LEGAL
ZTPipe Privacy Policy
Last updated: 31 October 2026
Packet Pilot LLC (Packet Pilot合同会社, “we”) provides ZTPipe, a desktop application for signed and encrypted business email, together with the website https://ztpipe.app and the customer portal (portal.ztpipe.app) (together, the “Service”). This policy explains what information the Service handles and how. Where the EU General Data Protection Regulation (GDPR) applies, this policy also describes our processing under that Regulation.
1. Our design principle: your mail stays on your devices
ZTPipe connects directly from your device to your mail provider (Google, Microsoft or your IMAP/SMTP server). The content of your email — subjects, bodies, attachments, recipients — your encryption keys and your contacts are processed and stored only on your devices. They are never sent to our servers. We have no way to read your messages.
2. Information processed only on your device
The ZTPipe app stores the following on your device, encrypted with keys protected by the device’s Secure Enclave (macOS) or TPM (Windows):
- Your mail account connection: OAuth tokens (Google, Microsoft) or your IMAP/SMTP password.
- Messages and attachments retrieved from your mailbox (kept in local quarantine until verified), drafts, folders, flags and read state.
- Your keys and certificates, the contacts you verify (Trust Directory) and your settings.
- Records of messages you sent and their verification results.
When you add a second device, the two devices exchange encrypted data through your own mailbox (see section 3). Expired messages are deleted from your devices as described in the app.
3. Google user data
When you connect a Gmail or Google Workspace account, ZTPipe requests the Gmail scope https://www.googleapis.com/auth/gmail.modify. ZTPipe uses it only to provide the email client features you use:
- Read: list new messages and download the raw message (MIME) of ZTPipe messages, so the app can decrypt and verify them on your device. Other messages are checked only for their structure (to recognise ZTPipe messages and delivery failure notices); their content is not downloaded.
- Send: send the messages you compose and the invitations you send.
- Device addition: create a hidden label named “ZTPipeControl”, place ZTPipe’s own temporary encrypted control messages there while you add a device, and move those control messages to the trash afterwards.
ZTPipe does not change the read state or labels of your other messages and does not delete them.
Google user data obtained through these scopes:
- is processed and stored only on your device, and is not transferred to Packet Pilot or to any third party;
- is not used for advertising, is not sold, and is not used to develop, improve or train generalised artificial intelligence or machine learning models;
- is not read by any person at Packet Pilot.
ZTPipe’s use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
You can revoke ZTPipe’s access at any time in your Google Account (https://myaccount.google.com/permissions) or by disconnecting the account in ZTPipe’s settings.
4. Microsoft 365 and other mail providers
When you connect a Microsoft 365 account, ZTPipe requests the Microsoft Graph permissions User.Read (to identify the connected mailbox), Mail.ReadWrite, Mail.Send and offline_access (to stay connected without signing in again). It uses them to read, send and (for device addition) create and delete its own control messages in a hidden folder. When you connect an IMAP/SMTP account, ZTPipe uses that server in the same way. As with Google, this data is processed only on your device and is not sent to us.
5. Information we receive
5.1 Customer portal (portal.ztpipe.app)
- Account information: email address and name of the person registering; your company’s name, address, telephone number and country, and its Japanese Corporate Number; a hash of your password; the secret for two-factor authentication (TOTP).
- Users invited by your administrator: email address and role.
- License notes: an optional note your administrator may add to each license (for example, the name of the person using it). We do not receive the email addresses of the people who use the app (see section 5.2).
- Security records: records of account and administration operations (what was done, when, by which account, and the result). They do not contain your IP address.
- Abuse prevention: to limit repeated attempts, we keep a one-way hash of the connecting IP address, never the address itself, for 7 days. Our web server logs record the request, the result and the time, but not your IP address or browser, and are kept for 7 days.
- Billing information: plan, number of licenses, contract period and payment status. Payments are processed by Stripe; we never hold your card number.
5.2 License check
When the app activates or refreshes a license it sends: the contract ID, the serial number (we store only a hash of it), a binding value computed on your device from your email address and the serial number (the app never sends your email address), a device identifier derived from the device’s signing key, the operating system and the app version. Request logs record the request, the result and the time, without your IP address; a one-way hash of the IP address is kept only to limit repeated failures. Both are kept for 7 days.
5.3 Sending-time network check
If you use the sending-time network check, the app contacts our check servers (to verify the server certificate, compare name resolution and test connectivity). No license, account or message information is attached. The names looked up through our DNS for the comparison are not recorded. Logs (including IP address and time) are kept for 7 days, separately from the license service logs, and the two are not correlated.
5.4 Email we send
We send service email (address verification, invitations, password reset, two-factor re-enrollment) from no-reply@ztpipe.app through Amazon SES.
