Privacy Policy

Last updated: November 12, 2026

The short version

Your TOTP secrets are end-to-end encrypted. We cannot read them, even on our own servers. We store the minimum needed to run your account, your subscription, and encrypted sync. Payments are handled by Stripe (Mac) or Apple (iPhone and iPad). No analytics, no advertising, no tracking — in the apps or on this website.

Who is responsible

RapidRocket GmbH, Rämistrasse 2, 8001 Zürich, Switzerland, is responsible for the processing described here. Contact: hello@getzack.app.

This policy follows the Swiss Federal Act on Data Protection (FADP), for people in the EU and the EEA the General Data Protection Regulation (GDPR), and for people in the United Kingdom the UK GDPR.

What we store on our servers

When you create an account and use Zack, we store:

  • Account data: your email address, your user ID, the time your account was created, and when you last signed in. Your password is handled by Firebase Authentication, which stores only a hash of it; it is never stored in plain text.
  • Subscription data: trial end date, subscription status, plan and current period end, billing source (trial, Stripe, or Apple), and — depending on where you subscribed — your Stripe customer ID or your App Store original transaction ID.
  • Encrypted vault: your vault entries as encrypted ciphertext, plus for each entry its visibility flags (show on Mac / show on iPhone) and timestamps.
  • Encrypted vault key: your vault key, encrypted with your recovery passphrase, so you can unlock Zack on a new device.
  • Device setup sessions: when you set up a new device by QR code, a short-lived pairing session with the device names, public keys, and an encrypted key envelope. These sessions expire after 5 minutes. As soon as a session is used, its keys and encrypted envelope are removed; expired sessions are deleted automatically, usually within 24 hours, and immediately when you delete your account.

Server logs: when the apps talk to our backend, Google processes technical connection data such as your IP address and app version to deliver the service and protect it against abuse. Our logs also record your user ID and, for purchases, your Stripe customer ID or App Store transaction ID. They are deleted after 30 days. Firebase Authentication keeps the IP addresses of sign-ins for a few weeks.

What we cannot access

Your TOTP secrets, account names, issuers, and generated codes are encrypted on your device with a key that never leaves your devices unencrypted. Our server stores only opaque encrypted blobs. Even in the event of a server breach, your vault data cannot be decrypted without your vault key or your recovery passphrase. We never receive your recovery passphrase.

Encryption details

  • Vault: each entry is encrypted on your device with AES-256-GCM using a random 256-bit vault key that is generated on your device and stored in its Keychain.
  • Recovery: your recovery passphrase encrypts the vault key (PBKDF2-SHA256 with 600,000 iterations + AES-256-GCM). Only this encrypted key is stored on our server. Without the passphrase, it is useless.
  • Device setup by QR code: an already unlocked device hands the vault key to the new device end-to-end encrypted. Our server only relays the encrypted envelope.
  • In transit: all connections use HTTPS/TLS.

On your device

Your vault key and sign-in session are stored in your device's Keychain. If you opt in, Zack also backs up your recovery passphrase to your own iCloud Keychain; it is stored by Apple in your iCloud account, not on our servers. If you enable the Touch ID, Face ID, or passcode lock, authentication is performed by your device's operating system; Zack never receives biometric data.

Payments

Stripe processes payments for subscriptions bought on the Mac. Apple processes In-App Purchases on iPhone and iPad. Stripe processes payments on our behalf and, for its own purposes such as fraud prevention and legal compliance, as an independent controller. Apple acts as an independent controller. Both have their own privacy policies (Stripe, Apple). Zack never sees your full card or payment details. We only receive what is needed to unlock your subscription: subscription status, plan, period end, and the Stripe customer ID or App Store transaction ID. To link a payment to your account, we give Stripe your email address and your Zack user ID; Apple receives an account token derived from your user ID, which does not reveal your email address.

At Stripe's checkout you confirm that you accept our terms; Stripe records that confirmation with your purchase. After a purchase on the Mac we send you a confirmation email.

Cancelling or withdrawing on this website

On getzack.app/cancel you can cancel a Mac subscription or withdraw from it without signing in. You enter your email address. We confirm right away that we received the request, and if that address has an active Mac subscription, we send a link that is valid for 24 hours to confirm it. For the request we store your user ID, your Stripe customer and subscription IDs, whether you cancel or withdraw, its status and times, and any refund amount, but not your email address or IP address. We delete this record 30 days after the request. To stop abuse, we count requests per IP address and per email address under a keyed hash that can't be reversed without our secret key; this is pseudonymous, not anonymous, and is deleted within two days. Copies of the emails stay in our mailbox, as described under Google Workspace below.

