Privacy policy

Last updated: 2 November 2026

This privacy policy covers the Android app Zapli (package dev.zapli, and dev.anyapp.preview for its testers), distributed by SynapTech s. r. o. (“we”). For any privacy question, write to the developer email address shown on Zapli’s Google Play page.

In short: Zapli does not collect, send or share your data. What you keep in it stays on your phone unless you back it up or share it yourself, and we never receive it. Zapli goes online only to fetch the Zapli library’s apps and their updates from GitHub, to download an app from a link when you ask it to, and to open a Claude artifact link you give it.

What Zapli does

Zapli installs and runs small apps: the ones from the Zapli library, such as a to-do list, a water log, a blood pressure log, an expense tracker, loyalty cards and three games, and the ones you import: a file you pick, a file or text you open or share with it from another app, text you paste, or a link you give it. It reads only what you give it this way, and installs no new app until you tap Install. It also checks the Zapli library for new apps and new versions: each time you open Zapli, at most once every 10 minutes, and when you tap Check now in the library’s Settings. A new version of a library app you installed is applied by itself when it asks for nothing new; otherwise it waits for your review. The check is on from the start; you can turn the automatic check off in the library’s Settings, with Check for library updates.

Your data is kept on your device

The apps and everything you enter in them are stored in Zapli’s private storage on your phone, and in any backups, as described below. That can be sensitive data, such as your blood pressure readings, what you spend, your loyalty card numbers or your photos. When an app asks for photos, you pick them in Android’s own picker, and the app receives only the photos you choose: Zapli needs no permission to read your photos for this. On Android 12 and older, the permission for music also covers photos and videos; Zapli never uses it for them. The app keeps a copy that Zapli makes of each photo you take or pick, without your location or other metadata. We never receive any of it.

The internet

Zapli uses the internet only for the library check, for the files of library apps you install or update, and for links you import from. For the library check, it downloads the list of the library’s apps, signed by us, and the apps’ files from GitHub (raw.githubusercontent.com) over an encrypted connection. It sends none of your data, no cookies and nothing that identifies you or your phone; the request says only that it comes from Zapli. Like any website, GitHub sees your phone’s internet address (IP address), the time and which files are fetched, and handles them under GitHub’s privacy statement; the DNS service your phone uses sees the name raw.githubusercontent.com.

Some library apps come as several files. Zapli downloads such an app’s files from GitHub only when you install it, or when one you installed gets a new version, so GitHub then also sees which app’s files your phone requests. New versions of such apps download by themselves only on Wi-Fi or another network that is not metered; on a network Android reports as metered, such as mobile data, the app’s tile shows the size of its update, and nothing downloads until you tap it.

When you import an app from a link, Zapli downloads the file at that link once, over an encrypted connection and only after you confirm, from the website its confirm step names (for a link to a file’s page on GitHub, GitHub’s file host, raw.githubusercontent.com or gist.githubusercontent.com) and from any website that website sends the download on to. Each of them sees your phone’s internet address (IP address), the time, the link and that the request comes from Zapli, and handles them under its own terms and privacy policy; the DNS service your phone uses sees each of their names. The confirm step shows the whole link, which the website receives as it is. Zapli keeps only each website’s name, the time and how many bytes went each way, in a log on your phone for 90 days, never the link; it never downloads from that link again by itself, and the downloaded app goes through its install review like a file you import.

A link to a public Claude artifact works differently: after you confirm, Zapli shows Claude’s own page, as a browser would, and your phone loads it from claude.ai, Cloudflare and the other sites that page uses. They see your phone’s internet address, the time and the link, can read what any web page can, such as your phone’s model, language and screen size, and can use cookies, under their own terms and privacy policies. The artifact’s own code runs in that page before you import it, and can reach what Claude’s page lets it. Zapli deletes that page’s cookies and storage when the visit ends, or the next time it opens if the visit was cut short, reads the app’s code only when you tap Import, and sends it nowhere; that app goes through its install review too. Zapli keeps only the time and how the visit ended in its log on your phone.

The apps themselves cannot connect to the internet: Zapli refuses every connection an app asks for. Apps that contain their own code run on your phone in sandboxed processes of Android System WebView; for such an app that you import, Zapli narrows how it could reach the internet but cannot fully stop it, and its install review says so.

No ads or tracking

Zapli contains no advertising, analytics, tracking or crash-reporting code, and it shows no ads. Neither do the open-source libraries it keeps for such apps (listed under Library licences).

