Privacy Policy

1. Who we are

Drip Type and the tryzap.net website are operated by VegaNext LLC under the Zap brand ("Zap," "we," "us," or "our"). For privacy questions or requests, use the private support form.

2. Scope

This policy applies to the Drip Type macOS and Windows applications, tryzap.net pages for Drip Type, subscription activation, software updates, and related support. It does not govern third-party websites, applications into which you choose to type, or Stripe-hosted pages governed by their own notices.

3. The local-first boundary

Drip Type 1.7 does not send your composer drafts, templates, template values, batch rows, writing profiles, explicitly captured clipboard items, or Writing Lab text to Zap, Stripe, Vercel, OpenAI, or another remote writing service. Composer drafts remain in application memory. Templates, profiles, and captured clipboard items are encrypted together in a local vault using operating-system protected encryption before they are written to disk. Clipboard text enters the private workspace only when you select Capture clipboard; Drip Type does not continuously monitor clipboard history. Information you deliberately enter in the website support form is support content and is sent to Zap as described below; it is not collected from the Drip Type writing workspace.

Writing Lab transforms are deterministic and run on-device. Drip Type 1.7 does not use a third-party AI writing API. Drip Type does not send keystroke logs, screenshots, window titles, browser history, contact lists, photos, microphone recordings, camera recordings, or precise location to Zap. The operating system may expose limited interface access after you grant Accessibility or Automation permission, but Drip Type uses that permission to enter the text you direct it to type, not to build a record of your activity.

4. Information we collect and why

We obtain information directly from you, including when you create an account or submit the support form; automatically from the app or browser when it contacts our services; and from Stripe when you purchase or manage a subscription. We do not collect payment-card numbers; Stripe processes payment credentials on its hosted pages. Zap does not send your password or recovery code to Stripe. The support form does not accept attachments, and we ask you not to include passwords, recovery codes, full payment-card numbers, private clipboard content, or other sensitive information.

5. How we use information

• Provide, authenticate, maintain, update, and support Drip Type.
• Process subscriptions, legally required billing corrections, plan changes, and Customer Portal requests.
• Protect the service, enforce device and rate limits, investigate errors, and prevent fraud or misuse.
• Comply with tax, accounting, legal, and regulatory obligations and enforce our agreements.
• Respond to messages and privacy requests.

Where data-protection law requires a legal basis, we rely on performance of our contract with you, compliance with legal obligations, and our legitimate interests in operating and securing a limited, local-first subscription service. Where consent is required, we will request it separately and you may withdraw it as permitted by law.

6. Cookies, local storage, and analytics

The Drip Type pages on tryzap.net do not currently run advertising analytics, behavioral advertising pixels, cross-site tracking, or writing-content analytics. We use only storage that is necessary to provide features you request:

• Secure account session: after sign-in, the __Host-zap_session cookie keeps the account session authenticated for up to seven days. It is HttpOnly, Secure, SameSite=Lax, and unavailable to page scripts.
• Checkout continuity: temporary session storage holds a random checkout identifier so a repeated click can resume or safely deduplicate the same checkout attempt. It is scoped to the browser tab and is not advertising data.
• Notice preference: local storage remembers that you dismissed the necessary-storage notice. It remains until you clear the site's browser storage.

These technologies are not used to profile you or follow you across websites. Because they are limited to requested sign-in, checkout, security, and preference functions, the banner provides notice rather than an advertising-cookie opt-in. If we introduce any non-essential analytics or advertising technology, we will update this policy and request consent where required before activating it. Stripe-hosted checkout and Customer Portal pages may use cookies or similar technologies under Stripe's Privacy Policy. Hosting and security providers may process ordinary request data needed to deliver and protect the site.

7. When we disclose information

We disclose limited information only as needed to:

• Stripe, which provides checkout, payment processing, subscriptions, invoices, fraud controls, and the Customer Portal.
• Vercel and GitHub, which host the website, first-party account and session endpoints, serverless billing and support endpoints, encrypted private account and support-ticket records, operational logs, update metadata, and downloadable release files. Support-ticket contents are retrieved only through Zap's authenticated admin endpoint.
• Apple, Microsoft, and your operating system, which provide platform permissions or input services, Keychain or DPAPI-protected credential storage, release verification, and macOS notarization checks.
• Professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate fraud, or handle a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate safeguards.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use sensitive personal information to infer characteristics about you.

8. Retention and deletion

Local drafts disappear when their in-memory session ends. Local templates, profiles, preferences, device identifiers, and captured clipboard items remain until you delete them or remove the relevant application data. The subscription refresh credential is stored in macOS Keychain or encrypted using Windows Data Protection API (DPAPI) until it is replaced, access is revoked, or you remove the relevant application data.

Support tickets are automatically deleted from Zap's private support store no later than 90 days after creation. Account, billing, subscription, device-hash, security, and transaction records are retained for as long as reasonably necessary to provide account access, resolve disputes, prevent fraud, enforce agreements, and meet legal, tax, and accounting requirements. Hosting logs and payment records are also subject to the providers' retention practices. When information is no longer required, we delete or de-identify it where reasonably practicable.

9. Security

We use measures designed for the information we process, including HTTPS, salted scrypt password hashing, AES-256-GCM encrypted private account storage, signed HttpOnly session cookies, persistent login lockouts, single-use recovery codes stored only as one-way hashes, strict support-form validation that rejects likely passwords, payment-card numbers, private keys, and access tokens, bounded support and activation attempts, a hidden anti-bot field, application-level AES-256-GCM encryption inside private support storage, an authenticated admin console protected by separate server-side account-ID and email allowlists, Stripe-hosted payment entry, a one-account-to-one-customer billing mapping, signed and notarized macOS releases, checksummed Windows releases, short-lived Ed25519-signed entitlements, hashed device bindings, restricted server credentials, and operating-system-protected encrypted storage for local private content and the refresh credential. No system is completely secure, so we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live and which law applies, you may have rights to know or access personal information, correct it, delete it, obtain a portable copy, restrict or object to processing, withdraw consent, or appeal a denied request. California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising their rights. Because we do not sell or share personal information for cross-context behavioral advertising, no sale/share opt-out is presently required for Drip Type.

For California notice-at-collection purposes, the categories described above are identifiers and customer-record information, commercial information, internet or electronic activity, and support communications. During the preceding 12 months, we collected and disclosed those categories for the business purposes described in Sections 4 through 7, including disclosure to service providers. We did not sell or share them for cross-context behavioral advertising.

Submit a request through the private support form with the summary "Privacy request." Tell us the right you want to exercise and the email associated with your subscription, if any. We may ask for information reasonably necessary to verify your identity and authority. An authorized agent may submit a request where permitted by law. We will respond within the period required by applicable law. You may also complain to your local data-protection regulator.

11. International processing

Zap is based in the United States, and our providers may process information in the United States and other countries. Where applicable law requires it, we use an approved transfer mechanism or other appropriate safeguard. Local writing content described in Section 3 is not transferred to our servers.

12. Children

Drip Type is not directed to children and is offered only to people who can form a binding contract and are at least 18 years old. We do not knowingly collect personal information from children through Drip Type. If you believe a child has provided information, contact us so we can review and delete it where appropriate.

13. Changes to this policy

We may update this policy when the product, providers, or law changes. We will post the revised version with a new effective date and provide additional notice when required. Material changes apply prospectively unless law permits otherwise.

14. Contact