Security

Security is built into how Zoku is designed. This page summarizes our posture. To report a vulnerability, email pd@heyzoku.com — we appreciate responsible disclosure and will respond promptly.

Encryption

All traffic between your devices and Zoku is encrypted in transit using TLS. Data is stored with our managed database provider (Supabase).

Authentication

Sign-in is handled by Supabase Auth using short-lived, signed tokens (Google sign-in). The app authenticates every backend request with that token; we never see your Google password.

No secrets on your device

The Zoku apps never ship AI provider API keys. All paid model and search requests go through our backend, which holds the keys, authenticates you, and meters usage — so a compromised app binary cannot leak a key or run up charges.

Data isolation

Per-user data is isolated at the database level (row-level security), so one user can never read another user’s data.

Privacy-aware logging

We log request metadata for reliability and abuse prevention, but do not log your prompts, voice, or message content by default. Speech recognition and synthesis run on your device where possible. See our Privacy Policy.

Payments

Payments are handled by DodoPayments as merchant of record. We do not store your full card details.