Privacy Policy

Last updated: 28 July 2026.

Datacea builds Zicarium, a personal data capture tool. This policy explains what we collect, why, where it is kept, and what you can ask us to do with it.

The short version: your records belong to you. We do not sell them, we do not use them for advertising, and we do not use them to train machine learning models.

Most content processing described here applies only if you create an account or choose a network feature. Zicarium’s local-only mode does not sync your content to a Datacea account. Our websites, download services, and any network feature you choose can still receive the technical or feature-specific information described below.

Who we are

DATACEA LLC, based in Cleveland, Ohio, United States, is the data controller for the processing described here.

Contact us about anything in this policy at contact@datacea.com.

If you use Zicarium without an account

Zicarium does not sync your content to a Datacea account in local-only mode. Content you keep entirely in local-only features ordinarily remains on that device. Requests to our websites, download servers, and other Datacea network features still produce technical records. If you choose a feature that retrieves information from a network service, processes data on a server, or sends content to an assistant, the information needed for that request is transmitted as described in this policy and in the feature.

What we collect if you do create an account

Account information. When you create an account we store an email address and, if you sign in with Google, the name and profile picture Google returns. We use this to identify your account and to contact you about the service. Sign-in is handled by our own identity service at auth.datacea.com.

The content you create. Notes, tasks, and every other item you record in Zicarium, along with any files and images you attach. We store this so we can sync it between your devices. We do not routinely read it. We access or process it only as needed to provide a feature you request, to investigate a fault you report, to secure the service or enforce our Terms, or to comply with law and valid legal process.

Technical records. Server logs containing IP addresses, timestamps, and request paths. These are produced by any request to our servers, including simply loading the application without signing in. We keep them only while they are useful for security and debugging, and we do not commit to holding them for any particular length of time.

Analytics and similar technologies. We may use analytics, cookies, local storage, and similar technologies in our websites and applications to operate the Services, remember settings, authenticate users, prevent abuse, understand visits and feature usage, diagnose performance, and improve what we build.

These technologies may process technical and usage information such as IP address, device and browser information, identifiers, pages or features used, referring pages, approximate location derived from an IP address, and crash or performance information. We may operate them ourselves or use service providers, and the particular tools may change. Where applicable, we will provide any notice, consent or choice required by law. Blocking these technologies through your browser or device may affect features that depend on them.

Where it is stored

We run our own infrastructure rather than renting managed data services. Your account and your content are stored in databases and object storage on servers we operate, at a hosting provider in the United States. If you are outside the United States, using our applications means your data is processed there.

Signed-in applications generally keep local data so ordinary records can remain usable offline and sync changes when a connection is available. The amount kept on a particular device can vary by application, record or file type, available storage, and settings. Some features and data require a server connection. Deleting an application or its local storage from one device does not by itself delete an account or server-side data.

In local-only mode, no account copy is created. The qualifications above still apply when you choose a network feature.

Third parties who process your data

We keep this list short deliberately. We describe these by category rather than by name, because the specific suppliers can change and this page should stay accurate when they do.

We do not sell your data or share it for advertising. In addition to the categories above, we may disclose information when you direct us to, when required by law or valid legal process, when reasonably necessary to protect a person or the Services or investigate abuse, or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of the business. A successor’s use of personal data remains subject to this policy unless it gives any additional notice or choice required by law. See Acceptable use in our Terms.

Assistant features

Zicarium includes an assistant. When you use it, your message and the content or context included in the request are transmitted to a language model provider so a reply can be generated. Depending on the feature, that context can include items or images you attach, information the application selects to carry out your instruction, and results returned by assistant tools. Do not use an assistant feature with content you do not want processed by the configured provider.

You can use your own provider instead of ours. The application has a setting for supplying your own OpenAI-compatible API key. If you do, requests go to the provider you chose, under whatever agreement you have with it, and its privacy terms apply to its processing. Provider configuration, routing, and available models can change as the feature develops; the application will identify the selected mode or provider in its settings.

Datacea does not use your content to train models. A model provider’s independent handling of a request can depend on the provider and account you select, so review that provider’s terms. If you do not want content sent to a model provider, do not use assistant features with that content.

Image and face grouping

If you attach photographs, Zicarium can detect faces in them and group similar ones, so that photographs of the same person can be found together. This produces mathematical descriptions of faces, used only for your own library. They are not shared with anyone, not matched against any external database, and not used to identify people outside your account.

Where that processing happens depends on the application:

• The desktop and mobile applications can do it entirely on your device. They ship the model needed, so your photographs do not have to be sent anywhere for this.
• The web application does it on our servers. The model is too large to send to a browser, so there is no on-device option there.

Face data is treated as sensitive. Deleting an underlying image is intended to remove the active face-grouping data derived from it, subject to the retention and deletion qualifications below. You can also ask us to delete account-associated face data by writing to us. If you do not want server-side face processing, do not enable or use a server-processed face feature.

How long we keep it

How long we keep information depends on the kind of information, whether your account or the relevant feature remains active, operational and security needs, backup and recovery processes, and legal obligations. Those are our retention criteria; we do not promise a fixed deletion or backup-rotation timetable.

Deleting an item or account is intended to remove it from ordinary active use. Copies or related records may remain where reasonably necessary for backup integrity, fraud or abuse prevention, security, legal compliance, dispute resolution, or enforcement of our agreements. We may also retain information that has been aggregated or de-identified so it is no longer reasonably linked to you. We will complete verified deletion requests as required by applicable law.

Your rights

Depending on where you live, you may have the right to obtain a copy of personal data, correct it, delete it, restrict or object to processing, withdraw consent, or appeal a decision about a request. These rights can have exceptions, and withdrawing consent does not affect processing that was already lawful.

Zicarium’s export function covers most requests immediately. For anything else, write to contact@datacea.com. We may need to verify your identity and authority before acting. We will respond within the time and in the manner required by applicable law, and may decline or limit a request where the law permits.

Security

We use administrative, technical, and physical safeguards designed to protect personal data, including encrypted connections to our public production services and restricted access to production systems. Safeguards reduce risk but cannot guarantee that information will never be lost, altered, accessed, or disclosed. You are responsible for protecting your devices, credentials, and independent backups. If you find a vulnerability, please tell us at contact@datacea.com.

Children

Accounts are for adults who are at least 18 and have reached the age of legal majority where they live. We do not knowingly allow a minor to create or control an account. A parent or legal guardian may supervise a minor’s use of a local-only copy; in that case the records remain on the device and are not collected by us. If you believe a minor has provided us personal data through an account, contact us so we can investigate and delete it as appropriate. Our Terms of Service explain how to report child exploitation, an account controlled by a minor, or another child-safety concern.

Changes

If we change this policy in a way that materially affects you, we will tell account holders by email rather than silently editing this page. The date at the top always reflects the current version.