Privacy Policy

1. Introduction

Zuko provides tools for structured co-parenting communication, scheduling, parenting time, requests, child profiles, protected medical information, expenses, documents, accountability records, reports, and related coordination. This Privacy Policy explains how Zuko collects, uses, shares, protects, and retains information when you use the Zuko mobile application, website, account portal, campaign pages, or related services.

2. Scope of This Policy

This Policy applies to information processed by Zuko through its mobile applications, websites, APIs, administrative systems, support processes, partner campaigns, and related services. Additional notices may apply to a particular campaign, feature, or service and will supplement this Policy.

3. Account and Profile Information We Collect

Zuko collects information needed to create and operate an account. This may include:

• Name, email address, phone number, language, timezone, and authentication information.
• Contact, communication, notification, and optional marketing preferences.
• Co-parent connections, invitations, workspace memberships, roles, and access levels.
• Subscription, entitlement, purchase, invoice, and transaction information.
• Support requests, account-closure requests, legal acknowledgements, and account activity.
• Physical addresses or other profile information that you choose to provide.

4. Child Profile Information

Authorized adult users may create child profiles and enter information needed to coordinate care between households. This may include:

• The child’s name and date of birth.
• School name, grade, and related educational information.
• Shirt, bottom, and shoe sizes.
• Shoe sizing system and sizing category.
• Events, schedules, requests, expenses, documents, and records linked to the child.
• Other practical information an authorized adult chooses to add for co-parenting coordination.

Zuko may generate or display approximate size conversions for convenience. Conversions can vary between brands, regions, ages, and sizing systems.

5. Protected Medical and Health Information

Eligible co-parents may choose to store structured medical and health information about a child. This may include:

• Blood type.
• Allergy, medical-condition, and medication status.
• Names and descriptions of allergies, diagnoses, conditions, and medications.
• Dosage, frequency, start dates, end dates, and care notes.
• Height, weight, measurement dates, units, and related notes.
• Medical documents and photographs.
• Information linked to medical appointments, events, requests, or other records.

This information is optional and is entered by authorized adults. Zuko does not obtain medical information directly from healthcare providers unless an authorized user uploads or enters it.

6. Authority to Provide Child Information

Zuko is intended for adults. By adding information about a child, a user represents that they are authorized to provide and use that information for legitimate parenting or caregiving purposes. Users should not enter information they are not authorized to possess, store, or share. Zuko does not determine legal custody, guardianship, parental responsibility, access rights, or medical decision-making authority. Product permissions are technical access controls and are not legal determinations.

7. User Content and Sensitive Information

Co-parenting records can be sensitive. Information users create or upload may include private communications, schedules, locations, financial information, medical information, photographs, documents, notes, parenting records, legal-related information, and other family information. Zuko processes this content to provide requested features, synchronize authorized records, preserve shared-workspace integrity, provide support, protect users and the service, and meet applicable legal obligations.

8. Mobile Application Permissions

Depending on the features a user enables, Zuko may request access to notifications, the camera, photographs, files, storage, biometric or device authentication, and other device capabilities required for the selected feature. Permissions can generally be managed through device settings. Zuko receives the result of biometric or device authentication but does not receive or store the user’s biometric template, facial image, or fingerprint data.

9. Technical Diagnostics and Problem Reports

Zuko may collect first-party technical diagnostics when the application encounters startup, hydration, synchronization, recovery, document-upload, or other operational problems. Users may also choose to submit a problem report and provide optional troubleshooting context. Diagnostic information may include:

• A technical issue identifier, which is not a biometric fingerprint.
• Diagnostic category and error code.
• Date and time of the occurrence.
• Number of repeated occurrences.
• Application version and build number.
• Device platform.
• Sanitized technical state and failure details.
• Optional troubleshooting text supplied by the user.

Diagnostic reports are associated with the authenticated Zuko account so authorized support personnel can identify affected users and investigate recurring problems. Zuko’s diagnostic process is designed to exclude or redact passwords, authentication tokens, authorization information, cookies, credentials, message bodies, document contents, and other identified sensitive fields. Users should not include passwords, payment credentials, or unnecessary personal information in optional troubleshooting text. Diagnostics are used for application functionality, customer support, service reliability, security, incident investigation, and product improvement. They are not used for advertising or cross-company behavioural tracking.

