This Privacy Policy describes how Lazy Leaf LLC (“Company,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use Zchedule (the “Service”). It applies to all of the ways you interact with Zchedule, including our iOS app, our website and marketing pages at zchedule.app, and the account, scheduling, and billing features available through them.

This is a single, unified policy that covers both our mobile app and our web experience. Where a practice applies only to one surface (for example, App Store purchases on iOS or advertising cookies on the web), we say so.

By using the Service, you consent to the practices described in this Privacy Policy.

We collect the following categories of information:

• Account information: name (if provided), email address, team/organization membership, and role.
• Service data: schedules, shifts, assignments, swap requests, and related activity within your teams.
• Device and usage data: IP address, device type, operating system, app version, and basic usage logs.
• Notifications data: push notification tokens used to deliver alerts to your device.
• Payments: on iOS, purchases are processed by the Apple App Store and our subscription providers (such as RevenueCat). On the web, subscriptions are processed by Stripe. In all cases, payment card details are handled by these processors — we do not store full payment card numbers.
• Advertising & measurement data (web): when you visit our website, we and our advertising partner (Meta) collect cookies and identifiers — such as Meta’s _fbp and _fbc cookies — and event data about actions like viewing a page, starting a trial, or beginning checkout. See Section 4 for full detail.

We use information to:

• Provide, maintain, and improve the Service;
• Authenticate users and secure accounts;
• Deliver notifications you request or enable;
• Process subscriptions and verify entitlements;
• Provide customer support;
• Send account, verification, and notification emails (delivered through our email provider, Resend);
• Measure and improve our advertising and understand how visitors find and sign up for Zchedule, including sharing certain web activity with Meta as described in Sections 4 and 5;
• Detect, prevent, and address fraud or misuse;
• Comply with legal obligations.

We do not sell your personal information for money. We do, however, share limited web activity with Meta for advertising measurement and matching, which California law treats as “sharing.” See Sections 4, 5, and 9 for details and your opt-out choices.

On our website at zchedule.app we use cookies and similar technologies for essential functionality (such as keeping you signed in) and for advertising measurement. Our mobile app does not use the advertising cookies described below. You can control cookies through your browser settings; blocking some cookies may affect how parts of the website work.

Meta Pixel (client-side). Our website loads the Meta (Facebook) Pixel, ID914329748387383. As you use the site, the Pixel sends event data to Meta from your browser. The events we currently fire are:

• PageView — on page loads and route changes;
• ViewedPlan (a custom event) — when you view plan details, including the general business type you selected;
• StartTrial — when you begin a trial;
• CompleteRegistration — when you finish creating an account;
• InitiateCheckout — when you begin checkout, including the plan and billing interval selected;
• Subscribe — when you start a paid subscription.

The Meta Pixel also reads Meta’s _fbp and _fbc cookies so that Meta can attribute these actions to its advertising.

Meta Conversions API (server-side). In addition to the browser Pixel, our servers send a matching, server-to-server copy of the CompleteRegistration, StartTrial, and InitiateCheckout events to Meta so the signal is still received if the browser Pixel is blocked or fails. Each server event is paired with its browser event using a shared event ID so Meta counts it once, not twice. For these server-side events we send:

• your email address, hashed (SHA-256) before it leaves our server;
• your first name, hashed (SHA-256) before it leaves our server;
• your Zchedule account identifier (Firebase user ID) as an external ID;
• your IP address and browser user-agent;
• the values of Meta’s _fbc and _fbp cookies;
• non-identifying event context, such as the plan and billing interval you selected.

We use this information solely for advertising attribution and matching — measuring the performance of our ads and reaching people with similar interests. We do not use it for any other purpose, and we deliberately do not send Meta your phone number, date of birth, gender, or postal address through the Conversions API. Once received, this data is handled by Meta under its own data and privacy policies, which we do not control.

We may share information with:

• Service providers who help us operate the Service — for example, Google Firebase for authentication and database hosting, and Resend to deliver account, verification, and notification emails (your email address and message content pass through Resend for delivery).
• Payment and subscription processors — Apple App Store and RevenueCat for purchases made in our iOS app, and Stripe for subscriptions purchased on the web — to process payments and manage subscription status.
• Our advertising partner (Meta) — as described in Section 4, we share certain website activity and identifiers with Meta through the Meta Pixel and Conversions API for advertising measurement and matching. Under the California Consumer Privacy Act, as amended by the CPRA, this may be considered “sharing” of personal information for cross-context behavioral advertising.
• Legal and safety disclosures if required by law or to protect rights, safety, and security.

We do not sell your personal information in exchange for money. Aside from the advertising sharing with Meta described above, we do not share your personal information with third-party advertisers. You can limit the Meta advertising sharing as described in Section 9.

We retain personal information for as long as necessary to provide the Service and for legitimate business purposes, such as compliance, security, and dispute resolution.

If you request deletion, we will delete or de-identify personal information within a reasonable timeframe, subject to legal and operational requirements.

Advertising event data shared with Meta through the Meta Pixel and Conversions API (Section 4) is retained by Meta according to Meta’s own data retention policies, which we do not control.

We use reasonable administrative, technical, and physical safeguards designed to protect your information. However, no method of transmission or storage is 100% secure.

If you are a California resident, you may have rights to request:

• Access to your personal information;
• Correction of inaccurate personal information;
• Deletion of personal information;
• Information about categories of personal information collected and disclosed;
• To opt out of the “sharing” of your personal information for cross-context behavioral advertising (see Section 9).

To submit a request, contact us at support@zchedule.app. We may need to verify your identity before fulfilling your request. We do not discriminate against users who exercise privacy rights.

Sale/Sharing: We do not sell personal information for money as defined by California law. We do “share” certain website activity with Meta for cross-context behavioral advertising, as described in Sections 4 and 5. You can opt out of this sharing — see Section 9.

We do not sell your personal information in exchange for money. However, our use of the Meta Pixel and Meta Conversions API on our website (Section 4) may be considered “sharing” of personal information for cross-context behavioral advertising under California law. You have the right to opt out of this sharing, and we will not discriminate against you for doing so.

You can opt out in any of these ways:

• Email us: send a request to support@zchedule.app with the subject “Do Not Share My Personal Information.” This uses the same request process described in Section 8, and we will apply your opt-out to the advertising sharing described above.
• Control cookies in your browser: block or clear cookies for zchedule.app, which prevents the Meta Pixel and its _fbp/_fbc cookies from operating.
• Adjust your Meta ad settings: you can manage ad personalization directly in your Facebook and Instagram account settings.

Because advertising cookies apply only to our website, this section does not affect our mobile app, which does not use them.

The Service is not intended for individuals under 18. We do not knowingly collect personal information from minors.

The Service is operated from the United States. If you access the Service from outside the United States, you understand that your information may be transferred to and stored in the United States.

We may update this Privacy Policy from time to time. If changes are material, we will provide notice as required by law. Continued use of the Service after changes become effective means you accept the updated Policy.

Lazy Leaf LLC
Support: support@zchedule.app