Privacy policy

Effective August 11, 2026

Zup is an iPhone app that turns photos you choose into captions and share-ready posts. For posts you create yourself, you select photos with Apple’s system photo picker and Zup does not need access to the rest of your library. The optional Daily suggestions feature is the only part of Zup that requests access to photos you allow so it can find pictures taken today.

On-device processing

Zup performs private photo analysis on-device for features such as Daily suggestions and the optional profile reference. Apple’s on-device Foundation Model remains available for the separately configured Daily suggestion flow, while Generate uses the hosted model you selected and activated. Data used only by an on-device model stays on your iPhone.

Optional Daily suggestions

Daily suggestions is off until you choose to set it up. Zup explains the feature before asking for Apple Photos permission, and you may give access to selected photos or your full library using Apple’s system control. When enabled, Zup checks photo creation dates on your iPhone when you open the app, considers only photos available to Zup that were taken today, skips screenshots, and prepares no more than three suggestions with up to four photos each. Zup does not continuously scan your library or run this check in the background.

You review each suggestion before keeping it. Swiping left dismisses only Zup’s suggestion and never deletes, edits, or hides the original photo in Apple Photos. Swiping right saves the proposed post and protected copies of its photos to Zup Favorites on this iPhone. Closing the review without swiping leaves the suggestion available for a later review. Creating or saving a suggestion does not publish it to any social network.

Zup first tries to create Daily suggestion captions on-device. If on-device captioning is unavailable, Zup may use Mistral automatically only after you separately grant the current automatic hosted-caption permission for Daily suggestions. Before you enable that option, Zup identifies Mistral and the service that relays each request, explains that resized copies of today’s candidate photos and the same caption context described below may be sent automatically when Zup opens, and asks for explicit permission. Zup may then make up to four sequential requests for the same suggestion to prepare platform-specific drafts in this order: X, Instagram, TikTok, then LinkedIn. Daily automatic use is recorded and checked separately in addition to the normal Mistral hosted-caption permission. Enabling Daily automatic use also allows Mistral for hosted captions on manually created posts; turning off Daily automatic use leaves the manual permission unchanged. Neither OpenRouter nor TokenRouter is silently switched to Mistral.

You can turn off Daily suggestions or automatic hosted captions under Your Voice. You can also limit or revoke Zup’s Photos access at any time in iOS Settings. Turning either option off prevents future Daily suggestion access or hosted requests but cannot retract a request already delivered.

Optional hosted captions with OpenRouter, TokenRouter, or Mistral

OpenRouter vision is the default for Generate, with TokenRouter’s OpenAI GPT-5.4 Image 2 model and Mistral available as alternatives under Your Voice → Hosted intelligence. OpenRouter offers a separate choice among Google Gemini 3.5 Flash, Anthropic Claude Sonnet 5, and OpenAI GPT-5.5. Selecting a provider or model does not upload anything. Before the first request to a hosted model, Zup identifies that model, explains what will be shared and why, and asks for explicit model-specific photo-sharing permission. Once you activate a provider and model, Generate uses only that selection. Daily suggestions retain the separately permissioned on-device/Mistral flow described above.

Every hosted provider may receive resized copies of up to twelve photos selected for the post; text from the post editor, details you enter for LinkedIn Professional Writer, and any follow-up answer you enter; the destination platform and caption preferences; supplemental Apple Vision observations produced on-device; verified brand handles matched from original-photo evidence when that feature is enabled; an optional text hint that you may appear in particular selected photos; the structured voice fingerprint for the destination; and up to six captions you previously chose to save for voice matching, with @mentions and hashtags replaced. Other text in those saved examples is sent so the model can match your writing style. When Zup prepares four Daily suggestion drafts through Mistral, the selected photos and applicable context may be included in each sequential request, with the destination platform changing for each request. Zup never sends your entire photo library or your profile reference photo.

For OpenRouter, the request is relayed through Zup’s Vercel-hosted, Apple App Attest-protected service to OpenRouter, which routes it to an inference provider serving the selected Google, Anthropic, or OpenAI model. Zup requests providers that deny data collection, and Zup’s relay validates and forwards the request without writing selected photos, the prompt, or the generated caption to its database. OpenRouter says API prompts and completions are not logged by default unless the account opts in, although request metadata is retained. Downstream handling remains subject to the selected model provider’s policy. See OpenRouter’s privacy policy and provider logging documentation.

For TokenRouter, the request is relayed through Zup’s Vercel-hosted, Apple App Attest-protected service to TokenRouter, which routes it to OpenAI’s GPT-5.4 Image 2 model solely to generate the caption you requested. Zup’s relay validates and forwards the request without writing the selected photos, prompt, or generated caption to its database. TokenRouter and OpenAI process the request under their applicable terms and data practices. See TokenRouter’s privacy policy and OpenAI’s enterprise privacy page.

For Mistral, the request is relayed through the same protected Zup service directly to Mistral AI. Mistral’s current API policy states that API inputs and outputs are not used for model training. Mistral may retain API inputs and outputs for up to 30 days for abuse monitoring unless zero data retention is enabled, and may retain information longer when legally required. Mistral processes this information under its commercial terms, data-processing terms, and privacy policy.

Your current, provider-specific permission choices are saved on your iPhone. You can turn off future OpenRouter, TokenRouter, or Mistral sharing separately under Your Voice → Hosted intelligence. Turning off a provider prevents future requests to that provider but cannot retract a request already delivered. If the recipient, purpose, categories of shared data, or permission terms change, Zup will ask for permission again.

