Terms of Use

Last updated: November 12, 2026

Acceptance

These terms govern your use of Zack, provided by RapidRocket GmbH, Switzerland (“RapidRocket”, “we”, “us”). By creating an account, you agree to these terms. If you don't agree, don't use it. Simple.

What Zack Is

Zack is a TOTP authenticator that stores your two-factor authentication secrets and generates one-time codes. It is available for macOS (as a direct download from this website) and for iPhone and iPad (via the App Store). Your vault is end-to-end encrypted and synced between the devices signed in to your account.

Yes, we know: keeping your second factor on the same device you log in from reduces the security benefit of 2FA. Zack is a deliberate trade-off for the many low-risk logins you do every day.

Security Recommendation

We strongly recommend NOT using Zack for high-security accounts such as banking, cryptocurrency, or your primary email account. Use it for the low-risk services where 2FA is more annoying than necessary.

Your Account

An account (email address and password) is required to use Zack. Accounts are managed through Firebase Authentication (Google); Zack never stores your password in plain text. You are responsible for keeping your account credentials and your recovery passphrase safe. Do not share your account. One account per person.

Free Trial

A 3-day free trial starts automatically when you create your account. No payment method is required. When the trial ends, you will not be charged automatically: to keep using Zack, you have to actively start a subscription. What happens to your codes until then is described under “When your trial or subscription ends”.

Subscription & Pricing

Zack costs $5 per month or $40 per year. One subscription unlocks Zack on all devices signed in to your account, regardless of where you bought it. Subscriptions renew automatically at the end of each billing period until you cancel. The final price, including any applicable taxes, is shown before you confirm your purchase.

We won't raise the price of your existing Mac subscription without your consent. We'll ask you at least 30 days before your renewal. If you don't agree, the subscription ends at the end of the paid period. App Store price changes follow Apple's rules.

Billing: Mac (Stripe) and iPhone/iPad (Apple)

  • On the Mac, subscriptions are sold by RapidRocket and payments are processed by Stripe.
  • On iPhone and iPad, subscriptions are purchased through Apple's In-App Purchase and billed to your Apple ID. App Store prices are shown in your local currency and may differ slightly from the prices above. Apple's payment terms apply to these purchases.

You only need one active subscription. If you already subscribe through one channel, please don't subscribe again through the other — we cannot refund App Store purchases.

How you subscribe on the Mac

You choose a plan in Zack and go to a checkout page run by Stripe. There you see the final price, can check and correct your details, and order by clicking the subscribe button. You get a confirmation email. The contract language is English. These terms are always available at getzack.app/terms.

Cancellation

  • Mac (Stripe) subscriptions: cancel anytime via “Manage Billing” in the Mac app, which opens the Stripe customer portal, or on getzack.app/cancel without signing in.
  • App Store subscriptions: cancel anytime in your Apple ID subscription settings (on iPhone or iPad: Settings › your name › Subscriptions). We cannot cancel App Store subscriptions for you.

After cancelling, you keep access until the end of your current billing period. Apart from a withdrawal (below), no partial refunds are issued for unused time within a billing period.

When your trial or subscription ends

For 14 days your codes stay readable. You can view, copy and export them, but not add, edit or delete entries. After that, Zack only offers to subscribe or to export your keys. Exporting your keys always stays possible.

Unused accounts

If your account has no active subscription and no Zack app has used it for 12 months, we delete it with all its data. We email you after 11 and after 12 months, and we delete no earlier than 14 days after the second email. Opening Zack and signing in keeps your account. We never delete an account with an active subscription for inactivity.

Withdrawal and refunds

  • Mac (Stripe) purchases: within 14 days of your first purchase you can withdraw without giving a reason and get a full refund. Write to hello@getzack.app or use getzack.app/cancel. For consumers in the EU, the EEA and the UK this is your statutory right of withdrawal: the period ends 14 days after the day you subscribed, and sending your notice before then is enough. We refund all payments within 14 days of receiving it, to your original payment method and at no cost to you. Your subscription ends when we receive it. Model form: “To RapidRocket GmbH, Rämistrasse 2, 8001 Zürich, Switzerland, hello@getzack.app: I hereby withdraw from my contract for the Zack subscription ordered on [date]. Name, email address, date.”
  • App Store purchases: refunds are handled exclusively by Apple. You can request one at reportaproblem.apple.com. RapidRocket cannot issue refunds for App Store purchases.

Mandatory consumer rights under applicable law remain unaffected.

