Privacy policy

Who is responsible for your data

ZipSync is a sole proprietorship based in California, and is who you are dealing with when you exercise any of the rights below. Reach us through the contact form; it is monitored and it is the fastest route to a human.

The channel we monitor is the contact form. We do not publish an email address, which keeps it away from scrapers; the form reaches us just as reliably and we answer requests through it.

Part 1 — The ZipSync apps

This section applies to ZipSync: Calculator & Units and, on release, ZipSync Challenge Hub.

No account. The apps have no login or registration. We do not ask for your name, email address, or phone number.

Information stored only on your device. Your age, conversion history, saved items, calculator history, counter values, app preferences and any AI API key you enter are stored only on your device, using encrypted storage (iOS Keychain / Android Keystore) or local app storage. This information is never sent to us and never leaves your device except as described below. It is deleted when you uninstall the app.

Your age. On first launch the app asks your age once. It is stored encrypted on your device and used only to decide whether ads can be personalised, in line with children's privacy rules (COPPA and GDPR-K). It is never transmitted anywhere.

Advertising (Google AdMob). The free version shows banner ads through Google AdMob. To serve and measure ads, Google may collect device and advertising identifiers, coarse location derived from your IP address, and ad-interaction data. Ads are non-personalised for users under 16, and non-personalised for anyone who declines tracking. On iOS 14.5+ the app presents Apple's App Tracking Transparency prompt; personalised ads and the IDFA are used only if you allow tracking. Google's handling of this data is governed by Google's Privacy Policy and How Google uses information from sites or apps that use our services. You can reset or limit your advertising ID in your device settings. Buying the one-time Premium upgrade removes all ads.

Optional “Ask AI” feature. If you choose to use Ask AI, you enter your own API key from an AI provider (OpenAI, Anthropic, or Google). Your key is stored encrypted on your device. When you ask a question, the question text is sent directly from your device to the provider you selected, using your own key. We never receive, see, or store your key or your questions. Your use of those services is governed by that provider's privacy policy.

Exchange rates. The currency converter fetches public exchange-rate data from a third-party API (open.er-api.com). No personal information is included in that request.

Inflation figures. The inflation calculator ships with a bundled table of US Consumer Price Index values. When you are online it may request more recent figures from the US Bureau of Labor Statistics public API (api.bls.gov), asking only for the years the bundled table does not already cover. The request carries no key and no information about you, and the calculator keeps working on the bundled data if it fails.

Purchases. The optional Premium upgrade is a one-time purchase processed entirely by the Apple App Store or Google Play. We do not receive or store your payment details; the app only records locally that Premium is unlocked.

Children. ZipSync: Calculator & Units is not directed to children under 13. Users who indicate they are under 16 are shown only non-personalised, age-appropriate ads. ZipSync Challenge Hub is designed for families and includes parental consent for younger players and moderation of any shared photo.

Your choices. You can change your saved age at any time in Settings → Privacy & ads, reset your advertising identifier in your device settings, remove ads by purchasing Premium, and delete all on-device data by uninstalling the app.

Part 2 — This website (zipsync.app)

The website collects a small amount of information that the apps do not. It sets no advertising or analytics cookies, and there is no tracking pixel on any page.

Marketing sign-ups. If you join the ZipSync Challenge Hub waitlist we store your email address, the fact that you ticked the marketing-consent and age-confirmation boxes, the exact wording you agreed to, the version of that wording, and the time you agreed. We keep that record so we can demonstrate that you consented.

What we send, and how often. We email you because you asked us to. Having opted in, you may receive email from us about:

• the launch of ZipSync Challenge Hub;
• new ZipSync app releases;
• significant updates to apps you may already use;
• occasional promotional offers, such as a launch discount.

We do not send on a fixed schedule and we do not email for the sake of it — but this is an ongoing marketing list, not a single announcement. Every email includes a one-click unsubscribe link, and unsubscribing takes effect immediately. You can also ask us to remove you through the support form. We keep your address until you unsubscribe or ask us to delete it.

Age. The waitlist is for people aged 16 and over. We do not knowingly collect email addresses from children. If you believe a child has signed up, contact us through the support form and we will delete the record.

Support messages. If you send us a message through the support form we store the message, your email address so we can reply, and the time it was sent.

Your IP address. To stop automated abuse of these forms we store a one-way hash of your IP address, salted with a secret value. We do not store the address itself and the hash cannot be reversed back into one. It is used only to rate-limit submissions.

reCAPTCHA. Both forms are protected by Google reCAPTCHA, which verifies you are not a bot. To do this, Google collects hardware and software information — including device and application data — and sends it to Google for analysis. This data is used to improve reCAPTCHA and for general security purposes; it is not used for personalised advertising by Google. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

Hosting. The site is hosted on Google Firebase Hosting, and form submissions are processed by Google Cloud Functions. Standard server logs, which may include IP addresses, are generated and retained by Google as part of that service.

What this website never does. Nothing you submit here is sold, shared with advertisers, used to build a profile of you, or used to send you anything you did not ask for. There are no advertising or analytics cookies on any page of this site.

That statement is about the website. The free tier of the app shows ads, and US state privacy law defines “sell” and “share” more broadly than everyday English does — see advertising and “sale” or “sharing”, which sets out what that means and how to opt out. We would rather draw your attention to it than let a tidy sentence here imply something narrower than the truth.