Sharing and social accounts

Caption generation creates drafts only and never publishes them. X, Instagram, Facebook Pages, LinkedIn, and TikTok offer direct publishing after you connect a supported account and explicitly confirm the final post in Zup. Instagram direct publishing is available only for Creator and Business accounts; personal accounts can use Zup’s native Instagram Stories handoff or Apple’s share sheet instead. Facebook direct publishing is available only for Pages the connected person manages and cannot publish to personal profiles. TikTok also lets you explicitly send the reviewed content to your TikTok inbox as a draft and retains an optional native Share Kit fallback. WhatsApp uses a native share handoff because its business API does not publish a person’s Status or operate their personal chats. The selected photos and caption are then sent through Zup’s protected publishing service only to the direct-publishing network you chose. Zup never receives your social account password and never publishes in the background or without your final confirmation.

When you choose TikTok’s Share Kit fallback, TikTok’s iOS SDK requires a Photos-library asset identifier. If a camera capture, edited image, or restored Zup post does not have one, Zup asks for add-only Photos permission and saves the prepared image as a new photo so TikTok can receive the version you chose to share. Zup remembers that prepared photo for later retries and does not edit or delete existing photos in your library.

Connected social accounts

When you connect X, Instagram, a Facebook Page, LinkedIn, or TikTok, Zup stores the account or selected Page identifier and display name needed to show connection status, along with the OAuth access token and any refresh token returned by that network. If your Facebook account manages more than one eligible Page, Zup temporarily stores the available Page names, identifiers, and Page access tokens as one encrypted selection record for no more than ten minutes while you choose; the unused options are deleted when selected or expired. Access and refresh tokens are encrypted at rest with AES-GCM on Zup’s server and are used only to maintain the connection or carry out a publish action you confirm. Zup keeps the chosen connection record until you disconnect the account in Zup or ask Zup to delete it. Disconnecting or completing a verified deletion request deletes the stored connection record and encrypted tokens; for TikTok, Zup also asks TikTok to revoke the access token.

Zup may detect likely people’s names from text visible in selected photos on your iPhone. Zup does not guess which X account belongs to a detected name. Only after you tap Find X handles does Zup send the displayed name to X through its protected service and show possible search results. No result is selected by default, and no handle is added to your caption unless you choose the exact account and confirm it.

If you explicitly tap Use recent X posts in Teach Zup your voice, Zup transiently retrieves up to ten recent posts authored by your connected account and returns them to your iPhone for review. Zup’s service does not save the retrieved posts. LinkedIn currently keeps the permission required to read a member’s personal post history closed to new apps, so Zup asks you to paste LinkedIn examples instead. Imported or pasted writing samples are analyzed on-device, the raw setup text is cleared after analysis, and only a structured fingerprint for that destination is saved on your iPhone.

During a confirmed X or LinkedIn publish, Zup’s service transiently processes the selected photos and caption without saving them in its hosted database. Instagram and TikTok require their services to fetch images from public URLs. For Instagram, Zup stores compressed copies behind long, unguessable URLs only while Meta creates the media containers, deletes them after the confirmed publish succeeds or fails, and makes interrupted copies expire within one hour. For TikTok, those URLs expire within 24 hours and are normally deleted earlier when TikTok reports a completed post, inbox delivery, or failure. Zup sends only the confirmed caption, temporary photo URLs, and provider-required publishing settings to the selected network. Resulting posts and drafts are stored by that network under its terms and privacy practices; deleting a Zup connection does not delete content already delivered there.

Profile reference

Your optional profile reference photo stays protected on your iPhone. Face comparison happens on-device. The reference photo is never uploaded by Zup.

Security and service records

Zup assigns a random installation identifier and stores an App Attest public key, request counter, and one-way credential hash to verify genuine app requests, prevent replay, and limit abuse. These records are not used for advertising or cross-app tracking. Zup’s hosting infrastructure may process ordinary network metadata such as an IP address, timestamp, and request status for security and service operation.

Local preferences

Your voice settings, per-platform structured voice fingerprints, favorites, profile reference, Daily suggestions settings and dismissed-photo identifiers, provider-specific OpenRouter, TokenRouter, and Mistral permission choices, and approved caption memory are stored on your iPhone. You can remove favorites, reset voice memory and every voice fingerprint, remove the profile reference, turn off Daily suggestions or future hosted sharing, or disconnect X, Instagram, Facebook, LinkedIn, or TikTok at any time. Removing a favorite deletes Zup’s saved copies of its photos but does not delete the original from Apple Photos.

Protection, retention, and deletion

Zup requires service providers that process user data to protect it consistently with this policy and applicable privacy requirements. Zup retains the security records described above for as long as needed to protect its hosted services and retains each encrypted social connection until it is disconnected or deleted on request. Instagram’s temporary photo URLs stop working within one hour; TikTok’s stop working within 24 hours. Their copies are normally deleted earlier when the provider reports a terminal status. Deleting the app removes local preferences and content but does not by itself notify Zup to delete a hosted connection. Disconnect X, Instagram, Facebook, LinkedIn, and TikTok before uninstalling, revoke Zup in the network’s connected-app settings, or send a deletion request using the address below.

Contact

Questions, consent requests, and deletion requests can be sent to privacy@samkarri.com. General product help is available from Zup support.