Service providers and international transfers

Google (Firebase) – our backend runs on Google Firebase (Firebase Authentication, Cloud Firestore, and Cloud Functions). Google acts as our processor. Your account record, subscription data, and encrypted vault are stored in Cloud Firestore in the European Union (multi-region eur3). Firebase Authentication, which holds your email address and password hash and sends password reset emails, runs only in data centers in the USA. Cloud Functions, which check your subscription and handle device setup, run in Google's us-central1 region in the USA. So your data is also transferred to and processed in the USA.

Google Workspace – our email. If you write to us, your message is stored in our mailbox. We also send account emails through it, such as purchase confirmations, cancellation and withdrawal confirmations, and the notices before we delete an unused account, and keep a copy of each in our mailbox for 24 months.

Vercel – hosts this website. When you visit it, Vercel processes standard server log data (such as IP address and browser type) to deliver and secure the site. The Mac app checks for updates once a day by loading a small file from this website; that request shows Vercel your IP address and the app version, and carries no account data. If you use the password reset pages on this website, your browser sends your email address or reset code and your IP address directly to Firebase Authentication (Google, USA).

Transfers to the USA are safeguarded by the Standard Contractual Clauses and/or the provider's certification under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework.

Analytics & tracking

None. The Zack apps contain no analytics, advertising, or tracking SDKs. This website uses no cookies, no analytics, and no tracking scripts.

Why we process your data

We process your data to provide the service you signed up for (account, sync, subscription) and to keep it secure and free of abuse. Where we are legally required to keep billing records, we do so only as long as required. Under the GDPR and the UK GDPR, our legal bases are:

  • Our contract with you (Art. 6(1)(b) GDPR and UK GDPR): your account, sign-in and password reset, encrypted sync, device setup, your trial and your subscription, and the emails about them.
  • Our legitimate interest in a secure, reliable service and in answering you (Art. 6(1)(f) GDPR and UK GDPR): server logs, protection against abuse (including the request counts on the cancellation page), emails you send us, and the server logs of this website.
  • Legal obligations (Art. 6(1)(c) GDPR and UK GDPR): billing and accounting records, and handling your cancellation or withdrawal.

We use your email address for your account and to contact you about your account or subscription. We do not send marketing emails without your consent, and we never sell your data.

Retention and account deletion

We keep your data for as long as your account exists. An account with an active subscription is never deleted for lack of use. If an account has no active subscription and no Zack app has signed in to it for 12 months, we email you after 11 and after 12 months and delete the account with all its data no earlier than 14 days after the second email. Opening Zack and signing in keeps your account. Until then, you can export your keys in the app, also after your trial or subscription ended.

You can delete your account at any time in the app (settings menu › “Delete Account”). This immediately deletes your account and all of its data on our servers, including your encrypted vault, except our email correspondence and billing records as described below, and cancels an active Stripe subscription. App Store subscriptions must be cancelled by you in your Apple ID settings. You can also request deletion by emailing hello@getzack.app.

Server logs are deleted after 30 days, cancellation requests 30 days after they were made. Google removes the remaining copies of a deleted account from Firebase Authentication's backup systems within 180 days. Payment and invoice records stay with Stripe for 10 years, as Swiss accounting law requires (Art. 958f of the Code of Obligations). Emails you send us are kept for 24 months after our last exchange, unless we need them longer to establish or defend legal claims.

Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR or the UK GDPR, you have the right to access your data, to have it corrected or deleted, to restrict its processing, and to receive it in a portable format. Where processing is based on legitimate interest, you can object to it. To exercise these rights, email hello@getzack.app.

You need an email address and a password to create an account; without them we cannot provide Zack. We make no automated decisions with legal effect on you. Unused accounts are deleted under the fixed rule above, and you can prevent that by using Zack.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of the country where you live or work, and in the United Kingdom the Information Commission (ICO).

Changes

We may update this policy when Zack changes. We will update the date above when we do and inform you about significant changes, for example by email.

Contact

RapidRocket GmbH, Rämistrasse 2, 8001 Zürich, Switzerland
For privacy questions, contact us at hello@getzack.app