Security
Your notes, kept with care.
Where your notes are kept, who can see them, and what leaves your iPhone, and when.
Where it lives
Your notes, on Zimoma’s server
Notes are kept in your Zimoma account, not in iCloud, so they appear on every device you sign in to and can be shared.
- The server
- In India, run on Hostinger.
- On the way
- All traffic between the app and the server is HTTPS.
- The database
- Runs in its own container and isn’t reachable from the internet.
- Backups
- Made every night and kept for 30 days, with a copy kept off the server.
- Photos, scans and recordings
- Stored on the server with the note they’re in, and removed when the note is deleted for good.
- Not synced yet
- A note written offline stays on your iPhone until it can upload.
- Request logs
- Ordinary logs, such as IP address and time, kept a short time to keep the service running and secure.
- Recently deleted
- A note you delete waits there 30 days, then is removed.
Accounts
Three ways to sign in
Sign-in is run for Zimoma by Clerk.
Sign in with Apple
Apple passes on the email address you choose to share, which can be a private relay address.
Continue with Google
Google passes on your name, email address and profile picture.
Email and password
Your email address and a password, with a 6-digit code sent to your email.
Kyoto, day three
zimoma.com/p/kyoto-day-three
- PasswordOn
- Show in search enginesOff
- Expires22 October
- Views14
Stop sharing
Sharing
You decide who sees a note
Nothing is shared until you share it. Every note and space has the same three levels: Can edit, Can comment and Can view.
- People you inviteSee the note or space, your name and email address, and whether you’re in it right now.
- Published pagesA read-only page, hidden from search engines unless you say so. Add a password or an end date.
- Stop sharing, at onceThe page goes straight away. Share again and it gets a new address, so old copies never open.
Published pages
A page on the web, on your terms
A password
Kept only as a hash. The password page shows nothing of the note, not even its title. After 10 wrong tries in 10 minutes from one place, it says “Too many tries”.
Out of search engines
Hidden from them by default. They can’t be let in while the page has a password.
An end date
After it, the page simply isn’t there, the same as one that was never published.
And the rest
Tokens, AI, and what we don’t do
Access tokens
For apps and AI assistants. Read only or read & write, shown once, and kept only as a fingerprint. Revoke one in Settings › Connections and it stops at once.
No more than you
A token sees what its owner sees. In a space you can only view, it can only read.
AI only when you tap
Only what you chose is sent, to OpenAI, with passwords and secrets found in text removed first. OpenAI is asked not to store it.
One switch for AI
Settings › AI features › Use AI features turns all of it off. Turn off Search notes with AI and its index is deleted.
No ads, no tracking
No advertising, no analytics or tracking software from other companies in the app, and your information is never sold.
Delete your account
Settings › Account › Delete account closes it at once and revokes its tokens. Its data is removed from the server within 30 days.
Sub-processors
Who else handles your information
The same list as in the privacy policy.
| Company | What it does for Zimoma |
|---|---|
| Clerk | Accounts and sign-in. |
| Hostinger | The server the service runs on, in India. |
| OpenAI | AI requests you make, only when you tap. |
| Apple | Sign in with Apple, speech recognition, delivering notifications, and payment for subscriptions. |
| Sign-in, if you choose Continue with Google. | |
| RevenueCat | If you subscribe to Pro: whether your subscription is active. Zimoma never sees your card details. |
Disclosure
Reporting a security problem
If you think you’ve found a weakness in Zimoma, the app, the website or the API, write to support@zimoma.com with “Security” in the subject.
What to include
- What you found, and where: the app, zimoma.com or api.zimoma.com.
- The steps to see it happen, as exactly as you can.
- What someone could do with it.
- How to reach you, if it isn’t the address you write from.
Ground rules
- Use your own account. Don’t open, change or keep anyone else’s notes or data.
- Don’t disrupt the service for other people, or flood it with requests.
- Give us time to fix it before you tell anyone else.
The waitlist
Note it now.
Zimoma is in beta on iPhone and on its way to the App Store. Leave your email and we’ll write when there’s a place for you.