Privacy
Effective 2026-10-16. 한국어 · Terms
Zap! is run by Mutual Solutions, Inc., a Delaware corporation ("we"). This page covers the Zap! website (zap.mutual.solutions), API, MCP server and command-line client. The mutual.solutions website has its own policy.
The short version
- Your board files are used only to run your job. Uploads are deleted when the job finishes; the routed board 7 days later, or at once when you delete the job.
- We do not use your boards to train or develop our software unless you agree in writing (email is enough). The
consent_trainingsetting records your preference; on its own it is not that agreement. - We keep small records with no board contents: job records (2 years), request logs (7 days), a one-way hash of your API key.
- Feedback you choose to send is used to improve Zap!. We never publish or quote it without asking, never use it to train AI models, keep it at most 2 years and delete it when you ask.
- No ads, trackers or analytics scripts; we never sell data or build profiles of you. Our only cookies are for sign-in.
What we keep, why, and for how long
| What | Why | How long |
|---|---|---|
| Files you upload | To check and route that job | Until the job finishes. Pre-flight check files are not kept. |
| Routed board, its report and layer pictures | For you to download | 7 days, or at once with DELETE /v1/jobs/{id} |
| Job record: id, times, status, options, version, summary numbers (pads, layers, missing connections, rule errors) | Job list, daily limits, support, fixing failures | 2 years, then deleted |
| API key | To let you in | Only a one-way hash; a lost key is replaced, not recovered |
| Key details: its label, limits, creation time | Running your access | Until the key is closed. A closed key is deleted after 2 years without use, or at once when you ask. |
| Request logs: time, IP address, key id, path, status, size, duration, and sign-in events. Never board contents, file names, keys, tokens or feedback text. | Security, rate limits, fixing errors | 7 days |
| Feedback: your text, the job id, whether we may reply, up to 3 board pictures you agreed to attach | To improve Zap! | At most 2 years, or until you ask us to delete it |
| Board pictures not attached (one area, at most 40 mm square) | For you to look at first | 24 hours, or at once if you delete it |
| Sign-in: verified email, the account id from Google, GitHub or Microsoft (and, for Microsoft work or school accounts, your organisation's directory id), sign-in times, hashed tokens. Not your name or photo. | Signing you in, and telling you about problems with your jobs (no marketing) | Sessions 8 hours; token hashes 1 day after the token expires; the account until you ask us to delete it, or 2 years after its last use |
| Trying Zap! without a key: the same as any job, plus a one-way hash of the trial's one-time token and a keyed hash of your network address | To run the trial and limit trials per network | Routed board until your first download (at most 7 days); address hash until the end of that UTC day; job record 2 years |
| The access request form: your email, name or company, what you want Zap! for, a keyed hash of your network address | To decide on and answer your request | As long as needed to answer you, and at most 2 years. Not in backups. |
| Emails you send us, and details you gave when asking for a key | To answer you and issue keys | As long as needed to answer you, and at most 2 years |
A picture attached to feedback shows a small part of your board, so it is deleted together with that feedback. We never keep or use the board file through feedback.
In your browser
- The upload page keeps your key in that tab only; closing the tab removes it.
- Sign-in uses two cookies: one keeps you signed in for up to 8 hours, the other lasts only the 10 minutes a sign-in may take. We set no other cookie. Cloudflare, which carries our traffic, could add its own short-lived security cookie to tell people from bots.
Who handles data for us
| Company | What it does | Where |
|---|---|---|
| Amazon Web Services | Our servers, the feedback database, encrypted backups | Seoul, South Korea |
| Cloudflare | Carries all traffic. It decrypts and re-encrypts connections on the way to our server, so files pass through its network. | Worldwide |
| Google, GitHub, Microsoft | Only if you sign in with them: they confirm your email and account id | Under their own policies |
| Google (Google Workspace) | Our email, hello@mutual.solutions | Under Google's policies |
| Slashy | An AI email assistant connected to hello@mutual.solutions; it helps us read and answer email | Under Slashy's policies |
| Anthropic | Its AI model Claude, used by our team through Claude Code, helps us read and sort feedback | United States and elsewhere |
| Stripe | Payments, once paid plans start; this page will be updated first | United States and elsewhere |
Backups. Job records, key hashes, feedback text and sign-in data (your email and provider account id, the names and return addresses of apps you connected, the names of your developer credentials and one-way hashes of their secrets; no tokens, sessions, board files or pictures) are copied daily to private, encrypted storage (Amazon S3) and to a second server of ours, both in the same region. Each copy is deleted after 14 days.
Assistants and platforms. Through Claude, ChatGPT, Cursor or a similar assistant, what you send also passes through that assistant's provider, under its terms. A design platform that sends us your board decides what it sends; we handle it under this page and our agreement with that platform.
Your choices and rights
- Delete a job's files at once with
DELETE /v1/jobs/{id};zap.py rundoes this by default. - Email hello@mutual.solutions for a copy of what we hold about you, a correction, deletion of your feedback or account, or to close your key. We answer within 30 days. Deleted items leave our main database at once and every copy within 14 days.
- Where you live (for example the EU, the UK or Korea) may give you further rights, including complaining to your data protection authority.
Children
Zap! is for engineers aged 18 or older. We do not knowingly collect personal information from children under 14 (Korea) or 16 (EEA).
Changes
We update the date above. For a significant change (new data, a new company handling it, longer storage) we post notice on zap.mutual.solutions and email the addresses we have, at least 14 days ahead. No change to this page lets us use your boards beyond their job; that still needs your written agreement.
Contact
hello@mutual.solutions. Mutual Solutions, Inc., 1111B S Governors Ave, STE 51148, Dover, Delaware 19904, United States. Privacy officer (개인정보 보호책임자): Yejun Jang, CEO, at hello@mutual.solutions.
Details
- Legal bases (EEA, UK): running jobs, keys and sign-in provides the service you ask for (contract); logs and rate limits protect it (legitimate interests); feedback is sent only when you choose (consent) and can be deleted on request.
- Cookies:
__Host-zap_session(signed in, up to 8 hours) and__Host-zap_login(a sign-in in progress, up to 10 minutes); both Secure, HttpOnly, SameSite=Lax. Cloudflare's security cookie is__cf_bm. - Command-line sign-in shows the country it was started from (as reported by Cloudflare) on the approval page; that country is deleted with the pending sign-in, within about 15 minutes.
- Feedback is read on a second server in the same region. It drops deleted feedback at its next update (every 10 minutes while that server runs).
- "Last use" of a closed key is its last job or feedback; of a sign-in account, its last sign-in or token. Job records, closed keys and accounts past 2 years are deleted by an hourly clean-up on our server.