Privacy Policy
Last updated: 8 November 2026
1. Who we are
Zentoku is run by Aryan Agarwal and Khushboo Agarwal, Bariatu, Ranchi, Jharkhand 834009, India. We decide why and how your personal data is used, which makes us the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023. You can reach us at support@zentoku.in.
2. What we collect, why, and for how long
| What | Why | How long we keep it |
|---|---|---|
| Account: email, password (stored scrambled, never readable), name, phone, saved addresses, wishlist, ZenWallet coins | To run your account and checkout | Until you delete your account |
| Google sign-in (only if you choose "Continue with Google"): your name and email address from your Google account | To create your account and sign you in without a password | Until you delete your account |
| Orders: items, delivery name, email, phone and address, payment status, courier tracking | To deliver your order, handle returns, and meet tax and accounting rules | As long as Indian tax and accounting law requires us to keep order records |
| Your IP address and browser details on an order | Only if you accepted advertising cookies: to match your purchase with the ad you clicked | 30 days, then cleared |
| Reviews: your rating, text and photos | To show your review on the product page | Until you delete your review or your account |
| Contact messages: name, email, message | To reply to you | 1 year. A copy also reaches our support inbox, where we delete it when we no longer need it. |
| Drop alerts: email and which list you joined | To email you about drops and restocks | Until you unsubscribe. Sign-ups you never confirm are deleted after 7 days. |
| Security log: sign-ins, password resets, data downloads, account deletions, unsubscribes, with the time, IP address and browser | To protect accounts and investigate misuse | 1 year |
| Website analytics (Google Analytics) | Only if you accepted analytics cookies, to see how the shop is used | 14 months |
| Game data (Emoji Trials) | To run the game and its leaderboards | See section 5 |
We also count requests from each IP address for a short time, so that bots cannot flood the site. These counters delete themselves.
3. Who receives your data
We use these services to run the shop. Each one receives only what it needs for its job. We never sell your data.
- Razorpay takes online payments (your name, email, phone and the amount). We never see or store your card number or UPI PIN.
- Delhivery delivers your parcel (your name, phone, address and order value).
- Resend sends our emails (order receipts, verification codes, password resets and drop alerts).
- Cloudinary stores review photos.
- Cloudflare Turnstile checks that a visitor is a person on reviews and the game. It looks at your browser and IP address.
- Vercel hosts the website and measures its speed and page views without cookies. MongoDB Atlas stores our database.
- Google runs the "Continue with Google" button on the sign-in page, so it sees your browser and IP address there. If you use the button, Google confirms your email and sends us only your name and email address. We never see your Google password.
- Meta and Google receive advertising and analytics data only if you accept cookies (see section 4).
Some of these companies process data outside India. We share data when the law or a court requires it.
4. Advertising and analytics: Meta Pixel and Google Analytics
The first time you visit, a banner asks whether you accept cookies from Meta and Google. They stay off unless you press Accept. Rejecting does not stop you shopping. You can change your choice at any time with "Cookie settings" at the bottom of every page. Rejecting after accepting removes the cookies from your browser.
If you accept, we use the Meta Pixel (provided by Meta Platforms, Inc.) to measure our advertising and show relevant streetwear announcements on Facebook and Instagram. It collects:
• Technical & device identifiers: IP address, browser type, operating system and screen size.
• Browsing & shopping activity: pages visited, tees viewed (ViewContent), items added to cart (AddToCart), started checkouts and completed order values (Purchase).
• Campaign attribution: the page that sent you and advertising click identifiers (such as fbclid).
When you place an order after accepting, our server also sends Meta the purchase itself (the order value and items). It adds your email, phone number, name, city, state and PIN code, each turned into a scrambled code (a SHA-256 hash) before it leaves our server, together with your IP address, browser details and Meta cookie values so Meta can match the purchase to your ad click. If you rejected cookies, none of this is sent.
Meta may link this activity to your Meta account under Meta's Privacy Policy. You can also manage ad targeting in your Facebook Ad Preferences.
If you accept, we also use Google Analytics 4 (provided by Google) to understand how visitors find and use the store. It collects:
• Technical & device information: approximate location (worked out from the IP address, which Google Analytics 4 does not log or store), browser, operating system and screen size.
• Browsing & shopping activity: pages visited, tees viewed, items added to the cart or wishlist, checkout steps, completed order values, and sign-ups to drop alerts or accounts.
• Traffic source: the site or campaign that brought you here, for example Instagram or a search engine.
We keep Google signals and ad personalization turned off. We do not send your name, email address, phone number, delivery address or order number to Google Analytics, and we remove personal details from page addresses before they are sent. Analytics data is kept for 14 months.
5. Games
Our free games at /play (Emoji Trials and Clash Arena) need no account. To run them we store:
• Your game name: the name you choose is shown publicly on the leaderboards, in challenge and duel results, and on "ghost" replays other players can race. Please don't use your real name, email or phone number.
• Your game records: scores, answers and answer times, rank, badges, streaks and head-to-head records, linked to your game name (and to your account if you are signed in).
• Your Clash Arena votes: who you picked in each fight, whether you know both fighters, and the deciding factor you chose, linked to your game profile. Others only ever see vote totals, never who voted. Draft Auction practice games stay in your browser and are not stored. For a Daily Draft or a challenge link, your score (and for a challenge, your drafted team) is stored with your game name so it can be ranked.
• Cookies: if you play without signing in, a random guest ID cookie (zt_player, kept for one year) remembers your progress; it moves into your account when you sign in. A short pass cookie (zt_pass, one hour) records that you passed the Cloudflare Turnstile bot check. These two cookies are needed for the game to work, so the cookie banner does not cover them.
Finished games are kept for 24 hours, duels for 2 hours, challenge links for 30 days, and daily scores and ghost replays for 60 days. Your game profile stays until you delete your account, or ask us to delete it at support@zentoku.in. Games award no ZenWallet coins or prizes.
6. Your rights
Under the Digital Personal Data Protection Act you can:
- See and download your data. Sign in, open Profile and press "Download my data".
- Correct your data. Change your name, phone, email and addresses in Profile, or email us.
- Delete your data. Press "Delete my account" in Profile. This removes your personal details, reviews and wishlist. You lose any ZenWallet coins left. We keep your past orders, because we must keep tax and refund records. You cannot delete the account while an order or return is still open.
- Withdraw consent. Use "Cookie settings" at the bottom of any page, or the Unsubscribe link in any drop-alert email. Withdrawing is as easy as giving it.
- Name someone to act for you if you die or cannot act yourself. Email us the person's name and contact details.
- Complain. Write to us first (section 8). If we do not resolve it, you can complain to the Data Protection Board of India.
7. Children
Zentoku is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us their data, email us and we will delete it.
8. Questions and complaints
Our contact for privacy questions and complaints is Aryan Agarwal, support@zentoku.in. We reply within 7 days.
9. Security and breaches
Payments are processed by Razorpay using SSL 256-bit encryption; payment data is handled directly by Razorpay. Passwords are stored scrambled. Our site and database use encrypted connections. If a breach puts your personal data at risk, we will tell you and the Data Protection Board of India as the law requires.
10. Changes to this policy
When we change how we use your data, we will update this page and its date. For changes that need your consent, we will ask you again.