Privacy policy.

Zekra (zekra.dev) is built and run by Fady Mondy, Heliopolis, Cairo, Egypt, who is responsible for the data this website collects. For anything on this page, write to info@3x1.io or call +201207860084.

This policy covers the zekra.dev website — its pages, blog, forms and newsletter — not sites it links to.

Newsletter: if you subscribe, your email address, the language and page you subscribed from, your subscription status and when it changed, and a random single-use confirmation token.

Forms and chat: what you type into a contact form or the chat, an opaque random visitor id kept in a cookie so a conversation survives a page reload, the page you wrote from, and your browser's user-agent string.

Server logs: ordinary web-server records of requests, used to operate the site and diagnose faults.

This page is about the website. What you put into the Zekra application itself is handled by the application.

When a Google Analytics measurement id or Google Tag Manager container is configured for the site, those scripts load in your browser and send Google pageview and session data, including a device identifier and an approximate location derived from your IP address.

I read this only as aggregate traffic reports — visits, top pages, referrers. I do not try to identify individual visitors from it. You can block it with a tracker-blocking extension or Google's own opt-out add-on without losing any site functionality.

The site sets a random chat visitor id so a conversation survives a page reload, and — only if you sign in to the admin area — an httpOnly session cookie. Your language and theme choices are also remembered in the browser.

Any further cookies come from Google Analytics or Google Tag Manager when those are enabled. I do not run advertising cookies of my own and do not sell any data.

The newsletter runs on your consent, given by confirming the double opt-in email, and you can withdraw it at any time.

What you send through a form or the chat is used to answer you. Logs and analytics support the legitimate interest of keeping the site running and knowing which pages and articles are read.

Email is delivered through an SMTP provider, which necessarily handles your address and the message. Analytics data goes to Google. The site runs on hosting and a CDN that process requests on its behalf.

Beyond that, nothing is shared, sold, or handed to advertisers. Data is disclosed to authorities only where the law requires it.

Subscriber rows are kept while you are subscribed. Unsubscribing marks the record as unsubscribed rather than deleting it immediately, so the same address is not re-added by mistake; ask and it is deleted outright.

Messages sent through a form or the chat are kept as a record of the conversation. Anything can be removed earlier on request.

You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Email info@3x1.io from the address concerned and it is handled without charge.

For the newsletter specifically, the unsubscribe link in any issue is the fastest route and needs no email to me at all.

This site is aimed at professionals and is not directed at children under 16, and no age data is collected.

If a child's details reach me through a form, tell me and I will delete them.

This section covers the Zekra apps for iPhone and Android and the web app at app.zekra.dev.

Account: your email address and password (stored hashed), your display name and timezone, or the name, email address and account identifier that Apple, Google or GitHub share when you sign in with them.

Your content: the brains you create or join, and the memories, notes and their versions, images and files, vault secrets (encrypted at rest) and presentations in them, plus the share links you create.

Device data: when you turn on notifications in Settings → Notifications, a push token (Firebase Cloud Messaging, and Apple's push service on iPhone). The home-screen widget shows brain names and counts on the device.

Analytics and crashes: Google Analytics for Firebase records which screens are opened (by screen type, never a note or brain id) and a few named actions, with an app-instance identifier and an approximate location that Google derives from your IP address. It never receives your content, your user id or an advertising identifier. Crash reports (device model, operating system, app version, the error) go to Firebase Crashlytics and are not linked to your account. "Report a problem" sends what you write, device details and, if you add them, a screenshot and your email address to our issue tracker (Mahaam).

The app has no advertising and no tracking.

Some features use a language model: chatting with a brain and translating a presentation. Today these run on Zekra's own self-hosted model (Qwen 2.5 14B) on Zekra's infrastructure, and search, recall and text recognition (OCR) use models we also host ourselves. No third-party AI provider is configured, so none of your content is sent to an outside AI service.

Before you translate a presentation for the first time, the app shows a consent dialog that names the provider that will process the text. If a third-party AI provider is ever enabled, the app will name it and ask you before any of your content is sent to it.

Only the providers needed to run Zekra: our hosting and database servers, Google Firebase (Cloud Messaging for notifications, Analytics and Crashlytics), an email provider for account emails, and Apple, Google or GitHub when you sign in with them. AI features run on our own servers, as described above. People you invite to a brain see its content, and anyone with a presentation link you share can open it until you revoke it or it expires. We disclose data if the law requires it. We do not sell personal data and do not use it for advertising.

In the app: Settings → Delete account. On the web: https://app.zekra.dev/en/account/delete (sign in first). The steps, for anyone without the app, are at https://zekra.dev/en/delete-account. If your account has a password, you confirm with it. If you sign in with Apple, Google or GitHub and have no password, we email you a 6-digit code to confirm. If you can't sign in at all, email info@3x1.io from the address on your account.

Straight away you are signed out everywhere, and your push tokens, AI-agent (MCP) connections and phone-camera pairings are removed. For 14 days you can cancel the deletion, on the web page or from the app's sign-in screen. After 14 days we permanently delete your account, every brain that you alone own together with all its content (notes and their versions, memories, images and files, presentations and their share links, and secrets), and your notifications, and we revoke your Sign in with Apple tokens at Apple.

Brains that have another owner stay with that owner; the notes you wrote there remain, without your name. The audit trail keeps only your user id and a one-way hash of your email address, and IP addresses are cleared.

As features are added to the site this text is updated to match them. The date at the top is the last material change.

The aim is that this page always describes what the code actually does, not a generic template.

Email info@3x1.io , phone or WhatsApp +201207860084, or write to Heliopolis, Cairo, Egypt.