to our texts; we do not rely on it as consent under data protection law, so saying no or replying STOP simply means we stop, and on request we delete your number.
• Security, preventing abuse, and keeping safety records: legitimate interests, in keeping accounts and families safe and being able to show what happened.
• Cookies that are not strictly necessary, and "offers and tips": only with your consent, which you can withdraw at any time in cookie preferences or in the app.

You have the right to object to anything we do on the basis of legitimate interests. For backup contacts, replying STOP or emailing us always ends it; we will not argue. For anything else, email [email protected].

3. Rescue sessions

When your phone dies and you sign in from a borrowed phone, we verify your number, date of birth, and PIN, then show your people with only the last three digits of each number. Messages you send are relayed through our telecommunications provider (Twilio). Your backup contact sees the relay and your name, and we store nothing on the borrowed phone after the 15-minute session ends. Failed sign-in attempts are rate-limited and logged (identifiers only) to protect against guessing.

4. If someone added you as their backup contact

You must be 16 or over to be someone's backup contact. Under-16s can only be reached as a member of a family plan (section 5).

You do not need a ZeroPercent account to be someone's backup contact, and you may be reading this because you got a text from us. Here is what that means.

How we got your number. Somebody who knows you typed it into their own list of people they would want to reach if their phone died. We did not buy it, and we did not take it from anyone's address book: the app never uploads contacts.

What we hold about you. Your number, the name and relationship label the person gave you, and a record of you agreeing: when, which wording you saw, the reference for the code we texted you, your browser type and a scrambled form of your internet address. If you agreed by texting us instead, we keep the message you sent, shortened to sixty characters. We keep this so we can show that you knew and agreed, if we are ever asked to. That is all. You are not a user, you have no profile, and we do not build one.

What we do with it. Nothing at all until that person starts a rescue from a borrowed phone, and then we send you the message they asked us to send. We never message you to advertise anything.

Agreeing. The person who added you sends you a link. The page it opens tells you who they are and what this means. If you are happy, tick the box, type your number and enter the code we text you. Ticking the box is you agreeing to our texts. It does not change why we are allowed to hold your number, which is explained above. If you are under 18, the page says so in plainer words and suggests you talk to the adult(s) who run your family first.

Older introductions. If you were asked to text SAVED and a code to our number before 25 September 2026, or by someone using an older version of the app, that still works. The code only tells us which person you are confirming for.

The link and the code. We keep the one-time code we text you for 24 hours, then delete it. We keep the record of the link itself for 30 days after it was used or ran out, so we can stop the same link being used twice, then delete it.

How long. We keep the record of you agreeing while you are someone's backup contact and for four years after, because that is how long someone could bring a legal claim about a text in the United States. Then we delete it.

Stopping. Reply STOP to any message from us and we will not text or call you again from any of our numbers. Reply HELP for what we are. You can also ask us to delete your number by emailing [email protected], whatever the person who listed you does, and you do not have to give a reason. You have the right to object to us holding or using your number. STOP or an email is enough.

5. Children and families

ZeroPercent has a minimum age of 13, and there is no version of it for under-13s. From 16 you can create an account by yourself. Between 13 and 15 you can't: someone else creates the family and sends you an invite code, that invitation is the only way in, and an adult (18 or over) who runs the family must approve you. Anyone under 18 who joins a family as a member is approved by an admin of that family before their membership becomes active. Admins are 16 or over, and any family containing someone under 16 must also include an admin aged 18 or over.

Reaching each other on a plan. Everyone on a plan can reach everyone else on it in a rescue. When you join, you tick to agree to that, and to our texts (and, on Pro plans, calls). If you are 16 or 17, the wording is written for you. If you are under 16, you do not tick anything: the adult(s) who run your family agree for you when they approve you. You can switch off any individual on the plan in Settings and stay on it. If you leave the plan, or are removed, that agreement ends and the others can no longer reach you through it; if you rejoin, we ask again.

When you accept an invitation into a family, the people who run it can see your battery level and readiness. Other members see only their own. That applies to whoever runs the family, including anyone added later, since admins can invite and approve new members. Leaving the family ends it. If you leave a family, or are removed from one, your account, your backup contacts and your rescue sign-in stay yours. Between 13 and 15 there is one limit: the account cannot be used outside a family, so if you have not joined one within 30 days we tell you in the app and, a week later, delete it (section 7).

