Privacy notice
Last updated: 20 October 2026
This notice covers the ZigZag app for iOS and Android, published by The Stolen Spot S.r.l. The available features depend on the installed version: ZigZag includes maps, place search, parking and information on restricted traffic zones (ZTLs); some versions also include vehicle access checks, navigation, reports and Pro services. We process the data described here only when the relevant feature is present and used.
1. Data controller and contact details
The data controller is The Stolen Spot S.r.l., Via Fontanabrolo 11, 24128 Bergamo (BG), Italy. For questions, requests concerning your data or to exercise your rights, you can email info@thestolenspot.com.
2. Data we process
Account and profile
When the app creates an anonymous identity or you sign in with Apple or Google, Firebase Authentication processes a user identifier. If you choose to sign in with an account, we may receive the name, email address and profile image supplied by the sign-in service. Profile features may retain the username and information needed to manage the account.
Location, places and routes
With your permission, the app uses your device’s location to centre the map, search nearby and, where available, calculate or follow a route. Place searches, the coordinates needed for the map and route, and requested destinations may be transmitted to Mapbox. Its SDK may send location and usage data to Mapbox for telemetry; you can turn this off through the Mapbox attribution control on the map. ZigZag navigation features, when active, send our services the location and data needed to plan, verify and update the route. If you share a link to a place, the link contains the name and coordinates of the chosen place: recipients can read them. The service that redirects the link may process the usual technical data of the web request.
Vehicle and ZTL checks
If you complete a vehicle profile, the app stores the data you enter on the device, such as category, fuel type, emission class, weight where needed, and declared permits or authorisations. When you request a personalised answer about a ZTL or a route, it transmits to our services the vehicle and permit data needed for the check, the requested place or zone, and the requested time. We do not ask you to enter a number plate for this check.
Optional number-plate lookup
You can choose to enter an Italian number plate and vehicle type to retrieve emission class and CO₂ through a third-party vehicle-data provider. Manual entry is always available. The plate and vehicle type are shared with the provider when needed for your requested lookup; the plate is not sent to the service calculating ZTL access. You must enter the fuel type yourself.
In updated versions the plate is used during lookup and is not saved in the vehicle profile or drafts: the detailed Euro class, CO₂ value and data provenance are retained. Earlier versions may have stored the plate on your device; updating does not automatically erase those existing records. The service temporarily caches successful results for up to 30 days and technical request records for two days, using pseudonymous request identifiers; it does not retain the plain-text plate in application logs. Account deletion also requests removal of these associated records; physical removal of expired records depends on the storage service. You can exercise your rights using the contact details in this notice.
The plate and vehicle type are needed only if you request this optional lookup. ZigZag does not share your account identifier or authentication tokens with the vehicle-data provider. The provider may process the request and technical data under its own rules: we cannot promise that it does not record them or that it erases them when ZigZag data is deleted. The feature does not retrieve or return the registered keeper’s name and does not certify vehicle ownership.
Purchases and subscriptions
If you view or use ZigZag Pro, Apple or Google handles payment. To display offers, verify access entitlements, and manage purchases and restores, versions of the app may use RevenueCat or, in earlier versions, Superwall. These services process app or account identifiers and information about products, transactions and subscription status. We do not receive your full payment card number.
Tracking permission on iOS
The iOS version that includes Mapbox Search may transmit usage data to Mapbox. The included SDK declares to Apple a domain used for tracking across other companies’ apps and websites. In versions with the new onboarding, ZigZag requests App Tracking Transparency (ATT) permission after the vehicle step, even if you choose to complete that step later. For people who update the app or have not yet made a choice, the request is also made from the main screen when the app is active and the introduction is not in progress. A choice already recorded by iOS is not requested again. If permission is not granted or remains undetermined, ZigZag turns off Mapbox telemetry: place search and favourites do not depend on tracking consent. ATT consent does not automatically reactivate telemetry that has been turned off; you can manage it through the Mapbox attribution control and change your ATT choice in iOS privacy settings. Requests needed to provide maps, search and routes remain separate from tracking. Advertising campaigns involving any additional measurement providers will require an update to this notice and the App Store declaration before activation.
