Privacy Policy

Last updated: June 22, 2026

Data Controller

The data controller for personal data processed through Zucchini is Hayaku Tech Limited, a private company incorporated in the Republic of Cyprus under company number HE 400807, with its registered office at Griva Digeni 78, 2nd floor, Office B1, 3101 Limassol, Cyprus. You can contact us about any privacy matter at [email protected].

Overview

Zucchini is a messenger app for chatting with Claude Code agents. Your privacy matters — we collect as little data as possible and never sell your information.

What We Collect

• Account credentials — login and password, used solely for authentication with our messaging backend.
• Chat messages — messages you send and responses from Claude Code agents, stored on our server to provide the chat functionality.
• Project metadata — names of project folders on your machine, used to organize chats by project.

What We Don't Collect

• We do not collect analytics, telemetry, or usage tracking data.
• We do not read or access your files beyond what Claude Code does in response to your messages.
• We do not use cookies or third-party trackers.

How Your Data Is Stored

Messages and account data are stored on our server infrastructure. The spawner component runs entirely on your local machine — your code and files stay on your device.

Message bodies, chat titles, drafts, and attachment blobs are end-to-end encrypted on your device before they reach our servers using XChaCha20-Poly1305 (IETF variant) authenticated encryption with a per-account symmetric key (K_user) that never leaves your devices. Our servers see ciphertext only and cannot read the contents of your messages, your chat titles, your drafts, or your attachments. Routing metadata that we cannot encrypt without breaking the service — account identifiers, machine and project names, project paths, message timestamps, and ordering — is stored in plaintext.

Data Retention

We keep your personal data only for as long as we need it to provide the service or to meet legal obligations:

• Account data and chats are retained for as long as your account is active.
• Account deletion: when you delete your account from the app, your account record and all associated rows (including encrypted message ciphertext, chats, machines, projects, and your subscription status) are permanently deleted from our database immediately and cannot be recovered.
• Individual chat deletion: when you delete a single chat, its encrypted message ciphertext and metadata rows are permanently deleted from our database immediately.
• Billing and payments are handled entirely by the Apple App Store and Google Play. We never receive or store your payment details, and any tax or transaction records are retained by Apple and Google under their own policies, not by us.

Your Rights

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that grants similar rights (including California under the CCPA/CPRA), you have the following rights with respect to your personal data:

• Right of access (Art. 15 GDPR) — obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification (Art. 16 GDPR) — have inaccurate personal data corrected and incomplete data completed.
• Right to erasure / deletion (Art. 17 GDPR) — have your personal data deleted, subject to legal retention obligations.
• Right to restriction of processing (Art. 18 GDPR) — ask us to limit how we process your data in specific circumstances.
• Right to data portability (Art. 20 GDPR) — receive your personal data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21 GDPR) — object to processing carried out on the basis of our legitimate interests.
• Right to withdraw consent at any time, where processing is based on your consent, without affecting the lawfulness of processing before withdrawal.
• Right to lodge a complaint with a supervisory authority. In Cyprus, the supervisory authority is the Office of the Commissioner for Personal Data Protection.

To exercise any of these rights, email us at [email protected]. We will respond within one month, in accordance with Article 12(3) GDPR.

Subscription Data

If you purchase a Zucchini Pro subscription, payment is processed entirely by Apple. We never see or store your credit card number, billing address, country, Apple ID, or password.

After a successful purchase, Apple sends our server a signed payload (a JSON Web Signature) that contains your subscription's original transaction id, the app bundle id, and the expiration timestamp. The only subscription data we store on our servers is:

• Your Pro entitlement expiry timestamp, so every device signed into your account knows whether Pro features are active.
• Apple's original transaction id for your subscription, used to dedupe renewal notifications and prevent the same purchase from being claimed by multiple accounts.

We do not receive or store any other information about your purchase, your Apple ID, or your payment method. Refunds, family sharing, and subscription management are handled entirely by Apple under Apple's privacy policy.

Third Parties

Chat messages are processed by Anthropic's Claude Code on your own machine to generate responses. Sign-in is handled by Stytch and, if you choose them, Apple and Google. Push notifications are delivered by Apple. Attachments are stored on Cloudflare R2. Subscriptions are processed by Apple. Each provider handles your data under their own privacy policy.

Deleting your account

You can delete your Zucchini account and all associated data directly from the app — no need to contact us. Zucchini is published by Hayaku Tech Limited.

To delete your account:

1. Open the Zucchini app and go to the Settings tab.
2. Scroll to the bottom and tap Delete account.
3. Confirm in the Delete account? dialog.

This permanently deletes your account, uninstalls the spawner from every paired machine, and erases all of your chats, messages, projects and machines. It cannot be undone.

What is deleted: your account record and all associated data — encrypted message ciphertext, chats, machines, projects, and your subscription status — are permanently deleted from our database immediately and cannot be recovered.

Payments: we never receive or store your payment details. Billing is handled entirely by the Apple App Store and Google Play, and any tax or transaction records are retained by them under their own policies, not by us.

If you cannot access the app, you can also request deletion by emailing [email protected].

Contact

For questions about this policy, reach out at [email protected].