We designed data visibility narrowly. The people who run a family see a member's battery level, readiness, and when that member last used the rescue sign-in (the time, never the messages). They also receive security notices about a member's account: a sign-in on a new device, a ZeroPercent PIN change, three failed rescue sign-ins in an hour, and a lockout. If a member under 18 switches off someone on the plan, the adult(s) who run the family see that that person cannot reach them. Never a member's backup contacts, and never any location, because we don't collect it.

The people who run your family are individuals, not us. What they do with what they see is up to them, which is why we keep it to battery, readiness and security notices. If someone is using a family to control you, see what to do.

6. Who we share data with

We share personal data only with the companies that help us run ZeroPercent. Most of them act only on our instructions, under a contract. Two of them, Twilio and Apple, also use some data for purposes of their own, and we say so below.

• Supabase: our database and authentication provider (hosting in the EU).
• Twilio: sends sign-in codes and carries rescue messages and calls. For sending what we ask it to send, it acts on our instructions. As a telecoms provider it is also responsible in its own right for the records a message creates (the numbers at each end, times, delivery status) and for message content, which its terms let it use to keep its network secure, prevent spam and fraud (including training its own fraud-detection tools), meet its legal and carrier obligations, develop and improve its products, and for its own business analysis. See the note below.
• Cloudflare: hosts our website and rescue page.
• Google: we read and answer email in Google's mail service, so anything you send to [email protected], including a request to see or delete your data, is held there.
• Apple: App Store distribution, payment processing if you subscribe, and delivering push notifications to your phone. We never see your payment details. Apple decides for itself how it handles the data those services create, under its own privacy policy.
• Your browser's push service, only if you turn on notifications on your account page in a browser: Google for Chrome and most Android browsers, Mozilla for Firefox, Apple for Safari. It passes our notifications on to your browser. What we send is encrypted with keys your browser made, so the push service cannot read it; it sees the address, the time and the size. Your browser chose it, not us, and it handles that data under its own privacy policy.
• Slack: an internal activity feed, so the people who run ZeroPercent can see it being used. It carries the region, the shape of a group, counts and an age band: "a family of three signed up in the UK". Never a name, a number, an account id, a message you sent or a rescue's contents.

We do not sell or rent personal data to anyone. We do not share data with advertisers or data brokers. We disclose data to the police or another authority only under a court order or another legal power that compels it, or where someone's life is in immediate danger. A request that is not backed by a legal power is answered by preserving the records while the authority obtains one, not by handing them over.

If OppBox Ltd is sold, merges, or transfers ZeroPercent to another company, your data would go with it, under this policy, and we would tell you in the app first.

Mobile numbers and text message consent. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Twilio sends what we ask it to send, on our instructions. It is also a telecoms provider in its own right, and for the purposes listed above it decides for itself how routing records and message content are used, under its own privacy notice. We chose Twilio knowing this. It is one reason a rescue message is as short as it is, and why we set Twilio to delete its stored copy after 30 days. How each kind of text works, and how to stop them, is set out in our text message terms.

