Legal
Privacy policy
Last updated: 23 July 2026
1. Scope
This policy describes how Zyra Public (“we”, “the service”) processes personal data when you use the website, account system, client software, and related features.
2. Data we process
Depending on how you use the service, we may process:
- Account data: username, email address, internal user ID, account creation time, salted password hash, invite relationships, role, ban status, profile-picture status, and subscription status. During signup verification, form contents are held temporarily until the account is created or the verification expires.
- Session and security data: IP address, login and session timestamps, session tokens, and a hashed browser identifier used to recognize sessions.
- Usage data: subscription changes, invite and activation-key activity, and security-relevant authentication events.
- Purchase data: internal order and user references, cryptocurrency deposit addresses and amounts, transaction identifiers when available, checkout status, timestamps, selected plan, and granted subscription time. We do not store wallet spending keys.
- Content you submit: profile pictures and forum content (titles, posts) if you use those features.
3. Why we process it
| Purpose | Data | Legal basis |
|---|---|---|
| Create and operate your account | Account, session, and subscription data | Contract performance (Art. 6(1)(b) GDPR) |
| Authenticate users and protect the service | IP, session tokens, browser identifier, security events | Contract performance and legitimate interests in security (Art. 6(1)(b), (f) GDPR) |
| Process purchases and grant access | Order references and payment status | Contract performance and legal record-keeping (Art. 6(1)(b), (c) GDPR) |
| Send signup verification mail | Username, email, verification code | Steps prior to contract (Art. 6(1)(b) GDPR) |
| Provide profile and community features | Profile pictures and forum content | Contract performance (Art. 6(1)(b) GDPR) |
4. Recipients
SMTP2GO receives your email address, username, and verification message to deliver signup mail. Cryptocurrency payments are processed on-chain to our own wallets; we do not use a third-party payment processor. Hosting and infrastructure providers may process connection data and stored account data on our behalf.
These providers may process data outside the European Economic Area. Their transfer safeguards and sub-processors are described in their own documentation.
5. Cookies
The site uses a strictly necessary authentication cookie to keep you signed in. Short sessions expire after 3 days; if you choose “Keep me signed in”, the duration is 30 days. We do not use advertising or analytics cookies.
6. Retention
Signup verification codes are accepted for about 10 minutes. Web sessions expire after their configured lifetime (3 or 30 days). Account, subscription, security, and community data is kept while the account remains active. Payment and transaction records may be retained for statutory tax and accounting periods.
7. Your rights
Where the GDPR applies, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests, subject to legal conditions. You may also lodge a complaint with a supervisory authority. Contact us through the service to exercise these rights.
8. Security
Passwords are stored as salted hashes. Session tokens authenticate web access. We apply technical measures appropriate to the nature of the service; no method of transmission or storage is completely secure.