Reports, usage and security
In versions that include feedback links, you can choose to open public boards hosted by Fider for bugs, improvements or ZTL corrections. Signing in to a board is separate from signing in to the app and may use Google or a code sent by email. Fider processes sign-in data and notification preferences; the profile name, content you publish, comments and votes may be visible to other visitors. For a ZTL correction, the link may include the ZTL’s name as a search term. Participation is optional. See also the Fider privacy notice.
Versions that allow reports may receive the text, specified location, attached images, time and account identifier. Firebase App Check and our services process technical data needed to prevent abuse and maintain the service, such as app attestations, IP addresses, technical identifiers and request or error logs. Map and purchase providers may process additional technical data under their respective privacy notices.
Onboarding and app usage analytics
In versions that include the new measurement, ZigZag uses Google Analytics for Firebase to understand app usage and improve it: first use, sessions, introduction steps and completion, adding a vehicle without its details, the demonstration tour, offer presentation, the outcome returned by the store, subscription status, search use, opening places and ZTLs, favourites, settings and navigation. The versions and offerings actually presented let us compare variants and experiments. A free trial, a purchase attempt and an actual payment are different outcomes.
Events may include dates and times, pseudonymous installation identifiers and, after a personal sign-in, an identifier derived from the internal account ID, iOS or Android operating system, app version and build, language, technical device information, and feature or subscription status. The SDK may collect standard session and purchase events and infer approximate location from network information. An installation identifier connects sessions on the same device; an account identifier may connect devices using the same account. Installations without personal sign-in do not guarantee recognition of the same person across devices or after reinstalling.
Our product analytics code does not send names, email addresses, phone numbers, licence plates, vehicle names or characteristics, ZTL permits, search text, addresses, destinations, precise GPS coordinates or route geometry. It does not record the screen, audio or typed content. The data is pseudonymous and is not described as universally anonymous. RevenueCat may receive the Firebase installation identifier to connect usage analysis with the subscription information that provider already manages.
The new Firebase measurement is for product analytics: advertising identifier collection, advertising personalisation and sending user data to Google for advertising purposes are disabled in this integration. This integration does not activate a Google Ads link or a new campaign. ATT choices and advertising measurement through the other providers described below remain separate; ATT is not presented as general consent to product analytics. Google explains its processing in How Google uses information from sites or apps that use its services.
We may inspect events and statistics through Google's APIs and a daily BigQuery export, with private access limited to the people operating ZigZag. The BigQuery dataset is configured in the European Union; this does not mean all Google Analytics processing takes place exclusively in the EU. For data requests and to exercise your rights, including objection to processing based on legitimate interest, email info@thestolenspot.com.
Advertising campaign measurement
In iOS versions where advertising measurement is enabled, ZigZag uses AppsFlyer to understand which campaigns lead to installations and subscriptions. In updated versions, AppsFlyer measurement may start when the app opens even without ATT permission, without collecting the IDFA advertising identifier. When ATT is authorised, IDFA may also be used. Data without IDFA may be used through aggregated or modelled measurement paths supported by AppsFlyer and its partners; this does not necessarily make the data anonymous. Data processed may include device, installation and account identifiers, IP addresses, technical device and app information, and data about installations, sessions and purchases. RevenueCat links subscription events to the AppsFlyer identifier and transmits its own customer identifier, events and related amounts and currencies to measure campaign results. AppsFlyer may transmit installation and subscription events to TikTok and installation, app-open and subscription events to Meta for Facebook and Instagram campaign measurement, including organic installations according to the partner configuration. Our attribution code does not transmit vehicle data, ZTL permits, destinations or routes to these services as advertising events.
Regardless of the ATT choice, enabled iOS versions may use Apple’s SKAdNetwork system for advertising measurement. The app sends Apple a limited value distinguishing a new free trial from a new paid subscription; this operation does not add customer or device identifiers. Apple manages attribution reports, delays and the limits on detail needed to protect privacy. Reports may be received by TikTok and Meta and decoded by AppsFlyer to evaluate campaigns. Actual purchase amounts remain separate from this value.
You can deny or revoke ATT permission in iOS privacy settings. App features and purchases remain available. Revocation is detected the next time the app is opened or checked before a purchase: IDFA is excluded from subsequent transmissions, while measurement without IDFA and SKAdNetwork may continue. Revocation does not automatically delete events already transmitted. Updating information held by RevenueCat requires an available connection. The configuration described does not activate AppsFlyer on Android.
