Privacy Policy

This privacy policy applies to the Zephyr app (hereby referred to as “Application”) for macOS that was created by Timothy Morgan (hereby referred to as “Service Provider”) as an Open Source service. This service is intended for use “AS IS”.

Zephyr is an independent Dropbox client. It is not affiliated with, endorsed by, or sponsored by Dropbox, Inc.

What information does the Application obtain and how is it used?

Zephyr has no accounts of its own, collects no information for the Service Provider, and transmits nothing to any server the Service Provider operates — because none exists. What follows describes every category of data the Application touches and everywhere it goes.

Your files and your Dropbox account

Unlike an app that keeps your data on your own machine, Zephyr’s entire purpose is to move it: it downloads the contents of files you open from Dropbox, uploads files you create or change, and keeps a record of your account’s folder structure so the Finder can show it to you. This is the service you are asking for when you link an account.

That traffic travels directly between your Mac and Dropbox over encrypted (HTTPS) connections, to www.dropbox.com, api.dropboxapi.com, content.dropboxapi.com, and notify.dropboxapi.com, and to no other host. It does not pass through any intermediary, proxy, or service operated by the Service Provider. Once your data is with Dropbox it is held by Dropbox under Dropbox’s own privacy policy, which governs what Dropbox does with it and which is worth reading alongside this one.

What access Zephyr requests from Dropbox

Zephyr is registered with Dropbox as a scoped-access application with full Dropbox access, because it presents your whole account in the Finder rather than a single app folder. When you link an account, Dropbox shows you what is being requested and asks you to approve it. What may be requested is set by Zephyr’s registration with Dropbox rather than by the app: the authorization request names no scopes of its own, so Dropbox grants what that registration enables, which is exactly these six and no others:

account_info.read

Read your account’s basic profile — the name and email on the account, and how much of your storage quota is in use. Zephyr uses it to label linked accounts and to show usage.

files.metadata.read

Read the names, paths, sizes, timestamps, revision identifiers, and content hashes of the files and folders in your Dropbox, and follow the account’s feed of changes. This is what lets the Finder show your Dropbox without downloading it.

files.content.read

Download the contents of your files, which happens when something opens one.

files.content.write

Create, modify, move, rename, and delete files and folders in your Dropbox — everything you do to the account through the Finder, the Share extension, or the command-line tool.

sharing.read

List the shared links that already exist on your account.

sharing.write

Create and revoke shared links, when you ask for one.

No team, team member, file request, contacts, or Paper scope is enabled, and Zephyr cannot see any account other than the one you link. You can withdraw this access at any time — see opt-out rights below.

Credentials

Zephyr signs in using Dropbox’s OAuth 2 authorization-code flow with PKCE, as a public client. You enter your Dropbox password on Dropbox’s own website, never in Zephyr; the Application never sees it. No client secret exists anywhere in Zephyr, and none is ever sent.

What Dropbox returns is a refresh token, which Zephyr stores in the macOS Keychain and exchanges with Dropbox for short-lived access tokens as it works. There are deliberately two stores: the app and its extensions keep their token in a data-protection keychain item shared through the Application’s keychain access group, while the zephyr command-line tool — which is not sandboxed and cannot carry that entitlement — keeps its own item in your login keychain. Access tokens are held in memory only.

No credential of any kind is transmitted to the Service Provider. Tokens are sent only to Dropbox, at api.dropboxapi.com, over HTTPS. There is no Zephyr account, no Zephyr login, and no Zephyr server to send anything to.

The local sync index

So that the Finder can list your Dropbox instantly and without downloading it, Zephyr keeps a SQLite database (using GRDB) for each linked account on your Mac. It records, for every item in the account: its name and path, its Dropbox identifier and revision id, its size, its content hash, its timestamps, whether it is marked as ignored, and the position of Zephyr’s place in the account’s change feed. It also keeps a rolling week of sync history — what changed and when — and a small set of notes about items that failed to sync.

This database never leaves your Mac. It is not backed up to any service by Zephyr, is not transmitted anywhere, and is not readable by the Service Provider. It lives in the Application’s app group container, at ~/Library/Group Containers/group.codes.tim.Zephyr/Library/Application Support/Zephyr/Accounts/<account id>/index.sqlite, alongside that account’s cached details and a staging folder for in-flight downloads. One level above it sit the registry of linked accounts and the settings that belong to this Mac rather than to one account. Unlinking an account or deleting that container removes it.

Update checks

The copy of Zephyr downloaded directly from GitHub checks for its own updates; the Mac App Store edition does not, because the App Store updates it. In the direct download, on launch and then periodically — daily by default — the app requests the public list of releases for the Zephyr repository from GitHub’s API, at api.github.com. The request is unauthenticated and carries no information about you, your Dropbox account, your files, or your copy of the app beyond what any web request necessarily reveals to the server answering it: your IP address, the time, and a generic user-agent string. It is governed by GitHub’s privacy statement. If you choose to install an update it is downloaded from GitHub as well.

You can turn automatic checks off. In the direct download's Settings ▸ Updates, the “Check automatically” setting offers Hourly, Daily, Weekly, and Never; choosing Never stops all background checks, and the Application will then contact GitHub only if you press “Check Now” yourself.

Diagnostic logging

Zephyr writes diagnostic messages to the macOS unified log under the subsystem codes.tim.Zephyr. These records — which can include Dropbox paths and file names — stay on your Mac, under the system’s own log retention, and Zephyr never uploads them anywhere.

Be aware that unified log data is included in a sysdiagnose. If you generate one and send it to Apple, or attach it (or the output of log show) to a bug report, that log data goes wherever you send it. It is worth a look before you share one.