Account Deletion

You can delete your account at any time in the app (settings menu › “Delete Account”) or by emailing hello@getzack.app. Deleting your account immediately and permanently deletes your account and all of its data on our servers, including your encrypted vault, and cancels an active Stripe subscription at once. Unless you are still within the 14-day withdrawal period, we don't refund the rest of the paid period. App Store subscriptions are not cancelled automatically — please cancel them in your Apple ID settings. Deleted data cannot be restored.

Your Data & Encryption

You own your data. Your TOTP secrets are encrypted on your device with AES-256-GCM before they are synced. The vault key is generated on your device and stored in the device Keychain. Our servers only store encrypted data; we cannot decrypt, read, or recover your vault.

Your recovery passphrase encrypts your vault key so that you can unlock Zack on a new device. You can also set up a new device by scanning a QR code from a device that is already unlocked. If you lose access to all your devices and forget your recovery passphrase, your vault data is permanently unrecoverable. This is by design — it means no one, including us, can access your secrets without your key.

Details on what we process and why are in our Privacy Policy.

Acceptable Use

Use Zack only for accounts you are authorized to access and only in compliance with applicable law. Don't attempt to disrupt, overload, or gain unauthorized access to our services or other users' data, and don't circumvent the subscription or trial mechanisms. We may suspend or terminate accounts that violate these terms. If we do, we tell you why, as described under “Content and moderation”.

Content and moderation

Your vault holds only what you put in it, and it is encrypted on your device. Nobody else can see it, and neither can we. So we don't review or moderate its contents, by hand or automatically. Don't store anything illegal in it.

If an authority orders us to, or if we learn that an account is used for illegal purposes, we can delete that account's data or suspend the account. Unless the law forbids it, we tell you by email what we decided, why, and on which rule or law it is based. You can ask us to look at it again by replying to that email or writing to hello@getzack.app, and you can also take the matter to court.

Reporting illegal content

If you believe a Zack account stores illegal content, write to hello@getzack.app. Please tell us why you think it is illegal and how we can identify the account. We need your name and email address, except for reports of child sexual abuse material. By reporting, you confirm that your report is accurate and complete to the best of your knowledge. We confirm that we received your report, decide promptly, and tell you what we decided.

Contact points (Digital Services Act)

  • For authorities (Art. 11 DSA): the single point of contact for the authorities of the EU Member States, the European Commission, and the European Board for Digital Services is dsa@rapidrocket.com. You can write to us in English or German.
  • For users (Art. 12 DSA): write to hello@getzack.app. A person reads and answers every message.

Availability and your backups

Zack generates codes on your device and works offline. Our servers are needed for your account, sync and subscription. We work to keep them available but cannot promise uninterrupted service. You decide which accounts to manage with Zack. When you turn on 2FA for a service, keep the backup codes that service gives you, separately from Zack. If you lose all your devices and your recovery passphrase, we cannot recover your vault, and only those backup codes will get you back into your accounts.

If we discontinue Zack

We'll tell you by email at least 90 days before our servers stop. Export Keys keeps working until then and afterwards too, because it runs offline from the copy on your device. For a Mac (Stripe) subscription, we refund the prepaid time after the shutdown date pro rata. We can't refund App Store purchases ourselves; for those, you can request a refund from Apple.

Liability

We are liable without limitation for intent and gross negligence, for injury to life, body or health, and wherever mandatory law requires it. For slight negligence, we are liable only for breaching obligations essential to the contract, and only for the typical, foreseeable damage. Otherwise, we are not liable for slight negligence. Your statutory rights as a consumer, including warranty rights for digital content and digital services, are not affected.

Apple App Store

If you downloaded Zack from the App Store, Apple's Licensed Application End User License Agreement (Standard EULA) applies in addition to these terms. Apple is not a party to these terms and is not responsible for Zack or its support.

Changes

We'll email you about changes to these terms at least 30 days before they apply, and update the date above. If a change is to your disadvantage, you can cancel before it applies. Changes to the price or to the core of the service need your consent.

Governing Law

Swiss law applies, excluding the UN Convention on Contracts for the International Sale of Goods. If you are a consumer, you keep the protection of the mandatory law of the country where you live. The courts of Zürich have jurisdiction; as a consumer you may also sue in the courts where you live and can be sued only there.

Contact

RapidRocket GmbH, Rämistrasse 2, 8001 Zürich, Switzerland
For questions, contact us at hello@getzack.app. More about us in the legal notice.