Zamm - Terms of Use & Privacy

Zamm is the one app for every event with friends, family or acquaintances: a trip, an outing, a bachelor or bachelorette party, a ski holiday, a hiking week, a wedding weekend, a club outing. Participants are invited by link or QR code and can then talk about every part of the event in Zamm.

Key Features

Chat: in a built-in chat, messages about the event can be exchanged. With replies and reactions.
Photos and videos: in a shared album, photos and videos can be shared in full quality. In the evening, Zamm reminds you of the day's photos if you like.
Costs: shared costs can be recorded in shares, in different currencies. At the end it shows who owes whom how much.
Places and location: on a shared map, the accommodation and meeting points are marked. Whoever wants to shares their location, as long as the event runs.
Tasks: in one or more shared task lists, everybody sees who brings what, what is booked and what is still missing.
Private: no account, no email, no phone number. The Zamm backend receives all content encrypted, only participants can access it. No ads, no tracking.
With an end date: an event in Zamm ends automatically. Once the event is over, the chat is closed and the data is deleted from the cloud.
Six languages: English, German, Spanish, French, Italian, Portuguese.

Terms of Use

Last updated: 30 October 2026

1. Acceptance of Terms

By downloading, installing, accessing or using Zamm (the "Application" or "App"), you agree to these Terms of Use ("Terms"). If you do not agree, do not use the App. The App is provided by insoso GmbH (the "Service Provider", "we").

2. License

Subject to these Terms, the Service Provider grants you a limited, non-exclusive, non-transferable, revocable license to use the App for personal, non-commercial purposes.

3. No account; eligibility

No account: the App works without registering. Each event knows your device only by a random token, and you choose the name the others see.
Age: you must be at least 13 years old, or older where the law of your country requires it. Younger children may take part only through a parent or guardian.
Invitations: whoever has an event's link or QR code can join it and read everything in it. Share them only with the people you mean.
People without Zamm: organizers may add a person who does not use Zamm, and anybody may add their own children, by name only, so that costs, tasks and appointments count them. Add only people who agree to it, or children you are responsible for.
Invitations in Zamm: anybody who was in an event with you may invite you to another one in Zamm. You can block a sender, or become unreachable for earlier contacts in About.

4. Content you share, and no tolerance for abuse

You are responsible for what you post: messages, photos, videos, names, pictures, costs and receipts, places, tasks, appointments, files, information, polls, suggestions and comments. You keep your rights in it and allow the other people in the event to see and keep it, which is what sharing it there means. There is no tolerance for objectionable content or abusive behaviour. You agree not to post or send anything that:

is unlawful, including sexual content involving minors, which we report to the authorities;
harasses, threatens, bullies or demeans anybody, or incites hatred or violence;
is pornographic or shows violence for its own sake;
infringes somebody else's rights, including copyright and the right to one's own image;
is spam, fraud or malware.

You also agree not to:

attempt to reverse-engineer, modify or interfere with the App or the service behind it;
circumvent the security, limits or rate limits of that service;
join an event you were not meant to be in, or pass an invitation on to keep somebody out of sight of the others.

5. Reporting, blocking and removal

Every message, every photo or video and every receipt can be reported in the App, and every participant can be blocked. A report hides the content for everybody in the event until it is reviewed, and sends it to us with the text or the picture as the reporter's App shows it, since we cannot read the event ourselves. We review reports promptly, normally within 24 hours, and may delete the content, remove the person who posted it from the event and keep that device from joining it again, or close the event. Organizers of an event may also remove participants. Blocking hides a person's messages, photos, videos and reactions from you; the person is not told.

6. Events end

An event is kept for a limited time on purpose. For 30 days after its end everything stays open. Then it becomes read only, after 60 days it goes offline, and after 90 days it is deleted from our servers for good. Save what you want to keep, photos and videos in particular, before then. The copy on your phone stays until you remove it.

7. Costs

The App works out shares and who owes whom from what the people in an event enter, with exchange rates of the European Central Bank where a currency needs one. It is a calculator for friends, not accounting or financial advice, and we are not a party to any debt between participants.

8. Availability and changes

We may update, suspend or discontinue parts of the App and its service at any time, and change the limits of an album. We may also update these Terms, and will say so in the "Last updated" date above.

9. Disclaimer; limitation of liability

The App is provided "as is" and "as available", without warranties of any kind. To the maximum extent permitted by law, the Service Provider is not liable for indirect, incidental, special, consequential or exemplary damages, or for loss of data, arising from your use of the App. Nothing here limits liability that cannot be limited by law.