Why we use what we collect

Every purpose we put personal information to, in one table. There is nothing we do with it that is not on this list:

Where the basis is consent, you can withdraw it at any time — by using an unsubscribe link, or by asking through the contact form. Withdrawing does not affect anything done before you withdrew.

How long we keep things

• Waitlist entries — until you unsubscribe or ask us to delete them. If ZipSync Challenge Hub is cancelled, or the list is retired, we delete the whole list.
• Consent records — the proof that you opted in (the wording, its version, and the time) is stored on the same record as your address, so it is deleted at the same time and by the same act. We do not keep a shadow copy of your consent after erasing you. That costs us the evidence we would rely on if someone later complained about having been emailed, and we accept that trade rather than keep data on someone who asked to be forgotten.
• Support messages — up to 24 months after the matter is closed, so we can follow up on a recurring problem.
• Hashed IP rate-limit records — automatically deleted after two hours by a database expiry policy. Nothing about this is manual.
• Anything the app stores — on your device, under your control, deleted when you uninstall.

How it is protected

Data in transit is encrypted with HTTPS, which this site enforces with HSTS. Form submissions never touch the database from your browser: they go to a server-side function that verifies reCAPTCHA, rate-limits, and validates every field before writing anything. The database denies all direct client access outright, so a waitlist address cannot be read from a browser even by someone signed in to our other services. IP addresses are stored only as a salted one-way hash, and the salt is held in a secrets manager rather than in the code.

No system is perfectly secure and we do not claim otherwise. If a breach affects your data and the law requires us to tell you, we will, within the deadline that applies — every US state has a breach-notification statute, and California's requires notice without unreasonable delay.

Where your data goes

Our infrastructure is Google Cloud and Firebase, and the form function runs in the United States. ZipSync is distributed in the United States, so your data stays within it. If that ever changes, this policy changes with it before the distribution does.

Children

ZipSync: Calculator & Units is a general-audience utility and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. Anyone who indicates they are under 16 is served only non-personalised ads.

The waitlist on this site is restricted to people aged 16 or over, and we ask for confirmation before accepting an address. Sixteen rather than the thirteen COPPA requires: ZipSync Challenge Hub is a family app, so its waitlist will attract children, and the conservative threshold is the one that keeps marketing email away from them. It also means nothing has to change here if we later distribute in Europe.

The FTC's amended COPPA Rule has been in full force since 22 April 2026. It widened what counts as personal information — adding biometric identifiers, government identifiers, phone numbers and audio recordings — and requires separate verifiable parental consent before a child's information is disclosed to a third party. Our position under it is that we do not knowingly collect from under-13s at all, and that no child's information is disclosed to any third party.

If you are a parent or guardian and believe a child has given us information, contact us through the contact form. We will delete it and confirm when it is done.

Your rights

Whoever and wherever you are, you can ask us to show you what we hold, correct it, delete it, or stop emailing you. Because the only data this website holds is a waitlist entry or a support message, these requests are usually settled in a single reply. Ask through the contact form.

• Off the waitlist — use any unsubscribe link, or ask. Immediate.
• A copy of what we hold — ask, and we will send it.
• Delete app data — uninstall. Everything the app stores is on your device.

We answer within 30 days, ahead of the 45 days US state privacy laws generally allow. We do not charge for this, and we will not treat you differently for asking.

United States

Twenty-four states now have comprehensive consumer privacy laws, beginning with California's CCPA as amended by the CPRA. Between them they give residents rights to know, access, delete, correct and port personal information, to opt out of its sale or of targeted advertising, to limit the use of sensitive information, and not to be discriminated against for exercising any of that. We extend all of those rights to everyone in the US, rather than checking which state you are in.

Advertising and “sale” or “sharing”. We never exchange anyone's data for money. But under the CPRA and several other state laws, “sale” and “share” are defined broadly enough that serving personalised ads through Google AdMob in the free tier of the app may amount to sharing personal information for cross-context behavioural advertising. We would rather tell you that plainly than rely on a narrow reading. You can stop it in any of these ways:

• set your age or ad preference in the app, under Settings → Privacy & ads — anyone under 16 gets non-personalised ads automatically;
• on iOS, decline the App Tracking Transparency prompt, or turn off “Allow Apps to Request to Track” entirely;
• on Android, turn on “Delete advertising ID” in your device settings;
• buy the one-time Premium upgrade, which removes ads altogether; or
• ask us through the contact form.

We do not sell or share the personal information of anyone we know to be under 16, and we do not collect the categories of sensitive personal information that trigger the right to limit their use. This website itself sells and shares nothing.

Do Not Track and Global Privacy Control

This site sets no advertising or analytics cookies and does no cross-site tracking, so there is nothing here for a Do Not Track or Global Privacy Control signal to switch off. We nonetheless treat a GPC signal as a valid opt-out of sale and sharing, which California requires. In the app, ad personalisation is controlled by your age setting, the ATT prompt on iOS, and your device advertising ID.

Changes

We may update this policy as the apps or the law change. The “last updated” date at the top always reflects the current version. If a change materially affects how we use data you have already given us, we will tell you before it takes effect — by email where we hold your address for that purpose, and otherwise on this page.

Contact

Questions about this policy, or a request about your data? Use the contact form and we will get back to you.

ZipSync — a sole proprietorship in California, and the business responsible for the information described above.