Privacy policy

October 30, 2026

Zup is an iPhone app that turns photos you choose into captions and share-ready posts. For posts you create yourself, you select photos with Apple’s system photo picker and Zup does not need access to the rest of your library. Venue context is off by default and can be turned on under Your Voice → Personalization. When it is on and a selected photo contains GPS metadata available through that selection, Zup combines Apple’s reverse-geocoding and nearby-place services with a live venue search. To identify a company, office, campus, or other venue that Apple does not list, Zup’s App Attest-protected service may transiently send the exact coordinates, reverse-geocoded address, and country code to Bright Data for a live Google place search. The selected photo and caption are not sent to Bright Data for this lookup. When Venue context is off, Zup does not start venue searches and excludes saved venue labels from caption prompts. Zup does not show a separate location confirmation, and neither Zup nor its database persists the raw coordinates or search response. Only a specifically resolved venue label may be saved with a favorite and supplied to the activated caption provider; a city or region alone is not supplied as caption context when no venue can be verified. The optional Daily suggestions feature is the only part of Zup that requests access to photos you allow so it can find pictures taken today.

Optional post performance dashboard

The post performance dashboard is currently an administrator-only pilot. Zup stores published post text, links, categories and performance counts imported by an administrator or retrieved from a connected account with the required permissions. These records are encrypted at rest and scoped to an app installation. Missing platform permissions may prevent syncing or access to private metrics. Contact support to request removal of stored post analytics. Dashboard records are not used to train models. This dashboard is separate from the aggregate app-usage telemetry described below.

Website redirect measurement

When an iPhone visit to zupapps.com is automatically redirected to the App Store, Zup records a daily aggregate count. A short campaign source, medium, and campaign label from a tagged link may be included; otherwise Zup uses the referring website’s hostname when the browser supplies it. Full referring URLs and their query strings are not retained. This measurement does not set visitor cookies or store IP addresses, raw user-agent strings, device identifiers, or individual browsing histories. It counts redirects rather than unique people or installs. Counts are grouped by Pacific calendar day, kept for a rolling 90-day reporting window, and old totals are removed as new redirects arrive. Access to the report is restricted to Zup’s administrator.

Privacy-friendly app analytics

Zup uses Apple App Store Connect analytics and TelemetryDeck to understand aggregate product use, such as whether onboarding was completed, how many photos were selected, which destination was chosen, whether caption generation or publishing succeeded, and which app version or device type was involved. TelemetryDeck receives a one-way anonymized identifier for this app installation, an event name, a timestamp rounded to the nearest hour, ordinary app and device metadata, and the limited non-content properties needed to group that event. TelemetryDeck does not store IP addresses.

Zup does not send selected photos, captions, photo-edit instructions, names, mentions, email addresses, social-account identifiers, access tokens, or raw error messages to analytics. Analytics data is not used for advertising, is not combined with data from other companies to track you across apps or websites, and is not linked by Zup to your identity. Learn more in TelemetryDeck’s privacy documentation.

On-device processing

Zup performs private photo analysis on-device for features such as Daily suggestions and the optional profile reference. Apple’s on-device Foundation Model remains available for the separately configured Daily suggestion flow, while Generate uses the approved hosted-caption route. Data used only by an on-device model stays on your iPhone.

Optional Daily suggestions

Daily suggestions is off until you choose to set it up. Zup explains the feature before asking for Apple Photos permission, and you may give access to selected photos or your full library using Apple’s system control. When enabled, Zup checks photo creation dates on your iPhone when you open the app, considers only photos available to Zup that were taken today, skips screenshots, and prepares no more than three suggestions with up to four photos each. Zup does not continuously scan your library or run this check in the background.

You review each suggestion before keeping it. Swiping left dismisses only Zup’s suggestion and never deletes, edits, or hides the original photo in Apple Photos. Swiping right saves the proposed post and protected copies of its photos to Zup Favorites on this iPhone. Closing the review without swiping leaves the suggestion available for a later review. Creating or saving a suggestion does not publish it to any social network.