10. How Information Is Used

Zuko may use information to:

• Create, authenticate, secure, and manage accounts.
• Establish and manage authorized co-parent connections and workspaces.
• Provide child profiles and protected medical-information features.
• Synchronize records between authorized devices and users.
• Operate messaging, requests, schedules, expenses, documents, reports, and accountability workflows.
• Process subscriptions and maintain entitlements.
• Deliver service notifications and communications.
• Provide customer support and investigate technical problems.
• Detect blocked startup, failed synchronization, hydration, recovery, or other operational conditions.
• Prevent misuse, fraud, unauthorized access, and threats to platform security.
• Review safety reports and enforce the Terms of Use.
• Maintain auditability, shared-record integrity, and service continuity.
• Comply with applicable legal obligations.
• Improve service reliability, accessibility, and user experience.

11. Workspaces and Shared Records

Zuko uses authenticated accounts, workspace memberships, co-parent relationships, child links, roles, and access controls to determine who may access information. Information designated as shared may be visible to the authorized co-parent or other authorized workspace participants. Information designated as private or creator-scoped is not made available to the co-parent unless the applicable feature explicitly provides otherwise. Users should review the sharing scope of information before submitting it.

12. Child and Medical Access Controls

General child-profile information may be available to authorized participants connected to the child through an active workspace. Editing permissions depend on the user’s relationship and access level. Protected medical information is restricted to eligible connected co-parents under Zuko’s child privacy controls. Opening the protected medical area may require device biometric authentication, PIN, passcode, or another supported device-security method. Medical documents added through the protected medical area inherit the applicable child-protection scope. After a document is downloaded or shared outside Zuko, the recipient and the device or service receiving it control that external copy.

13. Local Storage and Offline Access

The mobile application may maintain an authorized local copy of previously synchronized information so that users can review supported information when a network connection is unavailable and safely synchronize pending changes later. Users are responsible for securing their devices with an appropriate passcode, biometric protection, operating-system updates, and Zuko’s available application-lock settings. Signing out, reinstalling the application, clearing application data, or losing a device may affect locally stored information and pending unsynchronized changes.

14. Administrative and Support Access

Authorized Zuko administrators may access limited information where required for support, billing, safety, security, campaign administration, legal compliance, or platform operations. Depending on assigned role and purpose, authorized administrators may be able to view limited account information, subscription activity, device registrations, workspace membership, connected-adult information, child names, diagnostic summaries, or safety records. Access is controlled through role-based permissions and administrative scopes. Sensitive workspace and diagnostic detail access is restricted, and Zuko maintains audit controls for designated administrative activities. Administrators must not access user information outside their assigned responsibilities. Routine diagnostic and user-support views do not provide unrestricted access to message bodies, documents, or protected medical contents.

15. Storage and Security

Zuko uses secure infrastructure, encrypted communications, authentication controls, access restrictions, monitoring, audit mechanisms, and other technical and organizational safeguards intended to reduce unauthorized access, disclosure, alteration, or loss. No method of storage or transmission can guarantee absolute security. Users should protect their credentials, devices, authenticated sessions, downloaded files, and information shared outside Zuko.

16. Infrastructure and Service Providers

Zuko uses service providers to operate parts of the service, including hosting, database services, protected document storage, payment processing, email delivery, analytics, artificial-intelligence processing, and push notifications. These providers may include Apple, Google, Firebase, Postmark, Cloudflare, OpenRouter and selected AI model providers, PayPal, WiPay, hosting and database providers, and other vendors required to operate Zuko. Providers process information only as necessary to deliver their services to Zuko and are subject to their applicable terms, privacy commitments, and security controls.

17. Data Sharing

Zuko does not sell personal information, child information, medical information, messages, schedules, documents, expenses, or user-generated content. Information may be shared:

• With an authorized co-parent or workspace participant according to the applicable feature and access controls.
• With service providers required to operate Zuko.
• At the user’s direction.
• To comply with applicable legal obligations or lawful requests.
• To protect users, children, Zuko, or others from harm, fraud, misuse, or security threats.
• As part of a business reorganization, acquisition, financing, or transfer, subject to appropriate confidentiality and legal safeguards.

