Privacy Policy

The short version

• Your photos never leave your device. The app captures, stamps and saves them into your phone storage and gallery.
• No account. No email, no password, no access to your contacts.
• Location is used only to stamp the photo and to fetch local weather. There is no journey tracking and no background location collection.
• Right after each shot, the stamped text (time, coordinates, address, note) goes to our server so that whoever you later share the photo with can verify it — still without the image itself. If you would rather send nothing, turn the verification code off in the stamp settings: photos taken while it is off upload nothing at all.
• Payments are handled by the App Store and Google Play. The app never sees or stores your card details.
• No advertising. The app shows no ads in any tier and embeds no advertising or advertising-tracking SDK.

1. Who is responsible for your data

The TimePhoto app (package vn.com.zsoft.ztimephoto) and the website timephoto.z-cloud.com.vn are published and operated by Z-SOFT Co., Ltd., Vietnam.

For any question, deletion request or privacy complaint, write to support@z-cloud.com.vn.

2. Where your photos live

Photos taken with the app are written to your device storage and to the system photo gallery. They remain entirely under your control: uninstall the app or delete the photos and they are gone — we hold no copy.

The app does not back photos up to any cloud, does not send them to us and does not send them to third parties. A photo leaves your phone only when you choose to share it with another app (messenger, email…), and it then travels directly from your device to that app.

3. Data processed only on your device

The following never leaves your phone:

• The camera feed — to take and stamp the photo.
• Photos you pick from the gallery — when used as a virtual background or to replace a photo background. Subject segmentation runs entirely on-device — ML Kit on Android, Vision on iOS — with no network needed.
• Your settings — stamp layout, company logo, notes, saved delivery points, templates you saved from the shared library.

GPS position and street address are different: the app uses them on the device to print the stamp and to fetch local weather, but that is not where they stop — the coordinates and address are part of the verification record the app sends to our server right after each photo or video. See sections 4 and 5.

4. Data the app sends to our server

The app contacts timephoto.z-cloud.com.vn in four situations only:

• Checking for updates and licence status when you open the app: it sends a device code (a random string generated by the app for this installation — not your IMEI, not your phone number) and the app version.
• Registering a verification code right after each photo or video — see section 5.
• Fetching the support group link if you tap the "join support group" button.
• The template library when you open the Templates tab or share a template — see section 6.

As with any web server, access logs record IP address, request path and timestamp. They are used for troubleshooting and abuse prevention and are deleted after 90 days at most.

5. Photo and video verification codes and the /s/<code> page

Every photo and every video the app produces carries a 14-character code printed along its right edge (for videos the code also sits in the file metadata). As soon as the stamp is rendered, the app sends us the stamped text of that file — it does not wait for you to tap Share. That is why the share sheet opens instantly with the link https://timephoto.z-cloud.com.vn/s/<code> already attached, so the recipient can still verify the details if the file is cropped or edited. If you are offline when shooting, the record waits on the device and is sent once you are back online.

That text consists of: the verification code, capture time, time zone, coordinates and address (if you enabled location), the note you typed, the device model name (e.g. "Samsung SM-A566E"), the app version and the device code.

For photos the record also carries two fingerprints of the image file itself: a SHA-256 of the whole file and a 16-character string that follows what the picture looks like. Both are one-way hashes — the photo cannot be reconstructed from them, and they say nothing about what the photo shows. They are there so a recipient can check the actual photo in their hands against the record, not just the code: without them, anyone copying your code onto a different photo would borrow your timestamp and coordinates.

The server never receives and never stores the image or the video. Each record is signed with an Ed25519 key so any later tampering with our own storage becomes detectable.

Please note: anyone holding the link can open the /s/<code> page — no password is required, that is the point of it. So do not type confidential information into the note field. If you would rather no record be created at all, turn the verification code off in the stamp settings before shooting: photos and videos recorded while it is off carry no code and send nothing to the server. Turning it off afterwards does not withdraw records already registered — email us the verification code and we will delete them.

To have a registered record deleted, send the verification code to support@z-cloud.com.vn; we remove it within 7 business days.

6. The shared template library

The Templates tab is where users share stamp templates with each other. When you share one, the app sends us: the template name and creator / company you typed, the shape of the template (which parts are on, your note lines, the watermark text, where the info block sits) plus your device code and app version.