Zup first tries to create Daily suggestion captions on-device. If on-device captioning is unavailable, Zup may use hosted captions automatically only after you separately grant the current automatic hosted-caption permission for Daily suggestions. In current builds, that permission identifies OpenAI, Anthropic, OpenRouter and its model providers, TokenRouter and its model providers, Fireworks AI, and Mistral AI; explains that resized copies of today’s candidate photos and the same caption context described below may be sent automatically when Zup opens; and asks for explicit permission. Zup’s selected caption service may then use OpenAI directly after that approval. Older builds whose approval covered only automatic Mistral requests continue to use Mistral rather than sending their caption data to Anthropic. Zup may make up to four sequential requests for the same suggestion to prepare platform-specific drafts in this order: X, Instagram, TikTok, then LinkedIn. Accepting the current automatic permission also records approval for captions you request through the named hosted-caption partners. Daily automatic use remains a separate, versioned choice; turning it off leaves the approval for captions you request unchanged.

You can turn off Daily suggestions or automatic hosted captions under Your Voice. You can also limit or revoke Zup’s Photos access at any time in iOS Settings. Turning either option off prevents future Daily suggestion access or hosted requests but cannot retract a request already delivered.

Optional hosted captions with OpenAI, Anthropic, OpenRouter, TokenRouter, Fireworks AI, or Mistral

For people who approve the current hosted-caption partners, Generate can use OpenAI directly. Before that approval, Zup identifies OpenAI, Anthropic, OpenRouter and its model providers, TokenRouter and its model providers, Fireworks AI, and Mistral AI; explains the caption data shared and its purpose; and asks for explicit permission. Adding direct OpenAI processing requires a fresh approval even if you previously allowed the other services. Older builds and requests without that current approval retain their previously approved provider and model through OpenRouter, TokenRouter, Fireworks AI, or Mistral when that original route is available; they are not silently sent to OpenAI. If the original route is unavailable, Zup requires an update and the new permission. Compatible builds may offer Gemini caption models or Ox Alpha through OpenRouter, vision-caption models through TokenRouter, GLM 5.3 Flash through Fireworks AI, and Mistral. Zup’s protected service may choose or retry a caption service only within the recipients you approved. Daily suggestions retain the separately permissioned automatic-processing choice described above.

Every hosted provider may receive resized copies of up to twelve photos selected for the post; text from the post editor, details you enter for LinkedIn Professional Writer, and any follow-up answer you enter; the destination platform and caption preferences; a specifically resolved venue or point-of-interest label derived from available photo GPS metadata when Venue context is on, but not the raw coordinates; verified brand handles matched from original-photo evidence; an optional text hint that you may appear in particular selected photos; the structured voice fingerprint for the destination; and up to six captions you previously copied, shared, or successfully published, with @mentions and hashtags replaced. Other text in those saved examples is sent so the model can match your writing style. When Zup prepares four Daily suggestion drafts through Mistral, the selected photos and applicable context may be included in each sequential request, with the destination platform changing for each request. Zup never sends your entire photo library or your profile reference photo.

For OpenAI, Zup’s Apple App Attest-protected service sends the applicable caption data directly to OpenAI’s API to generate the requested caption. Credentials stay on Zup’s server, and requests disable optional response storage. OpenAI processes API data under its applicable data practices; see OpenAI’s API data information. Optional response storage is separate from provider abuse monitoring.

For Anthropic, Zup’s Apple App Attest-protected service sends the applicable caption data described above directly to Anthropic’s Messages API to generate the caption you requested. The API credential stays on Zup’s server. Anthropic processes that data under its applicable terms and data practices; see Anthropic’s privacy information.

For OpenRouter, the request is relayed through Zup’s Apple App Attest-protected service to OpenRouter, which routes it to the provider serving the model you selected. Zup requests providers that deny data collection for the Gemini models. Ox Alpha is an optional preview from an anonymous provider that retains prompts and completions but states that it does not use them for training. OpenRouter retains request metadata, and downstream handling remains subject to the selected model provider’s policy. See OpenRouter’s Ox Alpha page, OpenRouter’s privacy policy, and provider logging documentation.

