This Privacy Policy explains how Zambi — the Android and iOS app and the website www.zambiweb.com — handles the personal data of the people who use it. Zambi brings together the liturgical calendar of the orixás, songs and chants, a library of Afro-Brazilian culture and the community calendar.
We wrote this document in plain language, because privacy only works when it is understandable. By creating an account or using Zambi, you confirm that you have read and understood this Policy. If you do not agree with it, please do not use the service.
01Who is responsible for your data
The controller of the personal data processed by Zambi, under article 5, VI of the LGPD, is the developer responsible for the app. The same contact channel acts as the data protection officer (article 41 of the LGPD).
- Service: Zambi — mobile app and the website www.zambiweb.com
- Controller and data protection officer: the developer responsible for Zambi
- Privacy contact: rickfontes007@gmail.com
- Response time: up to 15 (fifteen) days from the date we receive your request
02What data we collect
We only collect what the app needs in order to work. The table below lists every category of data Zambi processes:
| Category | Data | Source | Why we collect it |
|---|---|---|---|
| Account data | Name or nickname, email address, profile picture and an internal user identifier | Provided by you at sign-up, or received from Google or Apple sign-in | To create and maintain your account, authenticate access and personalize the app |
| Content you upload | Photos and images taken with the camera or picked from your gallery, and text you post | Uploaded by you, inside the app | To display your content in the service — for example, your profile picture |
| Usage data | Screens viewed, interaction events, app instance identifier, device model, operating system version, language and approximate country (derived from the IP address) | Collected automatically by Firebase Analytics | To understand how the app is used, in aggregate, and prioritize improvements |
| Diagnostic data | Error logs, crash reports and the state of the device at the moment of the failure | Collected automatically by Firebase Crashlytics | To find and fix bugs in the app |
| Notification token | A device identifier generated by Firebase Cloud Messaging | Generated when you allow notifications | To send reminders about liturgical calendar dates and app news |
Zambi deals with African-matrix religious tradition. We do not use usage data to infer your religious beliefs, we do not build behavioral profiles, and we never link what you read to any advertising purpose. Usage statistics are analyzed in aggregate only.
The information in this section matches what we declare in the Google Play Data safety form.
03App permissions
Zambi only asks for a permission when you use the feature that needs it, and always through your operating system's own prompt. No permission is mandatory: you may deny all of them and keep using the app — only that specific feature becomes unavailable.
| Permission | What it is for | If you deny it |
|---|---|---|
| Camera | Taking a photo on the spot for your profile or for content you upload | The app keeps working normally; you can pick an existing image or continue with no photo |
| Photos / Gallery | Choosing an image already saved on your device | The app keeps working normally; you can use the camera or continue with no photo |
| Notifications | Reminders about liturgical calendar dates, new songs and app news | The app keeps working, simply without notifications |
| Internet / Network | Loading content, authenticating your account and saving your information | Without a connection the app cannot load new content or sync your account |
The images you choose are uploaded to and stored on our servers for as long as your account exists, and are erased when you delete your account. You can revoke any permission at any time in your system settings — on Android, Settings → Apps → Zambi → Permissions; on iOS, Settings → Zambi.
04Why we use your data, and on what legal basis
Every processing activity at Zambi has a specific purpose and a legal basis set out in article 7 of the LGPD:
| Purpose | Legal basis |
|---|---|
| To create, authenticate and maintain your account | Performance of a contract — art. 7, V |
| To store and display the photos and content you upload | Performance of a contract and consent — art. 7, V and I |
| To send notifications about the calendar and app news | Consent — art. 7, I (granted in your system settings and revocable at any time) |
| To measure app usage in aggregate and fix bugs | Legitimate interest — art. 7, IX, limited to what is strictly necessary and without profiling |
| To prevent fraud and abuse and keep the service secure | Legitimate interest — art. 7, IX |
| To answer your requests and comply with legal orders | Compliance with a legal or regulatory obligation — art. 7, II |
We do not make automated decisions that produce legal effects or otherwise affect your interests (article 20 of the LGPD).
05Who we share data with
We do not sell, rent or trade your personal data with anyone. We do not share data with data brokers or behavioral advertising networks, and the app displays no ads.
