← Back to RarZap

RarZap privacy policy

Last updated: 2026-10-12 · Applies to RarZap (free edition), RarZap Pro (commercial edition), and the RarZap license service operated at indmak.com. Contact: support@indmak.com

In one paragraph

If you use the free edition, RarZap makes no network requests at all.

1. Who we are

RarZap is an independent desktop utility published by the RarZap project ("we", "us"). The commercial edition is distributed through the Microsoft Store and activated with a license key issued by our license service. The free, MIT-licensed edition is distributed through GitHub. Data controller / contact point for privacy questions: support@indmak.com.

2. Scope

This policy does not apply to RAR archives you choose to convert, nor to any third-party software you use to obtain them.

3. What we do not collect

• Your files — archive contents, file names, folder names, or file sizes are never sent anywhere.
• Telemetry and usage analytics — no event tracking, no session recording, no feature counters.
• Advertising identifiers — none are read, generated, or transmitted.
• Crash reports — no crash-reporting integration; errors are written to a local log only.
• Contact lists, location, camera, microphone, clipboard, or browser data — the app requests none of these.
• Your email address — the app never asks for it. If you buy through our storefront, your email is handled by the payment provider (§8).

4. How conversion works (local-only)

1. You pick a .rar file (or drop it onto the window).
2. RarZap reads the archive locally, extracts it into a temporary staging folder on your own disk, and repacks the extracted files into a ZIP archive using Deflate compression.
3. The finished .zip is moved into place atomically; if you cancel or the conversion fails, the partial output is removed and nothing is left behind.
4. The temporary staging folder is deleted automatically.

The staging folder is created next to the output file (same disk) so the final move is atomic. Staging folders are named .rarzap-<random>; if the app is force-killed mid-conversion, a leftover folder is cleaned up automatically the next time you convert into the same folder (older than one hour).

Symbolic links inside an archive are not followed and not repacked, and archives containing absolute or parent-traversing entry paths (..) are refused outright — a safety measure that prevents a crafted archive from writing outside the staging folder.

5. What is stored on your device

Logs never contain a complete license key, and no file contents or names from your archives are written to them. Logs are written one file per day and are not pruned automatically in the current version.

Where to find them (Windows):

• Preferences: %APPDATA%\RarZap\config\config.json
• Logs: %LOCALAPPDATA%\RarZap\data\logs
• License: %APPDATA%\com.indmak.rarzap\license.json

On macOS and Linux the equivalent standard application-data folders are used. The in-app path is always one click away: Settings → Privacy → Open log folder.

6. Network access

The free edition makes no network requests whatsoever. The commercial edition contacts our license service in exactly these situations:

What is sent in those requests (the complete payload):

{
  "licenseKey": "IND-XXXX-XXXX-XXXXXXXX",
  "deviceFingerprint": "sha256:9f2c…",
  "deviceName": "WORKSTATION-AB12"
}

No file data, no file names, no paths, no usage statistics. Never sent: archive contents, archive names, folder structures, your output paths, your settings, your language, or any advertising identifier.

Transport: all requests use HTTPS (TLS) to https://www.indmak.com. A backup hostname (indmak.654880040.workers.dev) is used only if the primary host is unreachable. Verification results are signed (Ed25519, verified against a public key embedded in the binary), so a compromised network path cannot grant a license.

7. Device fingerprint

To enforce "one license, one device", the commercial edition derives a device fingerprint: Windows uses the MachineGuid registry value; macOS uses IOPlatformUUID; Linux uses /etc/machine-id. The raw identifier is never transmitted and never logged — only a SHA-256 hash, formatted as sha256:<hex>, is sent. It binds your license to this machine and counts seat usage (limit: 1 device per license).

If you reinstall the OS the fingerprint can change — that is expected; deactivate the old entry, then activate again. The app shows a short, non-reversible display code (e.g. b6d5d344) so you and our support team can identify the machine without exposing the underlying identifier.

8. Third parties

RarZap does not embed third-party analytics or advertising SDKs. These parties are involved in distribution and payment only:

None of these parties receive your archives or any file data.

9. Data retention

We do not store your files, and we never had access to them.

10. Your rights and controls

• Delete everything local: Settings → Activation → Deactivate this device removes the local license file and releases your seat. Deleting config.json and the log folder removes the rest.
• Stop all network activity: do not activate a license. Without a license the commercial edition still converts single files and performs no license requests. The free edition never performs any.
• Access / portability: the only personal data we hold is the license record and its device binding. Request a copy by emailing support@indmak.com.
• Erasure: ask us to delete the license record. We cannot delete payment records our merchant of record is legally required to keep.
• Objection / restriction: contact us and we will explain what is stored and how to remove it.

Depending on where you live (e.g. GDPR or CCPA/CPRA), you may have additional statutory rights. We honour those requests regardless of residency.

11. Security measures

• Local processing by default — no file ever needs to leave your machine.
• Minimal data — a hashed device identifier (not raw); a masked license key in logs (never full).
• Signed licenses — offline license files are verified with Ed25519 against a pinned public key, with strict signature checking.
• Protected storage — on Windows the license blob is encrypted with DPAPI (bound to your account), so copying it elsewhere does not work; on macOS/Linux it is owner-readable only.
• Transport security — all license traffic uses HTTPS.
• Fail-closed behaviour — an undecryptable/invalid license is treated as invalid, not downgraded.
• No secret logging — keys are never written to logs in full or included in error messages.

If you believe you have found a vulnerability, please contact us privately (see the Support page) rather than opening a public issue.

12. International transfers

Our license service and payment provider operate on global infrastructure, so the limited license metadata described above may be processed outside your country. We rely on standard contractual protections offered by those providers. No file data is involved in any transfer.

13. Children's privacy

RarZap is a general-purpose utility and is not directed at children. We do not knowingly collect data from children, and the product collects no personal data beyond what is described above.

14. Changes to this policy

If this policy changes materially, we will update the "Last updated" date and note the change in the release notes. Continued use after an update constitutes acceptance of the revised policy.

15. Contact

• Privacy questions, data access, or deletion: support@indmak.com
• Support centre: indmak.com/support-center
• Purchase: indmak.com/buy/rarzap

Appendix A — exact network requests

Rate limits: activation and deactivation are limited per source IP; the app surfaces rate limiting as a retryable error and does not retry aggressively.

Appendix B — what a log line looks like

2026-10-12T09:14:02Z INFO rarzap_pro::pro_state: license state detected licensed=true fp=b6d5d344
2026-10-12T09:14:03Z INFO rarzap_pro::view: batch: added added=3 total=3
2026-10-12T09:14:31Z WARN rarzap_pro::pro_state: activation failed code=invalid_license

• fp is the short display code derived from the hashed fingerprint.
• code is a machine-readable error identifier, not your key.
• File paths may appear in conversion error lines; review before sharing logs publicly.

Appendix C — where files live

Use Settings → Privacy → Open log folder to jump straight to the log directory on any platform.

Appendix D — free edition differences