For TokenRouter, the request is relayed through Zup’s Apple App Attest-protected service to TokenRouter, which routes it to the provider serving the vision model you selected solely to generate the caption you requested. Zup shows the selected model name, checks it against TokenRouter’s current catalog and supports only models compatible with Zup’s photo-caption flow. TokenRouter and the selected model provider process the request under their applicable terms and data practices. See TokenRouter’s privacy policy.

For Fireworks AI, the request is relayed through the same protected Zup service directly to Fireworks AI, which runs an approved vision model—currently GLM 5.3 Flash, with Kimi K3 and DeepSeek V4.1 Flash retained for compatible builds—to generate the caption you requested. Fireworks states that it does not log or store prompt or generation data for open models without explicit customer opt-in, and Zup has not opted in. See Fireworks AI’s data-security documentation.

For Mistral, the request is relayed through the same protected Zup service directly to Mistral AI. Mistral’s current API policy states that API inputs and outputs are not used for model training. Mistral may retain API inputs and outputs for up to 30 days for abuse monitoring unless zero data retention is enabled, and may retain information longer when legally required. Mistral processes this information under its commercial terms, data-processing terms, and privacy policy.

When the hosted-caption queue is enabled, Zup temporarily stores an encrypted copy of the caption request, including its selected photos and applicable context, and the returned caption so the requesting app installation can wait or reconnect. Results expire after 30 minutes; the service periodically removes caption job records older than one hour, and the queue is configured to remove its encrypted request records after its retention period. Direct caption requests do not use this queue. This operational storage is not used for advertising or model training.

Your versioned hosted-caption approval is saved on your iPhone and shared with Zup’s app extension. Switching among caption models or using automatic fallback within the exact partner set you approved does not ask again. The current set includes OpenAI, Anthropic, OpenRouter and its model providers, TokenRouter and its model providers, Fireworks AI, and Mistral AI; an older approval does not automatically cover OpenAI. A live routing change does not expand that approval to another service. You can turn off all future AI caption sharing under Your Voice → AI caption sharing. Turning it off prevents future hosted-caption requests but cannot retract a request already delivered. Zup asks again if a new third-party service is added or the purpose, categories of shared data, or permission terms materially change.

Connected-account voice learning

When you connect X, Instagram, LinkedIn, a Facebook Page, or TikTok, Zup can learn the writing style of that connected account from recent public posts. Its background service sends the account's public handle or profile URL to Bright Data and transiently analyzes the returned writing with Zup's configured hosted AI provider. LinkedIn may instead provide authored posts through an approved read permission; otherwise Zup needs your confirmed public profile URL. Zup does not send selected photos, draft captions, personal direction, profile references, saved local caption examples, or social access tokens to Bright Data for this collection. The source text is not saved in Zup's database. Zup stores the connected account identifier, aggregate writing profile, sample count, a content hash, collection job identifier, and refresh metadata separately for each installation and platform. Analysis is instructed to learn writing patterns without quoting source posts or copying their facts. Daily refreshes update changed writing, and caption generation uses the last successful cached profile without waiting for collection. Disconnecting the account deletes its learned profile and prevents in-flight jobs from restoring it.

Optional Zup AI photo editing

Photo editing is separate from caption generation. Before the first AI photo edit, Zup asks whether it may send a resized copy of the selected photo and the edit request you typed. If you allow it, Zup saves that choice on your iPhone so it does not ask again for later edits. Zup relays only that copy and request through its Apple App Attest-protected service to xAI’s Grok Imagine Image model to create the edit. Zup’s relay does not write the submitted photo, request, or returned image to its database. The returned image becomes a reversible working copy in Zup; the original Photos-library asset remains untouched, and you can undo the edit or restore the original before sharing.

xAI states that API inputs and outputs are not used to train its models without explicit permission and are ordinarily retained for up to 30 days for abuse and misuse monitoring unless zero-data-retention terms apply. xAI processes the request under its applicable terms and data practices. See xAI’s API security guidance.

