Privacy
ZPad is designed to keep browsing, terminal, bookmark, workspace, and file activity on your Mac. This page describes the app-initiated network calls in the product, what they transmit, why they exist, and how to control them. It does not describe websites, search engines, or download URLs that you choose to open; those services receive the requests you explicitly direct ZPad to make. For warranty, liability, and other license terms, see the EULA.
What stays on your device
- Browsing data. Website data belongs to the in-app WKWebView storage and can be removed from Settings → Privacy → Clear Browser Data.
- Terminal content. Terminal commands, output, and scrollback remain local.
- Favorites, workspaces, tabs, and preferences. Stored locally in app preferences/app-support storage. Explicit custom favorite icons remain usable when dedicated icon fetching is disabled; browser-synced favorite icons are browser-derived data and are removed by Clear Browser Data.
- License key. Stored in your Keychain. License validation itself is offline-first; device management is an explicit network operation described below.
- Clipboard. ZPad never scans the clipboard at launch. Clipboard data is read only through an explicit user action such as Paste or an import command.
1Website icon and logo lookups
ZPad uses the following dedicated providers and request paths:
| Path | Provider | When it is used | What leaves the device |
|---|---|---|---|
| Shared favicon fallback | DuckDuckGo (icons.duckduckgo.com) | A tab, favorite editor, or sidebar host has no local cached icon | The hostname |
| Page-declared icon | The website that declared the icon | A browser page supplies an explicit HTTPS icon URL and no cached icon exists | The URL requested by that page |
The provider and the visited website see the corresponding hostname or requested icon URL plus normal HTTP metadata (including your IP address). Their logs and privacy policies are controlled by those providers. ZPad does not send the full page URL to DuckDuckGo for this dedicated fallback lookup.
2Update checks
What is sent: current app version and build number, plus an anonymous installation ID in a request header. The installation ID is random and is not derived from your hardware serial, Apple ID, name, or license key.
Retention: the update service returns release metadata and does not intentionally persist these request fields in ZPad's application storage. Normal hosting, edge, and network logs may exist for operational/security purposes.
3Purchase configuration
When: you open the purchase sheet. ZPad does not fetch this configuration merely because the app launched.
What is sent: an anonymous installation ID for rollout/pricing selection. The response contains pricing and feature flags and is cached locally for up to six hours.
Control: do not open the purchase sheet. This is a user-initiated purchase flow, not background startup activity.
4Optional usage analytics
What is sent:
- App version/build, macOS version, and device model family
- Anonymous installation ID
- Aggregate display-mode and tab-type counters
- Workspace count, distinct days used, and feature "ever used" flags
- License state and trial day; never the license key
Never sent: visited URLs or search queries, terminal commands/output, file contents/names/paths, email addresses, license keys, your Apple ID, or crash reports. This telemetry payload contains only the aggregate fields listed above.
Retention: up to 90 days in rolling telemetry storage. Raw IP addresses are not written to telemetry objects. To prevent abuse, the service derives a truncated SHA-256 identifier from the source IP and stores only that hash as a rate-limit counter and deletes it at the one-hour expiry with a Durable Object alarm. A separate hashed installation identifier is used for the 24-hour installation limit.
Control: turn Share anonymous usage off. Future collection/upload triggers stop immediately; an upload that was already in flight may complete. Aggregate counters remain local and are never uploaded while the setting is off.
5License device management and recovery
License device reports occur when:
- you enter a valid license key;
- ZPad starts with a locally stored license, so revocation, expiry, and the device limit can be enforced;
- you open Manage Devices, which refreshes and can display the device list; or
- you deactivate a device, which removes that device's activation row.
Lost-key recovery is explicit and submits the email address you enter so the license key can be re-sent.
Device reports send the signed license key, a stable per-install device ID, and a generic device label containing only a hashed identifier (never your hostname or account name). Transient network failures preserve offline use for up to 14 consecutive days; explicit server revocation, expiry, or device-limit decisions are enforced locally.
Inactive activation rows are pruned after 90 days. License issuance records are retained for the lifetime needed to honor and audit the purchase. Operational backups contain purchase/license recovery data but exclude activation rows, so they do not preserve removed device IDs or device labels. You can remove a device from Settings → License → Manage Devices.
6Payments and license email delivery
Checkout currently offers a one-time lifetime license; annual auto-renewing checkout is not offered while subscription self-service is unavailable. Existing annual license records continue to be recognized under their stored terms. Purchases use Stripe's hosted checkout. Stripe receives your email and payment details; ZPad does not see or store your card number. License email delivery uses Resend and sends the email address and license key to your inbox. Their privacy policies apply:
7Referral sharing
ZPad only creates a referral link when you explicitly choose Share. The link includes an anonymous installation ID. If you share it through another app, that app and the recipient can see the link. ZPad does not scan the clipboard at launch, automatically claim a pasted referral, or POST a referrer/invitee relationship from the app.
Automatic startup summary
At first launch after these controls are installed:
- Dedicated favicon/network icon lookups occur only when enabled and a local icon is unavailable.
- An installed license is re-reported to enforce revocation, expiry, and device limits; transient failures preserve a 14-day offline grace period.
- Automatic update checks occur only when enabled.
- Remote purchase configuration is not fetched.
- Clipboard is not read.
- Analytics are not sent unless previously opted in.
- Referral relationships are not submitted.
Children's privacy
ZPad is not directed to children under 13 (or the applicable local age) and does not knowingly collect personal information from children.
Changes and contact
Material changes to this disclosure will ship with an app release and update this date. For privacy or data requests, use the Support Center or the contact provided on your purchase receipt.
Questions? Email [email protected]