If your template has a logo and you leave the "Include the logo image" switch on, that logo image is uploaded too and kept so people who download the template can print it on their photos. Turn the switch off and no image leaves your device. This is the only exception: the photos you take are never sent to our server, not even when you share a template.

The logo follows the template's scope. A public template means anyone can download its logo along with it; a private one means only people holding the template code can. So share a logo-bearing template publicly only when you really want that logo used by anyone.

You pick one of two scopes. Everyone: the template appears in the in-app grid and anyone can find it by its name or yours. Private: it stays off the grid and opens only with the 8-character template code you hand out — anyone holding the code can open it, so keep confidential wording out of a template you are about to share.

Templates shared from your device can be edited or taken down at any time from Templates > Mine. Once removed the template is gone from the library, even for people holding the code, and a logo image no template still uses is deleted with it. To have us take down a template or a logo by hand, send the template code to support@z-cloud.com.vn.

Browsing, downloading and using someone else's template sends nothing beyond your device code and the template code.

7. Payments

The Pro plan is sold through the Apple App Store (iOS) and Google Play Billing (Android). The whole payment flow happens inside Apple’s or Google’s interface: the app never sees, receives or stores your card or bank details. It only receives the store’s answer to "is this purchase still valid". Apple’s and Google’s handling of your data is governed by their own privacy policies.

We never receive or store any payment transaction. Our server does not sit in the payment flow, receives no bank statements and keeps no transfer details about you.

8. Third-party services

• Apple App Store (StoreKit) — payment and subscription status on iOS.
• Google Play (Billing & Play Services) — payment and subscription status on Android.
• Open-Meteo — weather at the capture location. The app sends rounded coordinates and no identifiers.
• Apple Maps (MapKit) and Apple location services — on iOS: map imagery for the map picker and turning coordinates into a street address (CLGeocoder).
• OpenStreetMap — on Android: map imagery for the map picker; also the map on the verification page.
• Android/Google location services — on Android: turning coordinates into a street address (the on-device Geocoder).
• Telegram — creating an invite link to the user support group, only if you tap the join button.

When the app calls these services, that provider sees your IP address, as with any ordinary Internet request.

Beyond that list, the app integrates no ad network, advertising SDK or advertising tracker, and builds no advertising identifier or behavioural profile of you.

9. Permissions and why they are needed

• Camera — to take photos. Required for the core function.
• Location (precise / approximate) — to stamp coordinates, address and weather. Read only while the capture screen is open; if you decline it the app still takes photos, just without location.
• Storage / photo library — to save stamped photos and to read the picture you choose as a background.

The app does not request access to contacts, messages, call history or the list of installed apps.

10. How long we keep data

• Photo and video verification records — for as long as the link should keep working, at most 5 years, or until you ask us to delete them.
• Device and licence records — for the life of the licence plus 24 months for accounting and warranty purposes.
• Server logs — 90 days at most.

11. Who we share data with

We do not sell, rent or trade your data. It leaves our systems in three cases only: (a) the service providers listed in section 8, limited to what they need to do their job; (b) where a competent authority requires it under applicable law; (c) when you yourself share a verification link with someone.

12. Security

All traffic between app and server is HTTPS — the app refuses unencrypted connections. Verification records are signed with Ed25519. Our servers are located in Vietnam, with rate limiting and abusive-address blocking. No system is perfectly secure, however, so please do not put sensitive information into a photo note.

13. Your rights

Under Vietnam’s Decree 13/2023/ND-CP on personal data protection (and under the GDPR if you are in the EU/EEA), you have the right to:

• know what data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted — including photo and video verification records;
• withdraw consent: revoke the location permission in system settings, or uninstall the app;
• lodge a complaint with the competent data protection authority.

Send requests to support@z-cloud.com.vn; we reply within 30 days. Since the app has no accounts, please include your device code (shown in the app’s settings screen) or the photo code so we can find the right record.

14. Children

The app is aimed at working adults, is not directed at children under 13, and we do not knowingly collect children’s data. If you believe a child has sent data to our server, tell us at support@z-cloud.com.vn and we will delete it.

15. Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects your rights, the app shows a notice the next time you open it. Continuing to use the app after the new version takes effect means you accept it.

16. Contact

Z-SOFT Co., Ltd. — support@z-cloud.com.vn