3. Why we process data
- Provide the optional plate lookup you request and return environmental details (performance of the requested service, GDPR Article 6(1)(b)). Limited retention of cached results and pseudonymous records reduces repeated requests, handles failures and prevents abuse (legitimate interests, GDPR Article 6(1)(f)). You can avoid lookup by entering the details manually.
- To provide the features you request: account, maps, search, ZTL answers, routes, reports and Pro access (performance of the requested service).
- To protect accounts, infrastructure and the app from errors and abuse, and improve the service using technical data and, in versions that include it, usage data (legitimate interest, within the limits permitted by law).
- To allow usage data to be sent, only when authorised through ATT, to the domains declared by the integrated SDK for tracking across other companies’ apps and websites (consent).
- To measure our advertising campaigns in enabled iOS versions: through AppsFlyer and RevenueCat, with IDFA when ATT is authorised and through supported measurement paths without IDFA when it is not, alongside the limited reports managed by Apple’s SKAdNetwork. These paths have different availability and levels of detail.
- To meet tax, accounting and rights-protection obligations related to purchases (legal obligation or legitimate interest, depending on the case).
Device location is optional: you can deny or revoke permission in iOS or Android settings. Without location, features that require your current location may not work; you can still use the features available without that permission.
4. Providers and transfers
For plate lookup we use technical providers for processing, authentication and private storage, and a third-party vehicle-data provider to retrieve Euro class and CO₂. We do not control the data provider’s independent processing. We remain responsible for the processing we carry out for ZigZag. You can contact us for information about recipients and to exercise your rights.
We use providers needed for the app to function: Firebase/Google for identity, app data, security and, in versions that include them, Analytics and report files; Mapbox for maps, search and routes; and RevenueCat or Superwall for offers and subscriptions. Apple and Google process purchases under their own privacy notices. Data may also be processed outside the European Economic Area, under the safeguards applicable to each provider. We do not sell your personal data.
For the advertising measurement described above, in enabled iOS versions, we also use AppsFlyer, TikTok and Meta. Measurement is separate from the services needed to use ZigZag and purchase a subscription. To check or request deletion of data associated with this purpose, you can contact us as described in the following sections.
5. Retention and deletion
The Google Analytics property settings specify two months for event data and fourteen months for user-level data, with the user retention period renewed by new activity. Aggregate statistics have separate retention rules. In the BigQuery sandbox used for the new export, event tables expire after sixty days. Private extracts are retained only as long as needed for analysis and operation of the service, with restricted access. Deleting an account in the app does not automatically remove all events already sent to these services: you can request review and deletion, where applicable, through the contact details provided.
Vehicle data, permits and searches saved locally remain on the device until you delete them or remove the app’s data. Account data is retained while the account is active or for the time needed to complete a deletion request. Reports and technical, analytics and security data are retained for the time needed for the stated purposes, according to the settings and limits of the services used. Purchase information may be retained longer where required by law or to manage disputes and contractual rights.
If your version of the app offers Delete account, you can use it to request removal of the identity and profile managed by ZigZag. You can also follow the online instructions to request deletion of your account and associated data. To check and delete any other associated data, including reports and data held by providers, email info@thestolenspot.com. Deleting an account does not automatically cancel an active subscription: manage it in App Store or Google Play settings. Some transaction data remains with stores or providers for their obligations.
6. Your rights
You can request access, correction, deletion, restriction and portability where applicable, and object to processing based on legitimate interest. You can also withdraw consent you have given, without affecting processing already carried out. Email info@thestolenspot.com to exercise these rights. You also have the right to lodge a complaint with the Italian Data Protection Authority or the competent authority in your country.
7. Minors and updates
ZigZag is not designed specifically for children, but may also be used by minors interested in maps and ZTLs. The app does not check age at startup: the data categories and providers described above also apply when it is used by a minor. For requests concerning a minor’s data, or if you believe it has been processed improperly, contact us at info@thestolenspot.com. We will update this page when features or data processing change materially; the date above indicates the latest revision.
To find out what data a specific feature in your app version processes, email us with iOS or Android and the version number.