Backups

You can back up your apps and their data to a file and save it where you choose, such as a folder on your phone or a cloud storage app. Zapli never receives it; the app or service you save it with handles it under its own terms. If you turn on automatic backups, Zapli writes such a file by itself on a schedule, daily or weekly, to the folder you picked; if that folder is in a cloud storage app, each file is uploaded there. A backup without a password can be read by anyone who has the file. Android’s own backup can also copy Zapli’s data: directly to a new phone when you set it up, and to your phone’s cloud backup only when that backup is end-to-end encrypted with your screen lock; otherwise Zapli is left out of it.

Permissions

Zapli uses these Android permissions, each only for what is written here. It also has the Internet permission, which Android grants when you install Zapli, without asking, and uses it only for the library check, the library apps’ downloads and the downloads from links and the Claude pages described above, never for an app you installed. With it comes Android’s permission to see the phone’s network, which Zapli uses only to skip the check, or not to start a download, when the phone is offline, and to let new versions of the library’s apps that come as several files download by themselves only on a network that is not metered. Before an app first uses the camera or your music, shows notifications or sets exact alarms, Zapli asks you, and Android may ask as well. You can refuse, and later turn each of these off for one app on its Permissions page in Zapli, or for Zapli as a whole in Android’s settings. Android grants Biometrics and Run at startup when you install Zapli, without asking:

• Camera: to scan a barcode or QR code when you start a scan, and to take a photo when you tap to take one in an app. A scan is analysed on the phone; its image is not stored or sent anywhere, and the app receives only the decoded text. You take a photo in your phone’s own camera app; the app that asked for it then keeps a copy that Zapli makes of it on your phone, without your location or other metadata.
• Music and audio: to show an app the songs on your phone when it asks and you allow it: their titles, artists, albums, lengths and covers, never the song files themselves. Zapli lists the audio files that Android marks as music and, as best it can, leaves out recordings and the phone’s sounds: it skips the usual folders for recordings, calls, voice memos, messengers, ringtones, alarms and notifications, other apps’ own media folders and voice-recording formats, so a recording kept somewhere else may still show as a song. On Android 12 and older, allowing music for an app means allowing Android’s photos and media permission (on Android 10: photos, media and files), which also covers your photos and videos; Zapli uses it only to list songs. Zapli plays the songs on your phone, also with the screen off or the app closed, with controls on the lock screen and in the notifications. While a song plays, its title, artist, album and cover show in Android’s media controls, and from there they can reach connected headphones, cars and watches and apps you allowed to read your notifications. Apart from that, Zapli sends the songs and their details nowhere: they stay on your phone.
• Notifications and Alarms & reminders: to show the reminders your apps set, on time.
• Biometrics: to unlock an app you protect with your fingerprint, face or screen lock. Android tells Zapli only whether unlocking succeeded; Zapli never receives biometric data.
• Run at startup: to set your reminders again after the phone restarts.

When data leaves Zapli

When you choose it: when you share something through Android’s share menu, or save, export or back up a file to a place you pick. Automatic backups, once you turn them on, run on their schedule without asking again and go to the folder you picked; a cloud folder uploads them. Android’s own backup can also copy your data, as described above. Your data then goes to the app or service you chose, under its own terms; we are not involved and receive nothing.

Google Play

If you installed Zapli through Google Play, Google processes data under its own privacy policy. In Google Play Console we see the statistics and crash reports that Google provides to developers, which come from devices whose owners agreed to share usage and diagnostics data with Google, and, while we test Zapli, the email addresses we added to the testers list. We use them only to run tests and fix problems.

Retention and deletion

Data in Zapli stays on your phone until you delete it: uninstalling an app in Zapli deletes its data, and uninstalling Zapli or clearing its storage in Android’s settings deletes everything in its private storage. Files you saved or exported, backup files in the folders you chose and any copy in your phone’s cloud backup are not deleted with it; delete them where they are. We hold no copy, so there is nothing for us to delete. If you are a tester, we remove your email address from the testers list when the test ends or when you ask us.

Security

The data is kept in Zapli’s private storage, protected by Android’s app sandbox; other apps on your phone cannot read it. The apps in Zapli are kept apart from each other, use only the phone features shown when you install them, and use the camera, your music, notifications and alarms only after you allow it. Zapli takes an app or an update from the library only when the list of apps carries our signature, which Zapli checks on your phone with a key built into it, and each file matches that list exactly; otherwise it keeps what it has. An app downloaded from a link is checked on your phone like a file you import and installs only after you review it.

Children

Zapli is not directed at children.

Changes

If this policy changes, Zapli shows the new version here, and we publish it on our policy’s web page, each with a new date.

Contact

Write to SynapTech s. r. o. at the developer email address shown on Zapli’s Google Play page.