Sharing and social accounts

Caption generation creates drafts only and never publishes them. X, Instagram, Facebook Pages, LinkedIn, and TikTok offer direct publishing after you connect a supported account and explicitly confirm the final post in Zup. Instagram direct publishing is available only for supported professional accounts: Feed sends all selected photos and the reviewed caption. The optional native Instagram handoff opens Instagram’s own available destination choices with the photo currently in view and places the reviewed caption on the short-lived iOS pasteboard for the user to paste before publishing or sending. Personal Instagram accounts can use this native handoff or Apple’s share sheet. Facebook direct publishing is available only for Pages the connected person manages and cannot publish to personal profiles. TikTok also lets you explicitly send the reviewed content to your TikTok inbox as a draft and retains an optional native Share Kit fallback. WhatsApp uses a native share handoff because its business API does not publish a person’s Status or operate their personal chats. The applicable selected content is sent through Zup’s protected publishing service only to the direct-publishing network you chose. Zup never receives your social account password. It publishes only after your final confirmation, either immediately or at the LinkedIn or X time you explicitly schedule.

Instagram’s native handoff and TikTok’s Share Kit fallback require a Photos-library asset identifier. If a camera capture, edited image, or restored Zup post does not have one, Zup asks for add-only Photos permission and saves the prepared image as a new photo so the selected app can receive the version you chose to share. Zup remembers that prepared photo for later retries and does not edit or delete existing photos in your library.

Connected social accounts

When you connect X, Instagram, Facebook Pages, LinkedIn, or TikTok, Zup stores the account or selected Page identifiers and display names needed to show connection status, along with the OAuth access tokens and any refresh token returned by that network. When you connect Facebook, Zup shows the eligible Page names and identifiers so you can explicitly choose where to publish, even when only one Page is available. Zup temporarily stores the available Page names, identifiers, and Page access tokens as one encrypted selection record for no more than ten minutes while you choose one Page, a checked subset, or all Pages. No Page is selected by default. Only the chosen Page credentials move into the encrypted connection record; unselected credentials are deleted with the temporary selection record. Access and refresh tokens are encrypted at rest with AES-GCM on Zup’s server and are used only to maintain the connection, carry out a publish action you confirm, or retrieve the account content described here. Zup keeps the chosen connection record until you disconnect the account in Zup or ask Zup to delete it. Disconnecting or completing a verified deletion request deletes the stored connection record and encrypted tokens; for TikTok, Zup also asks TikTok to revoke the access token.

Zup may identify likely people or organization names in your caption on your iPhone. Zup does not guess which X account belongs to a suggested name. Only after you tap a suggestion or Find does Zup send that name to X through its protected service and show possible search results. No result is selected by default, and no handle is added to your caption unless you choose the exact account and confirm it.

After you connect X or a supported Instagram Creator or Business account, Zup automatically and transiently retrieves up to ten recent posts or captions authored by that account. When LinkedIn grants the required member-post permission, the same automatic import applies there; otherwise the LinkedIn connection and publishing features continue to work without it. Zup’s service does not save the retrieved text. The posts are analyzed on-device, the raw text is discarded after analysis, and only a structured writing fingerprint for that destination is saved on your iPhone. Facebook and TikTok connections do not currently expose recent writing to this import. For every destination, captions you copy, share, or successfully publish through Zup are stored locally as approved examples and can build the destination’s fingerprint after five examples.

After a Facebook Page publish succeeds, Zup retrieves that specific post from Facebook using the selected Page’s access token to show its Page name and identifier, published caption, photo, publication time, and a link to Facebook. Zup verifies that the returned post belongs to the selected Page. This confirmation content is processed transiently and is not saved in Zup’s hosted database or sent to a caption provider. Zup retains only the publication identifiers, links, Page identity, and status needed to avoid duplicate publishing. If Facebook cannot return the confirmation content, Zup still records the successful publish and does not send the post again.

