Zahir — Privacy Policy
Effective date: 2026-11-05 Version: 1.0
This policy explains what Northlane Studio ("Northlane Studio", "we") does with personal data when you buy and use Zahir. We are the data controller for that data. Contact: [email protected].
The short version
- There is no account, no analytics and no tracking. We do not sell your data and we do not run ads.
- What's on your island stays on your computer: your music, your batteries, which apps use your camera or microphone, your timers and your computer's performance are read locally and sent nowhere.
- Three things do leave your computer: your key when you activate, your IP address to find your city for the weather, and an approximate location to get the forecast.
1. What we collect, and why
| Data | Why | Legal basis | Kept |
|---|---|---|---|
| When you buy: email address, amount, currency, order reference | Deliver your key, support and refunds, tax records | Contract and legal obligation | 5 years after the purchase |
| When you activate: your key, a one-way hash of your computer's Windows identifier, your computer's name, activation and last-check dates | Keep the key within its 3 computers; let you or support free one | Contract | While the key exists |
| Every 12 hours, while online: your key, that same hash | Check the key has not been refunded | Contract | Only the last-check date is kept |
| Update check: app version, operating system, IP address | Tell you a new version exists | Legitimate interest (a working, secure product) | IP in server logs, 30 days |
Your computer's name helps you recognise it when you ask support to free it.
2. Weather: two third parties, directly
To show the weather, Zahir talks directly to two services, about every 30 minutes. We do not receive any of this.
| Who | What it receives | What for |
|---|---|---|
| GeoJS (get.geojs.io) | Your IP address | Find your approximate city, once per session |
| MET Norway (api.met.no) | Your approximate coordinates, rounded, and your IP address | Get the forecast |
Forecast data comes from the Norwegian Meteorological Institute (MET Norway), under its open licence. Both services apply their own privacy terms.
3. Who else sees it
We use a small number of processors, each bound by contract to use the data only to give us the service:
| Who | What for | Where |
|---|---|---|
| Stripe, Inc. | Takes your payment; it handles your card details as its own controller too | United States and others |
| DigitalOcean, LLC | Runs the server and the database | New York, United States |
| Brevo (Sendinblue SAS) | Sends your key | the European Union (France) |
| Cloudflare, Inc. | Serves and protects the website, downloads and server | Global edge network |
Apart from those, we disclose personal data only when the law makes us, or to defend a legal claim. We never sell it and we never rent it.
4. Data leaving your country
Our servers are in New York, United States. If you are in the European Economic Area, the United Kingdom or Switzerland, that is an international transfer, and we rely on the European Commission Standard Contractual Clauses with each provider. A copy is available on request at [email protected].
5. How we protect it
HTTPS everywhere, limits on activation attempts, and restricted access to the server. No system is perfectly secure. If a breach affects your data and creates a real risk to you, we will notify you and the competent authority within the deadlines the law sets (72 hours to the authority under the GDPR).
6. Your rights
Wherever you live, you can ask us to access, correct, delete or export the data we hold about you, and to restrict or object to a particular use. Write to [email protected] from the email you used to buy. We answer within 30 days, free of charge. Deleting your data ends your key, and we may have to keep purchase records for tax reasons.
- Mexico: you can also complain to the competent data protection authority.
- European Union / EEA / UK: you can complain to your national data protection authority.
- California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA.
7. Children
Zahir is not for children under 16. We do not knowingly collect their data. If you believe a child gave us data, write to [email protected] and we will delete it.
8. Automated decisions
We make none, and we do not profile you.
9. Changes
We will post any new version at https://northlanestudio.dev/legal/zahir/privacy.html with a new date. For a material change we will tell you in the app or by email at least 30 days before it applies.
10. Contact
Northlane Studio
Privacy: [email protected] We are not required to appoint a Data Protection Officer; privacy questions go to the address above.