Settings ▸ Troubleshooting ▸ Collect… writes a diagnostics report meant for a bug report, and it is the one thing Zephyr produces that names your files: it lists the path of every item that failed to sync and of every item you have excluded from syncing. Around those it puts the Application’s version, your macOS version, whether syncing is paused, your notification level and transfer limits, any approvals macOS is withholding, and — for each linked account — its Dropbox identifier, its namespace, when it was linked, and how many files and folders it holds, followed by a tail of the Application’s own recent log. It is written to a file on your Mac and revealed in the Finder; the Application never sends it anywhere. Read it before you attach it to anything.

Crash reports

The Application reports its own crashes to Sentry, a diagnostics service operated by Functional Software, Inc., along with a sample of its own performance and, from the menu-bar app alone, its own hangs. The purpose is narrow: to find out that something is broken or slow, and to have enough context to fix it. The Application sends nothing about what you do with it — it counts no features, no commands, and no settings.

What a report contains:

• the Application’s version and build, the macOS version, and the Mac’s model identifier, CPU architecture, locale, and available memory;
• for a crash or a hang: the exception type, the message, and the stack trace, plus which of the Application’s components it came from — the app, the File Provider extension, the File Provider UI extension that draws the version-history sheet, the Share extension, the widget, or the command-line tool;
• a short trail of what that component did just before the fault: the network requests it made, with their Dropbox API routes, HTTP statuses, and durations, and its own start-up and lifecycle events;
• from the app and the File Provider extension only, and from about a fifth of their own work: timings for the network and file-system work the Application does, and periodic samples of which of its own functions were running, so that slow paths can be found. The other four components send no performance data at all;
• a random identifier generated on this Mac, so that repeated reports from one installation can be recognized as the same installation. It is not derived from your Dropbox account, your Apple Account, or any hardware serial number, and deleting the Application’s app group container discards it.

What a report does not contain:

• the contents of any file;
• file names, folder names, or Dropbox paths — the Application scrubs these out of error messages, breadcrumbs, and log lines before a report is sent;
• your Dropbox account identifier, display name, or email address;
• your refresh token, any access token, or any other credential;
• your IP address, which is discarded rather than stored with the report.

There is currently no setting that turns this off. The Application reports for as long as it is running. A future version may add one; if it does, this policy will be updated to describe it before that version is published. In the meantime, removing the Application stops the reports, as does blocking *.ingest.us.sentry.io at your firewall or DNS.

Sentry processes this data as the Service Provider’s processor, under Sentry’s privacy policy and its data processing addendum. Reports are retained for 90 days and then deleted. No report is sold, rented, or shared with advertisers or data brokers, and none of it is used to profile you or to track you across apps or websites. The Application uses no advertising identifier and does no cross-app tracking of any kind.

Do third parties see and/or have access to information obtained by the Application?

Dropbox receives your files and their metadata, necessarily — that is what a Dropbox client does — under the terms of your own Dropbox account. GitHub sees the update-check requests described above. Sentry receives the crash reports and performance data described above and processes them on the Service Provider’s behalf. Apple is involved only insofar as macOS itself stores the file contents it has materialized on your Mac, and insofar as you choose to send Apple a sysdiagnose. Nobody else receives anything. No data is sold, rented, or shared with advertisers or data brokers, and nothing about the contents of your Dropbox is sent to the Service Provider.

What are my opt-out rights?

You can stop all use of your data by the Application by unlinking your account, which deletes the stored refresh token from your Keychain and revokes Zephyr’s access with Dropbox. You can also revoke that access independently from the connected apps page of your Dropbox account, which the Application cannot override. Removing the Application from your Mac ends everything else, and deleting its app group container removes the local index along with it. The direct download's update checks can be turned off in Settings ▸ Updates, and notifications reduced or silenced in Settings ▸ Notifications and in macOS System Settings. Crash reports have no such setting yet — see crash reports above for what stops them.

Children

The Application is a utility and is not used to knowingly solicit data from or market to children under the age of 13.

The Service Provider does not knowingly collect personally identifiable information from children — or, indeed, from anyone. If you have reason to believe that a child has provided personally identifiable information to the Service Provider through the Application, please contact the Service Provider (zephyr@timothymorgan.info) so that they will be able to take the necessary actions. You must also be at least 16 years of age to consent to the processing of your personally identifiable information in your country (in some countries we may allow your parent or guardian to do so on your behalf).

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. Every request the Application makes — to Dropbox and to GitHub alike — is made over an encrypted (HTTPS) connection. Your Dropbox refresh token is held in the macOS Keychain rather than in a file, protected by the system, and the app and its extensions use a data-protection keychain item that is unavailable until after the first unlock following a restart. Because Zephyr authenticates as a public client with PKCE, there is no client secret to be extracted from the app or intercepted. Every file transfer is verified against Dropbox’s content hash. The app and its extensions run in Apple’s App Sandbox; the command-line tool, by necessity, does not.

Zephyr is open source, and the code behind every claim on this page can be read in the repository.

Changes

This Privacy Policy may be updated from time to time for any reason. The Service Provider will notify you of any changes to their Privacy Policy by updating this page with the new Privacy Policy. You are advised to consult this Privacy Policy regularly for any changes, as continued use is deemed approval of all changes.

This privacy policy is effective as of 24 August 2026.

Your consent

By using the Application, you are consenting to the processing of your information as set forth in this Privacy Policy now and as amended by the Service Provider.

Contact

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider by email at zephyr@timothymorgan.info, or by opening an issue at github.com/RISCfuture/Zephyr/issues.