Zeptap is made by Afterlume Labs, Bengaluru 560010, India ("we"). We decide how and why the personal data described here is used. This policy covers the Zeptap Mac app, zeptap.com (including the blog and docs), licensing, payments and support. The short version: your iPhone's screen, what's typed on it and your passcode stay on your Mac. We never see them.
Questions or requests: support@zeptap.com. That address is also our grievance contact for users in India.
What stays on your Mac
- The iPhone screen, captured over USB, and the text Zeptap reads from it (on-device, with Apple's Vision framework).
- Everything you or an agent types, taps or says in the built-in chat.
- Your device passcode, if you save it for local unlock. It's kept in the macOS login Keychain, never synced to iCloud, and never given to agents.
- API keys you enter for the built-in chat (for example, an OpenRouter key), also in the login Keychain and only used to call that provider.
- Recordings and screenshots you save.
The MCP server runs on your Mac and only accepts connections from it. Other software on your Mac may be able to reach it, so only install software you trust.
Your AI provider
Zeptap doesn't include an AI model. When you connect an agent (Claude Code, Codex, Cursor or others) or use the built-in chat, that agent's model provider receives the screenshots, screen text and instructions it needs to do what you asked. It may process them on its own servers, possibly in other countries, under your agreement with that provider. Check its retention and training settings before you connect it.
Your screen may show passwords, verification codes, messages, financial or health information, or other people's information. A connected agent can see whatever is on screen. Zeptap doesn't automatically hide sensitive content or ask for approval before every action.
Zeptap provides tools for phone control. You select the agents, accounts, permissions and instructions. Making an action technically possible doesn't mean Afterlume Labs authorizes or endorses it, and we don't undertake to monitor or approve every use. This doesn't exclude responsibility that applicable law places on us.
The technical details are in the privacy and security docs.
What we do collect
Purchases
Payments are handled by Dodo Payments, our merchant of record. Dodo collects your name, email, billing address and payment details, and shares your name, email, billing country, license key and order details with us so we can deliver your license, keep tax records and support you. We never see your full card number.
License checks
To activate and re-check your license, the app sends your license key and this Mac's activation ID to Dodo's license service at launch and about once a day. To enforce your plan's device limit, it sends our server a one-way hash of each iPhone's identifier, the name you gave the device, its model, and a hashed form of your license. We also record when each device was added, last seen or removed.
Usage stats and crash reports
The app sends usage events (which features and tools are used, how long things take, whether they worked, the app and macOS versions, the Mac and iPhone models, and which agent is set up) and crash reports (crashes, freezes and errors, with the app's last few usage events leading up to them). They carry a random install ID, not your name or email, and we don't build a profile linked to you. They go through our server, which may note the approximate location (city, region, country) of the request and then drops your IP address before passing them to PostHog, our analytics provider.
They never include screen contents, OCR text, typed text, chat messages, tool arguments, device or Mac names, hardware identifiers, Bluetooth addresses, passcodes or license keys. Both are on by default, and you can switch either off at any time in Settings › Preferences.
The website
zeptap.com uses PostHog to understand how people find and use the site. It records the pages you view, where you came from, clicks (including download and checkout clicks), your browser, device, screen size and language, and your approximate location (worked out from your IP address). It may also record your session (mouse movement, scrolling and clicks on the page) so we can see where the site is confusing. Text you type into fields is masked. PostHog stores a random ID in a cookie and in your browser's local storage so repeat visits count as the same visitor.
zeptap.com is served by Cloudflare, which processes standard request data such as IP addresses to deliver and protect the site.
Support and problem reports
- Settings › Support emails us your message, your email if you add one so we can reply, diagnostics (app and macOS versions, Mac and device models, plan) and up to five attachments, through Cloudflare's email service.
- "Still stuck?" reports during setup send what you write and the connection details the form lists before you send it to PostHog, the same way as usage stats.
Nothing is sent unless you press Send. Attachments can contain information about you or other people, so avoid sending screenshots with passwords, payment details or private messages.
Updates and phone pictures
The app checks for updates once a day against a feed hosted on GitHub. The first time you connect a device whose pictures aren't built into the app, it downloads them from zeptap.com. Both see your IP address like any web request.
Why we use it (EU, EEA and UK)
- Contract: purchases, license activation, device limits and support.
- Legitimate interests: keeping Zeptap reliable (usage stats and crash reports), understanding how the website is used, preventing license abuse and fraud, securing our systems and answering questions. We keep this data minimal, don't link it to your identity, and let you opt out.
- Legal obligation: tax, accounting and other records the law requires.
- Consent: where the law requires it, for example for certain cookies. You can withdraw consent at any time.
Buying a license needs purchase and license data. Usage stats, crash reports and support attachments are always optional.
Who we share data with
- Dodo Payments: payments, tax, invoices and license keys.
- Cloudflare: hosting for the website and our license server, our database and support email.
- PostHog (EU region): website analytics and session recordings, and the app's usage stats, crash reports and setup reports.
- GitHub: app downloads and update checks.
- Our email provider: email you send us.
We don't sell personal data, and we don't share it for advertising. We may also disclose it to professional advisers, to comply with a valid legal request, to protect our rights or people's safety, or as part of a merger or sale of the business, in which case this policy keeps applying to your data.
International transfers
We're based in India, and our providers operate in other countries, including the United States and the EU. Where the law requires safeguards for transfers, we rely on adequacy decisions, Standard Contractual Clauses or equivalent terms in our providers' agreements. Email us to ask which apply.
How long we keep it
- Orders and invoices: 8 years, for tax and accounting law.
- License, Mac and device records: while your license is active, plus 2 years.
- Removed devices: 30 days after removal.
- Usage stats, crash reports and setup reports: up to 12 months.
- Website analytics: up to 12 months; session recordings up to 90 days.
- Support email: up to 2 years after the issue is resolved.
- Server logs: up to 30 days, unless needed to investigate a security incident.
We may keep data longer if the law requires it or to handle a dispute. If deleting your data would stop us recognizing a lifetime license, we'll tell you first.
Your choices and rights
- Turn off usage stats or crash reports in Settings › Preferences.
- Remove a device from your license in Settings › License. Removing a device doesn't cancel a subscription.
- Block or clear cookies in your browser, or use a content blocker, to stop website analytics.
Depending on where you live, you can also:
- access the data we hold about you and get a copy, or receive it in a portable format;
- correct or delete it;
- restrict or object to how we use it, including use based on legitimate interests;
- withdraw consent;
- nominate someone to exercise your rights if you die or become unable to (India);
- complain to a data protection authority, such as your local EU authority, the UK Information Commissioner's Office or the Data Protection Board of India.
Email support@zeptap.com from the address you bought with, or tell us how to find your records. We reply within 30 days; if a request is complex, we may take up to two more months and will tell you why. Requests are free. If you live in a US state with a privacy law, you have these rights too, and we won't treat you differently for using them.
Security
We encrypt data in transit, hash license keys and device identifiers on our server, limit who can access data, and keep secrets on your Mac in the Keychain. No system is perfectly secure. If a breach affects your data, we'll tell you and the relevant authorities as the law requires.
Children
Zeptap isn't intended for anyone under 18, and we don't knowingly collect children's data. If you think a child has given us personal data, email us and we'll delete it.
Changes
If we change this policy, we'll update the date at the top. Significant changes will also be announced on this site or by email before they take effect.
Contact
Afterlume Labs, Bengaluru 560010, India. support@zeptap.com