10. Governing law

These Terms are governed by the laws of Austria, without regard to conflict-of-law provisions. Mandatory consumer protection rules of your country of residence may also apply.

11. Contact

For questions about these Terms, and to report content outside the App, write to .

Privacy Policy

Last updated: 5 November 2026

Overview

Zamm keeps a group's things in sync through our server, and the server is built so that it cannot read them. Your phone encrypts everything before it leaves, with a key that only travels inside the invitation link, and the other phones in the event decrypt it. There is no account, and the server cannot tell who you are.

End-to-end encrypted, and so unreadable to us

Encrypted with AES-256-GCM on your phone, and readable only by the people in the event:

chat messages, replies and reactions, and pictures sent in the chat;
photos and videos, including the metadata inside them such as where and when they were taken;
the event's name and cover picture and the part of it that shows, people's names and profile pictures;
the names of people without Zamm and whether a profile is a child's;
costs, their titles, amounts and shares, exchange rates and settings, and the pictures of receipts;
places, live locations, tasks and lists;
appointments of the calendar, with their times, places, notes and answer deadlines;
the event's information, such as an address, a Wi-Fi password or a door code;
files added to appointments or to the information, such as tickets, with their names;
the questions and answers of polls, and the suggestions and comments of everybody in them;
your contact card (the address of your mailbox and its public key), left in every event you open.

The key is created on the phone of whoever starts the event and travels only in the invitation link after the "#", a part browsers never send to a server. Whoever has the link has the key.

What the server can read

Identifiers: random ids for the event, the participants and the items, and the roles (organizer or member).
Times: when the event starts and ends, when something was posted or changed. Not when an appointment of the calendar is: that stays encrypted.
Answers and votes: who said they take part in which appointment, or not, and how many guests they bring; who sees to an appointment; who chose which answer of a poll; and that an appointment's time or place was changed. The server sees these by random ids only, never what the appointment or the poll is about, so that it can count them and send the notifications.
Kind and size: the kind of event, how many items there are and how large they are, receipts included, and who added a receipt.
A device token: a random value per event that proves your phone belongs to it. We store only a hash of it, and a hash of a device id, so the same phone joining again is recognised.
App Attest key: when you create or join an event, your App proves with Apple's App Attest that it is a genuine copy on a real iPhone. We keep the public part of that key and a counter, linked to no event and no person, so that nobody can create events with a script. On Android, Google Play Integrity does the same: Google tells our server whether the App is genuine and installed from Google Play; we keep nothing of it.
Profiles without Zamm: that a participant has no device, who added it, and a hash of the code of a personal invitation, with whether it was opened.
Mailboxes: the random address of a mailbox, its push address, and when letters come and go, as described below.
Typing: that somebody is typing in the chat right now, passed on to the others in the event at once and never stored.
Push address: the address Apple (iPhone) or Google's Firebase Cloud Messaging (Android) gives your phone for notifications, so that the others' messages and photos can be announced.
Reports: when you report something, your App sends us the reported text or a small copy of the picture or receipt as it shows it, the names involved and a note if you add one. This is the only way we can review it.
Connection data: our web server sees your IP address with each request and keeps it in access logs for at most 14 days, to stop abuse.

Your live location is encrypted like everything else. The server keeps only the latest encrypted position of each person who shares, in memory and never on disk, and only while the event runs. Whoever stops sharing stays visible to the others at their last position for one more hour, then it is gone; leaving the event removes it at once.

Invitations and Zamm contacts

Each phone has one mailbox outside of any event, known by a random address. In every event you open, your phone leaves a card with that address and a public key, encrypted for the event. The phones of the others keep it as a Zamm contact, with the name and picture they know from that event. An invitation in Zamm is a letter encrypted to the receiver's key: it holds the invitation link, the event's name and times and the sender's card, and only the receiver can open it. The answers (received, seen, accepted, declined) go back the same way. The server sees which mailbox writes to which, and when, and the push address of a mailbox, but never who is behind it or what a letter says. Letters are deleted after 30 days, and a mailbox nobody opened for 3 years is deleted. "Become unreachable for earlier contacts" closes your mailbox and opens a new one.

