Privacy · zeko

Privacy

Last updated 5 October 2026

zeko is run by one person, Trần Anh Đức, in Vietnam. I collect the least I can get away with, because storing data I don't need is a liability, not an asset. Here's the full list.

Your account

Name, email address, and your password stored only as a bcrypt hash. I can't read your password, and neither can anyone who steals the database.

Your site content

Whatever you type into the editor, plus any images you upload. Images go to Google Cloud Storage.

Orders

Order number, which plan, the amount and whether it was paid. Card numbers never reach zeko.

Refund requests

If you ask for a refund, the form stores your email, the order number and the PayPal address to send the money to. The form rejects anything that looks like a card number on purpose.

Sign-in safety

A count of failed sign-in attempts per email, so passwords can't be guessed in bulk. These delete themselves after an hour.

Your session

A cookie that keeps you signed in for up to 7 days, and a record of your one active session. Signing in somewhere else ends the old one.

Visits to zeko.lol

Aggregate page views through Umami. No cookies, no profile, no following you to other websites.

Card details never touch zeko. Payments go through Lemon Squeezy, who act as the merchant and handle the card form and the tax. All zeko ever learns is that an order was paid.

Published sites are public

This sounds obvious, but it matters. Once you publish, everything on that page can be read by anyone with the address, and search engines may index it. Don't put a phone number or home address on a published page unless you want strangers to have it.

Drafts you build without an account are the opposite. They sit in your own browser and never reach my server.

Who else handles your data

I don't sell data and I don't run ad trackers. These companies are involved because the service can't run without them:

MongoDB Atlas stores accounts, sites and orders
Google Cloud runs the servers and stores uploaded images
Cloudflare sits in front of the site and routes traffic
Lemon Squeezy processes payments and issues receipts
Umami counts visits to zeko.lol

Analytics only runs on zeko's own pages. I deliberately don't load it on customer sites, so visitors to your published page aren't counted by me.

How long things are kept

Account and sites: until you delete them, or until you ask me to close the account
Unpaid orders: removed automatically after a day
Paid orders: kept, because they're proof of purchase and I need them for tax
Failed sign-in counts: deleted after an hour

Deleting your data

Any site can be deleted from the dashboard, and that takes its content with it. For the whole account, email me and I'll remove it along with your sites and uploads. Paid order records stay, because I'm required to keep them.

Want a copy of what's stored about you? Ask and I'll send it.

Children

zeko isn't aimed at children under 13, and I don't knowingly keep accounts for them. If you think a child has signed up, tell me and I'll delete it.

Contact

support@zeko.lol, or the contact form. See also terms and refunds.