When an app requests a permission, it is really making a promise: it will use that access only for what it says. But in practice most apps ask for far more than they need to do their job. Zerolog's approach is the reverse: it asks only for the permissions it truly needs to function, and touches nothing beyond that.
In this post we cover which permissions Zerolog asks for and why, which data it never collects, and how to read a data-safety disclosure in an app store.
Every permission should have a reason
A good permission is requested only when it enables a concrete function. A bad permission is collected in advance "in case it is useful later." Zerolog believes only in the first kind. Every permission it asks for has a counterpart tied directly to the app's core promise.
At the heart of Zerolog is messaging without the internet, device to device. That makes some permissions necessary; but all of them serve local communication, not tracking you.
The permissions Zerolog asks for, and why
The Bluetooth permission is required for Zerolog's most fundamental feature. Two devices finding each other and exchanging messages without the internet happens over Bluetooth Low Energy. Without this permission, offline messaging and offline games cannot work. Bluetooth is used here only to talk to the paired device near you.
Local network access is the second leg of that same offline communication. Two devices on the same Wi-Fi network can deliver messages to each other directly, without traveling the world over the internet. This permission is for finding paired devices on the local network; not for sending data outward.
Your phone number is used only for verification. It helps confirm that your account belongs to a real person, and it is not stored. Your number is never used to build an advertising profile, suggest you to others, or track you.
Microphone access comes into play only when you make a peer-to-peer voice call. Unless you start a voice call, it is not used.
The notification permission is so you are informed when a message or call arrives. Its purpose is to deliver communication on time; not to read content or measure your behavior.
What these permissions share is this: they all exist to make communication possible, and none of them is used to track you. You can see how they work in more detail on the how it works page.
What Zerolog never collects
The best way to understand an app is to look at what it does not ask for. Zerolog never collects:
- Advertising ID — there is no identifier tracking you across ad networks
- Location — where you are is not recorded
- Contact list — your address book is not accessed
- Analytics — your behavior is not measured or profiled
- Message content — servers never see what you write
All of this is a deliberate choice. Messages are end-to-end encrypted, and the encryption keys stay only on your device. Because servers cannot see your message content, there is no content to collect. It rests on the idea that the safest data is the data that cannot leak: a record that does not exist cannot be stolen.
How to read a data-safety disclosure
Both the App Store and Google Play provide a data-safety section where each app declares which data it collects. Reading this section is the most practical way to decide whether to trust an app. A few tips:
First, look at the distinction between "data collected" and "data linked to you." An app may be collecting data, but what really matters is whether it ties that data to your identity.
Second, look for items like location, contacts, advertising ID, and usage data. A messaging app does not need most of these. A long list of collected data is often a warning sign.
Third, check the "shared with third parties" section. Where your data goes matters as much as whether it is minimized.
Zerolog keeps these disclosures simple, because there is not much to collect. How little an app declares is often the most honest indicator of how respectful it is. You can read all of these principles on the privacy page.
Asking for less is protecting more
Minimal permissions are not a marketing slogan but an engineering decision. The less data an app touches, the less can go wrong. Data that is never collected cannot be leaked, sold, or used against you.
Zerolog is compliant with KVKK and GDPR, and that compliance is not a layer added later but a design principle present from the start. Whispers between devices leave nothing behind; permissions not requested and data not collected are part of that promise too.
Trusting an app is ultimately measured by how little you are forced to give it. Zerolog was designed to keep that amount as small as possible.