7. How long we keep data

• Account data: for as long as your account exists.
• Crash and performance reports: 90 days.
• Battery history: 30 days. Your current level and when it was last reported are kept while your account exists, so your family's screen can show "last known" honestly.
• Battery check-in records: 7 days.
• Sign-in check records: 1 day.
• Invite link opens: 1 hour.
• Rescue sessions: a session lasts 15 minutes. Messages sent during a rescue, their delivery status and any replies are deleted from our systems within a day of the session ending. The session record itself (times and internal references, no content) is kept for 7 days, and sign-in attempts for 30 days. Twilio, which carries the messages, is set to delete its stored copy of each message and delivery record after 30 days (its systems can take up to 30 more to clear). Twilio also keeps some records for its own purposes as a telecoms provider, such as billing and fraud prevention, for periods set out in its privacy notice, which we do not control. If the police, a court or another authority asks us to keep a specific record, or we believe a specific record is needed to protect someone's safety, we set that record aside and keep it only until the matter is resolved. Everything else is still deleted on schedule.
• Sign-in codes: the text carrying your code is kept by Twilio for the same 30 days. We keep a scrambled (hashed) form of the number, never the number itself, for 30 days to stop the same number being sent codes over and over.
• Deleted accounts: deleting your account in the app (Settings → Delete account) permanently removes your profile, contacts, battery history, and family records. Backups age out within 30 days.
• Unused accounts: if nothing has used your account for 18 months (no sign-in, no battery report from your phone, nothing done in the app or on the web), we delete it with everything in it, as if you had deleted it yourself. We warn you twice first, in the app, at least three weeks before the date we name. Opening the app before then keeps the account. We do not do this to someone who runs a family that still has other members in it, or to the only adult in a family with a child under 16; those accounts are left for the family to sort out.
• Under-16s with no family: between 13 and 15, ZeroPercent only works inside a family (section 5). If you leave your family, or are removed from it, and have not joined another within 30 days, we tell you in the app, name a date a week later, and say what to ask for: an invite code from the adult who runs your family. If you are still not in a family on that date, we delete the account with everything in it. Joining a family at any point before then keeps it. This is the one case where an account is removed sooner than the 18 months above, and it exists because the account can do nothing in that state and we should not hold a child's data we cannot use.
• Safety and security records: we keep a log of the things that matter if something goes wrong later. A rescue was started. A message was relayed. Someone was approved into a family, or removed from one. A ZeroPercent PIN was changed. Each entry holds the time, the action, and internal reference numbers. It never holds what anyone said. We keep these for six years because they are what lets us answer, months afterwards, whether a number was reached with permission, or how somebody gained access to a family. After six years they are deleted. When you delete your account, these entries stop pointing at you: the link to your profile is severed, so what remains records that something happened, not that you did it.
• Product events and in-app notices: product events (section 2) are deleted after 12 months, and the notices in your in-app inbox after 90 days.
• A record that a backup contact or plan member agreed: whether they agreed on our page, by texting our number, or by joining a plan, we keep the record described in sections 2 and 4 with the pair of them, so we can show a phone network or a regulator that they knew and agreed, and when. We keep it while they can be reached by that person and for four years after. A STOP is kept against the number for as long as it takes to honour it, which is indefinitely.
• Confirmation codes and links: the one-time code on our page is deleted after 24 hours, and the link record 30 days after it was used or expired.

8. Your rights

Under UK data protection law you can ask us to access, correct, delete, or export your personal data, and to restrict or object to processing. Where we rely on your consent (cookies that are not strictly necessary, and "offers and tips"), you can withdraw it at any time, in cookie preferences or in the app. Most of this you can do directly in the app; for anything else email [email protected] and we'll respond within one month. Before we act on a request we may ask you to prove the account is yours, usually by signing in to the app or replying from the number on the account.

If you're under 18, these rights are yours. You can email us yourself, and we won't tell the adults who run your family unless you ask us to or someone is at risk. An adult who runs your family can ask on your behalf only with you involved.

If you are unhappy with how we have handled your data, email [email protected] with the word Complaint in the subject. We will acknowledge it within 30 days and tell you the outcome. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

9. Security

All traffic is encrypted in transit. Every database row is protected by row-level security, designed so that users can read only what this policy says they can. Rescue PINs are stored as salted hashes. Rescue sign-in gives identical responses for every kind of failure, so that a failed attempt does not reveal which detail was wrong. If a breach is likely to put you at risk we will tell you directly, as well as the ICO.

10. International transfers

Our main hosting is in the European Union, which UK law treats as providing adequate protection. Twilio, Cloudflare and Slack are in the United States and are certified under the UK Extension to the EU-U.S. Data Privacy Framework, which UK law also recognises. If a certification lapses, the transfer is covered instead by the safeguards in that provider's contract (binding corporate rules or the UK Addendum to the EU standard contractual clauses). Apple is also in the United States and relies on the EU standard contractual clauses with the UK Addendum, and our email provider, Google, holds email there too. A text message also passes through mobile networks on its way to the recipient, which no sender can control.

11. Changes to this policy

If we make material changes we'll tell you in the app before they take effect, and update the date at the top of this page.

12. Cookies

The app sets no cookies. On this website we use only what is needed to make it work, plus anything you have actively agreed to. What each category is for, and how to change your mind, is set out in our cookie policy.

One part of this site is run by somebody else: the security check on the rescue page (Cloudflare). It stores nothing in your browser under our name. The cookie policy says what it does in practice.

13. Contact

OppBox Ltd (trading as ZeroPercent), company number 17351386. ICO registration C2039038. [email protected]

Previous versions of this policy