5.5 Optional Proof (PP-TSA)
If you choose to add a Proof to a message, the app sends only cryptographic hashes of the message and attachments, and request metadata, to Packet Pilot’s timestamping service (PP-TSA). The content never leaves your device.
5.6 Enquiries
The content of your enquiries and the contact details you give with them.
5.7 App update check
After it starts, and then about once a day, the app downloads information about new versions from our server. It downloads the installer of a new version only when you press “Update”. No license, account, device or message information is attached, and the app does not send its version or operating system. Web server logs record the request, the result and the time, but not your IP address, and are kept for 7 days, separately from other logs.
6. Connections the app makes to others
Besides your mail provider, the app connects to: iptoasn.com, only when you press “Update ASN data” (to download a public data file; nothing about you is sent); the PP-TSA service when you use Proof; and, if you choose a DNS other than ours (Cloudflare, Google or one you specify) in the settings of the network check, that DNS service (to look up the names of the sending servers).
7. Cookies
We use no analytics or advertising cookies, trackers or third-party scripts. Fonts are served from our own server.
| Where | Name | Purpose | Duration |
|---|---|---|---|
| ztpipe.app | ztpipe_lang | Remembers the language you chose with the language selector (set only when you choose one) | 1 year |
| portal.ztpipe.app | __Host-ztpipe-portal | Keeps you signed in (strictly necessary) | 8 hours |
| portal.ztpipe.app | __Host-ztpipe-csrf | Protects your actions against cross-site request forgery (strictly necessary) | 8 hours |
| portal.ztpipe.app | __Host-ztpipe-download | Allows the app download you requested (strictly necessary) | 30 minutes |
| ztpipe.app and portal.ztpipe.app (browser storage) | ztpipe.cookie_notice | Remembers that you closed the cookie notice; stays in your browser and is not sent to us | Until you clear it |
| portal.ztpipe.app (browser storage) | ztpipe.theme, ztpipe.locale | Remembers the light/dark appearance and language you chose; stays in your browser and is not sent to us | Until you clear it |
When you pay, the portal shows Stripe’s payment form, and Stripe may set cookies needed for payment and fraud prevention under its own privacy policy.
8. Purposes and legal bases
| Information | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account and billing | Providing the Service, authentication, contract administration, charging and tax compliance | Contract; legal obligation |
| License service data | Confirming the license and the number of devices | Contract |
| Logs and IP address hashes | Operating the Service, preventing misuse, investigating faults | Legitimate interests (kept to 7 days) |
| Security records | Protecting accounts, investigating misuse | Legitimate interests |
| Network check logs | Providing the network check | Legitimate interests (kept to 7 days) |
| Enquiries | Answering you | Contract or legitimate interests |
9. Disclosure and processors
We do not sell personal data and do not disclose it to third parties except with your consent, where required by law, or to the processors below.
| Processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting (Tokyo region) and email delivery (Amazon SES) | Japan |
| Stripe | Card payment processing | United States and others |
10. International transfers
Personal data is stored and processed in Japan (AWS Tokyo region). Transfers from the EEA to Japan rely on the European Commission’s adequacy decision. Payment data may be transferred to Stripe in the United States, which participates in the EU-US Data Privacy Framework.
11. Retention
| Information | Period |
|---|---|
| Account information | During the contract and 30 days after it ends |
| License records | During the contract and 30 days after it ends |
| Web server logs, license service logs, network check logs, app update check logs, IP address hashes for abuse prevention | 7 days |
| Security records | During the contract and 30 days after it ends |
| Billing records | The period required by law |
| Enquiries | During the contract and 30 days after it ends |
12. Security
Encryption in transit (TLS) and at rest; signing keys held in a key management service; two-factor authentication for all portal accounts; least-privilege access; audit logging; tenant separation. In the app, private keys are protected by the device’s Secure Enclave or TPM and data is stored encrypted.
13. Your rights
You may request access, rectification, erasure, restriction, objection and data portability for personal data we hold, and withdraw consent where processing is based on consent. Contact us (section 16). Where the GDPR applies we respond within one month. You may lodge a complaint with your data protection authority or with the Personal Information Protection Commission of Japan. Data stored only on your devices (section 2) is under your control; you can delete it by deleting ZTPipe’s data on the device.
14. The EU / EEA
ZTPipe is currently offered only to corporations established in Japan and is not offered to businesses in the EU / EEA. Before we start offering ZTPipe to businesses in the EU / EEA, we will appoint a representative in the EU under Article 27 of the GDPR and publish their name, address and contact details on this page. If you have any questions, please contact us at the address in section 16.
15. Changes
We will publish changes on this page and notify registered customers by email of material changes.
16. Contact
Packet Pilot LLC (Packet Pilot合同会社) — product.support@packet-pilot.net