During an immediate confirmed X or LinkedIn publish, Zup’s service transiently processes the selected photos and caption without saving them in its hosted database. Instagram and TikTok require their services to fetch images from public URLs. For Instagram, Zup stores compressed copies behind long, unguessable URLs only while Meta creates the media containers, deletes them after the confirmed publish succeeds or fails, and makes interrupted copies expire within one hour. For TikTok, those URLs expire within 24 hours and are normally deleted earlier when TikTok reports a completed post, inbox delivery, or failure. Zup sends only the confirmed caption when the chosen destination accepts one, temporary photo URLs, and provider-required publishing settings to the selected network. Resulting posts and drafts are stored by that network under its terms and privacy practices; deleting a Zup connection does not delete content already delivered there.

Scheduled LinkedIn and X posts

If you choose Schedule and confirm a date and time, Zup saves an encrypted copy of the reviewed caption and prepared photos on its server, together with the selected LinkedIn or X account, scheduled time, and time zone. The server publishes that copy automatically, even while Zup is closed. Later changes to your local draft do not change the scheduled copy. When X grants a refresh token, Zup uses it to renew the connection for a scheduled publish. Scheduled posts are managed in Zup, separately from the native LinkedIn and X scheduled-post lists.

You can cancel a pending post in Scheduled posts before publishing begins. Disconnecting LinkedIn or X cancels pending Zup schedules for that account. The caption and photo copies are removed when the schedule is cancelled or reaches a completed, failed, or uncertain result; a minimal status record is retained for up to seven days. Zup accepts dates up to 30 days ahead and within your connection’s validity. Its dispatch service checks due posts each minute; provider delays or revoked access can prevent a post. Deleting Zup from your phone does not cancel a confirmed server schedule. Cancel it or disconnect the corresponding account before uninstalling.

Profile reference

Your optional profile reference photo stays protected on your iPhone. Face comparison happens on-device. The reference photo is never uploaded by Zup.

Security and service records

Zup assigns a random installation identifier and stores an App Attest public key, request counter, and one-way credential hash to verify genuine app requests, prevent replay, and limit abuse. These records are not used for advertising or cross-app tracking. Zup’s hosting infrastructure may process ordinary network metadata such as an IP address, timestamp, and request status for security and service operation.

Local preferences

Your voice settings, social voice-matching preference, per-platform structured voice fingerprints, favorites and their resolved photo-location labels, profile reference, Daily suggestions settings and dismissed-photo identifiers, hosted-caption approval, AI photo-edit permission, and captions you copy, share, or successfully publish for local voice memory are stored on your iPhone. Zup automatically uses verified brand evidence from selected photos when a matching handle is available and automatically learns from those approved caption actions. Raw photo coordinates are not stored by Zup. You can remove favorites, remove the profile reference, turn off Daily suggestions or future hosted sharing, or disconnect X, Instagram, Facebook, LinkedIn, or TikTok at any time. Deleting Zup removes its locally stored voice memory and every writing fingerprint. Removing a favorite deletes Zup’s saved copies of its photos and their resolved location labels but does not delete the original from Apple Photos.

Protection, retention, and deletion

Zup requires service providers that process user data to protect it consistently with this policy and applicable privacy requirements. Zup retains the security records described above for as long as needed to protect its hosted services and retains each encrypted social connection until it is disconnected or deleted on request. Instagram’s temporary photo URLs stop working within one hour; TikTok’s stop working within 24 hours. Their copies are normally deleted earlier when the provider reports a terminal status. Deleting the app removes local preferences and content but does not by itself notify Zup to delete a hosted connection. Disconnect X, Instagram, Facebook, LinkedIn, and TikTok before uninstalling, revoke Zup in the network’s connected-app settings, or send a deletion request using the address below.

Contact

Questions, consent requests, and deletion requests can be sent to [email protected]. General product help is available from Zup support.