On your phone

The App keeps a copy of each event on your phone, so it opens at once and stays as a memory after the event is gone from the server. That copy, the event keys and your device tokens are kept in the App's storage and in the iOS keychain or the Android Keystore, excluded from backups where possible. "Remove from this device" deletes an event from the phone; deleting the App deletes all of them. Your phone's photo library is only read if you switch on photo suggestions, and nothing from it leaves the phone unless you choose to share it. When you add a receipt, your phone reads its total itself, with Apple's or Google's text recognition on the device; the picture and its text are sent nowhere but, encrypted, to the event. Your Zamm contacts stay on your phone, out of backups. When you invite people from your phone's contacts, the phone shows its own picker; the App never reads your contacts, and the message goes through your phone's messaging app. What you share to Zamm from another app waits on your phone until Zamm opens and sends it, encrypted, to the event you chose.

How long

For 30 days after an event ends everything stays open. Then it is read only, after 60 days it goes offline, and after 90 days all of it is deleted from our servers: messages, photos, videos, costs, everything. Report data goes with the event. Server backups are kept for at most 14 days, so a deleted event is gone from them too after that. Only if an authority lawfully asks us to keep an event's data do we keep it past the 90 days, for as long as that request requires, and still unreadable to us. Letters in a mailbox go after 30 days, a mailbox unused for 3 years is deleted.

Leaving an event

Leaving an event in the App deletes your name, picture, contact card, messages, photos, videos, position, push address, blocks, reports, answers to appointments, votes in polls and your suggestions and comments in them from it at once. Costs you entered stay, with their receipts and without your name, because the others' settlement depends on them.

Who else is involved

Hetzner Online GmbH, our hosting provider, in Finland and Germany, inside the EU.
Apple, in the iPhone App, to deliver notifications (Apple Push Notification service). A notification carries the message, the appointment or the poll encrypted; your phone decrypts it.
Apple Maps, in the iPhone App: when you search for a place or type the address of a place or an appointment, what you type goes to Apple to suggest addresses, as in Apple's own Maps app. Maps also loads the map you look at from Apple. Nothing of the event goes along. To show an appointment in the time zone of its place, your phone asks Apple for the time zone of that place's coordinates. To put an appointment at an address on the map and to find its weather, your phone asks Apple where that address is.
Apple Weather, in the iPhone App: unless the organizers hide it, your phone asks Apple's weather service for the forecast at the coordinates of the event's places and of its appointments. Apple receives those coordinates, and nothing else of the event.
Google, in the Android App only: Firebase Cloud Messaging delivers notifications (a notification carries the message, the appointment or the poll encrypted; your phone decrypts it), Google Play Integrity checks that the App is genuine when you create or join an event, and Google Maps loads the map you look at. When you search for a place or an address, what you type goes to the search service of your phone (Google's on most Android phones); nothing of the event goes along.
Open-Meteo, in the Android App only: unless the organizers hide the weather, your phone asks open-meteo.com for the forecast, and for the time zone of a place, at the coordinates of the event's places and of its appointments. Open-Meteo receives those coordinates and your IP address, and nothing else of the event.
Linked websites: when a chat message holds a link, the phones of the people who read it load a preview (title and picture) directly from that website, which sees their IP address as when the link is opened. Our server learns nothing of it.
OpenSnowMap and Waymarked Trails: when the organizers of an event lay ski pistes, hiking trails or cycling routes over its map, your phone loads the pictures of the part of the map you look at from opensnowmap.org or waymarkedtrails.org, which see your IP address and that part of the map. Nothing of the event goes along. You can hide the layers on your phone.
The European Central Bank: your phone downloads the day's exchange rates directly. Nothing about you is sent.
Zoho, the email service that delivers reports to us.

We use no analytics, advertising or tracking framework, Google services only in the Android App and only for what is named above, and we sell or share no data.

Legal basis

We process the data above to provide the App you chose to use (Art. 6(1)(b) GDPR), and access logs and reports to keep the service safe and to meet our legal duties for user content (Art. 6(1)(c) and (f) GDPR).

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction, objection and data portability. Most of these are in your own hands in the App: you change your name and picture, delete your messages and photos, and leave an event, which erases what is yours. Since we hold nothing that identifies you and cannot read an event, we can neither find nor hand out "your data" by name. Write to us, and we will help as far as we can.

You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehoerde, Barichgasse 40-42, 1030 Vienna.

Children

Zamm is meant for people of 13 and older. Children younger than that may take part in a family event only through a parent or guardian.

Controller and contact

insoso GmbH, Griepenkerlgasse 10, 1130 Vienna, Austria - . Write to that address for any question about this policy, and we will answer it.

Changes

If this policy changes, the date above changes with it, and a change that affects what leaves your device will be said in the App as well, not only here.