We share only what is strictly necessary with the processors that run the service's infrastructure, all of them contractually bound to handle data according to our instructions:
| Partner | Role | Privacy policy |
|---|---|---|
| Supabase | Authentication and database — stores your account and the content you upload | supabase.com/privacy |
| Google Firebase (Analytics, Crashlytics and Cloud Messaging) | Aggregate usage statistics, crash reports and notification delivery | firebase.google.com/support/privacy |
| Google (Sign in with Google) | Authentication — confirms your identity and provides your name, email and picture | policies.google.com/privacy |
| Apple (Sign in with Apple) | Authentication — confirms your identity and lets you hide your real email address | apple.com/legal/privacy |
| Google Play and the App Store | App distribution and aggregate install reporting | play.google.com/about/play-terms |
We may also disclose data in response to a court order or a request from a competent authority, or where necessary to exercise our rights in legal proceedings (article 7, VI of the LGPD). If that happens and the law allows it, we will let you know.
06International data transfers
The infrastructure providers we use (Supabase and Google Firebase) may keep servers outside Brazil, including in the United States and the European Union. This means your data may be transferred to and stored abroad.
These transfers rely on article 33 of the LGPD and are covered by contractual clauses with those providers, under which they commit to a level of data protection compatible with Brazilian law.
07How long we keep your data
- Account data and uploaded content: for as long as your account exists. Deleting your account erases this data.
- Usage and diagnostic data (Firebase): up to 14 months, per the retention window configured in Firebase; after that only aggregate statistics remain, which identify no one.
- Application access logs: 6 months, as required by article 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014).
- Data needed to comply with a legal obligation or to exercise rights in proceedings: for the applicable statutory period.
08How to delete your account and your data
You can delete your account at any time, on your own, without contacting support and without giving a reason. There are two ways to do it:
- In the app: open your account screen and tap Delete my account. You will be asked to confirm before it goes through.
- On the website: go to www.zambiweb.com/conta, sign in and click Delete my account.
Deletion is permanent and immediate. We remove your profile from the server (name, email address and picture), the images and content you uploaded, your notification token and the records tied to your user identifier. The account cannot be recovered afterwards, and we keep no copy of your profile.
Rotating backups are overwritten within 30 days. After that period, the only things that may remain are: (a) aggregate, anonymized statistics that do not identify you and cannot be reversed; and (b) data we are legally required to keep, such as the access logs required by the Brazilian Internet Civil Framework.
Prefer to take care of it right now, in your browser?
Delete my account on the websiteIf you have lost access to your account and cannot sign in, write to rickfontes007@gmail.com from your registered email address. We will confirm ownership and complete the deletion within 15 days.
09Your rights as a data subject
Article 18 of the LGPD gives you the right, at any time and free of charge, to obtain:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- portability of your data to another provider, upon express request;
- deletion of data processed on the basis of your consent;
- information about the entities we share your data with;
- information about your option not to give consent, and the consequences of refusing;
- withdrawal of consent, at any time;
- objection to processing carried out on the basis of legitimate interest.
To exercise any of these rights, write to rickfontes007@gmail.com from the email address registered on your account. We will reply within 15 days. You may also file a complaint with the ANPD — Brazilian National Data Protection Authority (gov.br/anpd).
10How we protect your data
- All traffic between the app, the website and our servers is encrypted with HTTPS/TLS.
- Stored data is encrypted at rest by our infrastructure providers.
- The database uses Row Level Security policies, so each person can only reach their own data.
- Administrative access is restricted to the responsible developer and protected by two-factor authentication.
- We apply data minimization: we do not collect what the service does not need in order to work.
No system is completely immune to incidents. If a security incident occurs that may create relevant risk or harm to you, we will notify you and the ANPD within a reasonable time, as required by article 48 of the LGPD. Keep your password confidential and do not share it with third parties.
11Children and teenagers
Zambi offers cultural and educational content and may be used by families, including children and teenagers accompanied by their guardians.
Under article 14 of the LGPD, children's data is always processed in their best interest and requires specific, prominent consent from at least one parent or legal guardian. If you are responsible for a child who uses Zambi, the account must be created or authorized by you.
Under no circumstances do we display ads, sell data or build behavioral profiles — for any user, and least of all for minors. We never condition participation in any app activity on providing more data than necessary.
If we learn that a child's account was created without a guardian's consent, we will delete the data. Guardians may request access to, correction of or deletion of that data at any time by writing to rickfontes007@gmail.com.
13Changes to this Policy
We may update this Policy to reflect changes in the service or in the law. The version in force is always published on this page, with the update date at the top.
When a change is material — for example, a new category of collected data or a new purpose — we will announce it prominently inside the app or by email before it takes effect. If the new purpose requires consent, we will ask for your consent again.
14Contact
Questions about this Policy, about how your data is used or about exercising your rights: write to rickfontes007@gmail.com. We reply within 15 days.
The same address handles support requests, content reports and security communications.