18. Legal Requests and Compliance

Information may be preserved or disclosed where required by applicable law, court order, subpoena, regulatory requirement, or legal process. Zuko may also preserve or disclose information where reasonably necessary to protect legal rights, investigate fraud or misuse, respond to safety concerns, protect platform operations, or prevent harm. Zuko evaluates requests according to applicable law and the information reasonably available.

19. Analytics and Technical Information

The mobile application uses Google Firebase Analytics to understand general application usage and feature engagement. Firebase Analytics may process a pseudonymous application-installation identifier, automatically collected application and device details, application opens, screen views, feature events, session activity, and an approximate geographic area derived from network information such as an IP address. Zuko does not send authenticated Zuko account identifiers, names, email addresses, phone numbers, message text, document contents, child information, workspace identifiers, record identifiers, access codes, or authentication tokens to Firebase Analytics. Zuko does not associate Firebase Analytics events with a user’s Zuko account. First-party account-linked diagnostics are separate from Firebase Analytics and are handled as described in the Technical Diagnostics and Problem Reports section.

20. AI-Assisted Message Review

If a user enables AI-assisted message review, the text of an outgoing message draft is sent through Zuko’s authenticated API to OpenRouter and a selected AI model provider to produce tone guidance or a suggested rewrite. Zuko requires zero-data-retention routing for these requests and does not send the draft to Firebase Analytics. Zuko records limited operational metadata such as the account and workspace involved, provider, model, character counts, risk level, success or failure, and related audit information, but does not store the message draft in its AI usage log. AI guidance is optional, may be incomplete or inaccurate, and never sends a message on the user’s behalf.

21. Push Notifications

If push notifications are enabled, Zuko uses Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service. Zuko stores a registration token associated with the authenticated account and device platform so notifications can be routed to the correct device. Registration tokens are security-sensitive and are not used for advertising. Notification content may appear on a locked screen depending on device settings. Users can manage notification permissions and previews through Zuko and applicable device settings.

22. Website Cookies, Analytics, and Authentication

Zuko uses essential cookies and similar technologies for website and portal authentication, session management, routing, account security, and fraud prevention. Secure HTTP-only cookies may be used to maintain authenticated sessions. With the visitor’s consent, the public website may use Google Analytics or related tag-management services to understand page visits, traffic patterns, device or browser type, and performance trends. Visitors may accept or decline optional analytics cookies through the website cookie notice. Blocking essential cookies may prevent account and portal features from functioning. Zuko does not use advertising cookies or cross-company behavioural tracking cookies.

23. Service and Marketing Communications

Zuko may send verification messages, security alerts, co-parent invitations, request notifications, billing information, safety communications, account-closure messages, diagnostic-support communications, and other service messages necessary to operate the platform. Zuko records delivery, bounce, and spam-complaint events for eligible operational email. Sensitive operational emails may be excluded from open and click tracking. Zuko may send product updates, helpful resources, or offers by email only where the recipient has opted in or another lawful basis applies. Optional marketing consent can be withdrawn through available application or account-portal settings. Withdrawal does not stop required account, security, billing, safety, or service communications.

24. Subscriptions, Billing, and Payments

Zuko processes subscription and transaction information needed to provide paid plans, confirm purchases, maintain entitlements, investigate payment failures, process partner benefits, and support billing questions. Purchases made through Apple, Google, PayPal, WiPay, or another payment provider are also processed under that provider’s terms and privacy practices. Zuko may receive transaction identifiers, product identifiers, purchase status, subscription status, currency, amount, purchase dates, renewal information, cancellation information, and refund or revocation status. Zuko does not use payment information for advertising.

25. Safety Reports and Blocking

Zuko allows users to report received messages and block direct messaging. When a report is submitted, Zuko may process the report category, optional details, reported message and conversation references, reporter and reported-account references, timestamps, and review or resolution information. Safety information is used to investigate concerns, prevent misuse, protect users, enforce the Terms of Use, and maintain platform integrity. Safety reports may be retained where reasonably necessary for safety, legal compliance, dispute resolution, fraud prevention, and security. Safety reporting is not a replacement for contacting emergency services or appropriate local authorities where there is an immediate risk of harm.

