Privacy Policy

Telegram account details. When you start the bot or open the mini app, Telegram shares your numeric Telegram ID, username, first name and language. We use these to create your account and deliver alerts.

Email address (optional). If you add an email for login or account verification, we store it together with its verification status. If you set a password for web login, we store only a salted hash, never the password itself.

Alert settings. The coins, conditions, thresholds and public wallet addresses you ask Zash to watch. Wallet addresses you track are public blockchain data and are not linked to your identity by us beyond your own watchlist.

Payment records. Payments are processed by Stripe (cards), NOWPayments (crypto) and Telegram Stars. We never see or store full card numbers. We keep subscription status, plan, invoice references and payment timestamps.

Usage data. We use Google Analytics on the marketing site and app to understand which pages and features are used. This relies on cookies and collects device and interaction data as described in Google's policies.

Support messages. Messages you send to our support account or email are kept so we can resolve your issue and improve the product.

We use your data to deliver the alerts you configure, operate and secure your account, process subscription payments, respond to support requests, prevent abuse, and improve the product. We do not sell your personal data, and we do not use it for third party advertising.

We share data only with the processors needed to run the service: Telegram (message delivery), Stripe and NOWPayments (payments), our hosting providers (servers and databases), Google (analytics), and email delivery providers (verification and account emails). Each processor receives only what it needs for its role.

We may disclose data if required by law or to protect the rights, safety or integrity of Zash and its users.

We keep your account data while your account is active. Alert history and delivery logs are kept for a limited period for reliability and abuse prevention, then deleted or aggregated. Payment records are kept as long as accounting and tax rules require. If you ask us to delete your account, we remove personal data that we are not legally required to keep.

All traffic to zash.xyz and app.zash.xyz is encrypted with HTTPS. Passwords are stored only as salted hashes. Access to production systems is restricted and credentials are rotated. No system is perfectly secure, but we treat the live service and its data with strict care.

You can view and change your alert settings and email in the app at any time. You can request a copy of your data, or ask us to correct or delete it, by writing to Support@zash.xyz from the account email or from your Telegram account. You can block or delete the Telegram bot at any time, which stops all message delivery.

Zash is not directed at children and is intended for users who are at least 18 years old. We do not knowingly collect data from anyone under 18.

If we make material changes to this policy we will update this page and its date, and for significant changes we will notify you in the app or by Telegram message.

Questions about privacy? Email Support@zash.xyz or message our support account on Telegram. The data controller is ZASH APP LTD, company number 16987818, registered in England and Wales.