Privacy Policy

The short version

We do not sell your personal information, and we do not share it with advertisers.
Your email address is encrypted before it is stored. We cannot read it by browsing the database.
Our product analytics are anonymous by design. They are not tied to your account, and we built them that way on purpose.
You can delete your account from Settings at any time, and the deletion is immediate.
You must be 21 or older to use Zimi.

Who we are

Zimi is a cocktail discovery app operated from the United States. When this policy says "we", "us", or "Zimi", it means the team that operates the Zimi app and website. If you want to reach a person about anything in this document, email support@zimitaste.app.

What we collect

Information you give us when you create an account and use the app:

Your email address, which we use to sign you in and to contact you about your account.
Your username, and optionally a tagline and an avatar. These are visible to other people on Zimi.
Your ratings, reviews, review photos, check-ins, lists, and the drinks you save. Reviews and photos you post are visible to other people, subject to your privacy settings.
Your taste preferences: the flavors you rate, the spirits you tell us to avoid, whether you drink alcohol, and the results of the taste quiz.
Anything you write to us in a support ticket or a feedback message, including the email address you give us so we can reply.

Information we collect automatically when you use the app:

Your approximate location, but only while you are searching for drinks or venues near you, and only if you grant location permission. We use it to sort results by distance. We do not keep a history of where you have been.
Basic device and app information such as your platform, app version, and operating system version. When you file a support ticket we attach this so we can reproduce the problem.
Anonymous product analytics describing which screens and features get used. These events carry no account identifier. See the analytics section below.
Standard server logs, including IP address, which we use to keep the service running and to enforce rate limits against abuse.

How we use it

To run the app: signing you in, showing your profile, saving your ratings, and keeping your data in sync across devices.
To recommend drinks. Your ratings and taste profile drive your match scores, your recommendations, and your Taste Twins.
To answer you when you contact support, and to investigate bugs you report.
To keep Zimi safe: reviewing reported content, enforcing our Terms, blocking abuse, and rate-limiting automated traffic.
To understand which features work and where the app confuses people, using the anonymous analytics described below.
To send you notifications you have turned on. You control these in Settings, and you can turn any of them off.

We do not use your personal information to build advertising profiles, and we do not run third-party ad trackers in the app.

Our analytics are anonymous

We made a deliberate decision about product analytics, and it is worth spelling out because most apps do the opposite.

Analytics events never carry your user id. There is no column to put it in.
On our website, events are grouped under a random identifier stored in your browser. It is not your account, it carries no name or email address, and clearing your browser data resets it. Our analytics provider is never told who you are: we do not call the function that would attach your account to its records, and person profiles stay off entirely.
We also keep our own separate count of website page views. Those are grouped by a rotating hash rather than a stable identifier, and a result is only reported when at least 50 people fall into a group.
In the mobile app, events are grouped under a random identifier created on your device. Our analytics provider is never told who you are: we do not call the function that would attach your account to its records, and person profiles stay off entirely.

We used to record anonymous, masked session replays in the mobile app. We turned that off in August 2026, and we no longer record replays on either the website or the app.

The practical consequence is that we can see how the app gets used, and we cannot connect any of it to your account. We are not able to retarget you individually, and we are not set up to sell behavioral data.

How we protect it

Your email address, bio, tagline, and business details are encrypted at rest using AES-256-GCM. The encryption keys live outside the database, so a copy of the database alone does not reveal them.
Email lookups run against a keyed one-way index rather than the plaintext address, which lets us find your account at sign-in without storing a readable email column.
Passwords are handled by our authentication provider. We never see or store your password.
Traffic between your device and Zimi is encrypted in transit with TLS.
Access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If we ever discover a breach affecting your personal information, we will notify you as required by applicable law.

If you believe you have found a security vulnerability in Zimi, email security@zimitaste.app. Please tell us what you found and how to reproduce it, and give us a reasonable chance to fix it before sharing it publicly. We will not pursue legal action against anyone who reports a problem in good faith and does not access, change, or delete other people's data while investigating.

Who we share it with

We do not sell your personal information. We share it only in these cases:

With other Zimi users, but only the things you chose to make visible: your username, avatar, tagline, and the reviews, photos, and activity your privacy settings allow. Your Taste Twin list is visible only to your friends, and Settings lets you hide your activity and limit Taste Twin matching to your friends.
With service providers who run parts of the product for us, such as hosting, database storage, authentication, and anonymous analytics. They are bound by contract to use your information only to provide that service to us, and never for their own purposes. We can tell you who they are if you ask.
When the law requires it, such as a valid subpoena or court order, or when it is necessary to protect the rights and safety of our users.
If Zimi is ever acquired or merged, your information may transfer as part of that transaction. We will tell you before your information becomes subject to a different privacy policy.

Your choices

Edit or delete your content. You can edit your profile and remove your reviews, photos, and lists at any time.
Delete your account. Settings has a Delete Account option. It removes your profile, ratings, reviews, photos, check-ins, lists, and taste data, and it removes your sign-in credentials so the account cannot be used again. This is immediate and cannot be undone.
Control your visibility. Settings lets you hide your activity from your profile and limit Taste Twin matching to your friends, so you never appear as a stranger’s Taste Twin.
Control notifications. Every notification category has its own switch in Settings, and you can turn all of them off.
Control location. Location is requested only for nearby search, and you can deny or revoke it in your device settings. The rest of the app works without it.
Ask us a question. Email support@zimitaste.app or use the support form in the app, and a person will read it.

How long we keep it

We keep your account information for as long as your account exists. When you delete your account, your personal data is deleted with it. Two things intentionally outlive the account: drinks and venues you contributed stay in the shared catalog with your name removed, because other people’s ratings depend on them, and support tickets you filed are kept so we have a record of issues we were asked to fix. Anonymous analytics events are not linked to your account and are unaffected by deletion, because there is no identifier in them to delete.

Age requirement

Zimi is about alcoholic drinks and is intended only for people who are 21 or older. We ask you to confirm your age before you use the app. We do not knowingly collect information from anyone under 21. If you believe someone under 21 has created an account, email support@zimitaste.app and we will remove it.

Where we operate

Zimi is offered in the United States and our systems are hosted there. We do not currently offer Zimi in the European Economic Area or the United Kingdom, and this policy does not describe rights under the GDPR. If you are in the United States, your state may give you specific privacy rights, including the right to know what we have collected and the right to have it deleted. The Settings options above cover both, and you can always reach us at support@zimitaste.app.

Changes to this policy

We will update this policy when the product changes. When we make a change that materially affects how we handle your information, we will update the effective date at the top and notify you in the app before the change takes effect.

August 29, 2026: turned off session replay everywhere, and described the random identifier the website now stores in your browser.
August 6, 2026: described the anonymous, masked session replays in the mobile app.
July 30, 2026: first published.

Contact us

Questions, complaints, or requests about your data go to support@zimitaste.app, or through the support form in the app. We aim to respond within a few business days.