26. Partner Campaigns and Trial Programs

Zuko may operate partner campaigns, promotional trials, and feedback programs. These programs may process eligibility information, names, email addresses, invitations, account links, enrollment status, benefit status, feedback, testimonials, optional name attribution, and email delivery or engagement information. When a participant submits testimonial text, the applicable campaign form explains how it may be used. Permission to publish the participant’s name is collected separately. Without name-publication permission, an approved testimonial must be used anonymously. Campaign-specific terms and privacy notices may supplement this Policy.

27. Data Retention

Zuko retains information only for as long as reasonably necessary for the purposes described in this Policy, including service operation, synchronization, shared-record continuity, support, diagnostics, audit history, document and report access records, subscription management, fraud prevention, backups, dispute resolution, safety, legal compliance, and platform security. Retention periods vary according to the type of information and its purpose:

• Account and profile information is retained while the account is active and during the account-closure process.
• Shared workspace, child, medical, messaging, scheduling, expense, document, and audit records may be retained to preserve authorized shared-record continuity.
• Billing and transaction information may be retained for financial, tax, fraud-prevention, dispute, and legal purposes.
• Safety reports may be retained for safety, enforcement, legal, and security purposes.
• Technical diagnostics and optional troubleshooting context are retained only as long as reasonably necessary to investigate reliability, support, security, and recurring technical problems.
• Email delivery and campaign engagement information is retained for a limited operational period and may then be deleted or anonymized.
• Information subject to a legal hold, active dispute, safety investigation, or security incident may be retained for longer where reasonably necessary.

Zuko may delete, aggregate, or anonymize information when identifiable information is no longer required.

28. Shared Records and Account Closure

A user may request account closure through available account settings. A 10-day cancellation period begins when the request is submitted. The user may sign in and cancel the request during that period. After the cancellation period ends, Zuko may delete or anonymize personal profile and authentication information and revoke access. Closing a Zuko account does not automatically cancel a subscription managed by Apple, Google, or another payment provider. The user remains responsible for cancelling that subscription through the applicable provider. Shared workspace records—including child profiles, medical information, messages, documents, requests, events, expenses, parenting-time information, and audit history—may remain available to other authorized participants where necessary to preserve shared-record integrity and continuity. Billing, legal-acceptance, safety, security, audit, fraud-prevention, backup, and legally required records may also be retained for the purposes described in this Policy.

29. International Processing

Zuko and its service providers may store or process information outside Trinidad and Tobago or outside the user’s country of residence. Where required, Zuko uses contractual, technical, and organizational safeguards appropriate to the information and transfer. Service-provider locations and processing arrangements may change as Zuko’s infrastructure evolves.

30. Children’s Information and Adult-Directed Service

Zuko is intended for use by adults and is not directed to children. Children should not create Zuko accounts or submit information directly to Zuko. Child-related information is entered and managed by adult account holders for parenting, caregiving, scheduling, documentation, and record-management purposes. Adults must use appropriate judgment when deciding what child information to enter and should avoid adding information that is unnecessary for legitimate co-parenting purposes.

31. Rights and Choices

Subject to applicable law, users may:

• Access or correct eligible account and profile information.
• Update child information where their access level permits.
• Manage notification permissions.
• Manage optional marketing-email preferences.
• Request information about Zuko’s handling of personal information.
• Request account closure.
• Ask for correction or deletion of eligible personal information.
• Raise a concern about unauthorized access or processing.

Some shared, medical, billing, legal, safety, security, audit, or transaction records may not be immediately deletable where retention is reasonably necessary or legally required. Requests may require identity verification before Zuko releases, changes, or deletes information.

32. Changes to This Policy

Zuko may update this Privacy Policy to reflect changes in features, data practices, service providers, security controls, or legal requirements. When a material revision is published, Zuko will update the version and effective date and may provide notice or require users to acknowledge the revised Policy.

33. Contact

Questions, privacy requests, or concerns regarding this Policy may be sent to [email protected]. Safety concerns, reports of harassment or threats, and concerns about abusive use of the service may be sent to [email protected]. Billing questions may be sent to [email protected]. Please do not send passwords, full payment-card information, authentication codes, or unnecessary sensitive information by email.