The app collects nothing unless you ask it to.

The app: what it collects

Nothing, by default. Kopya has no backend for your syncs. Nothing about your files, your jobs, or how you use the app is ever sent to us, and through the app we have no way to identify you or observe how you use it.

Kopya News

The app offers an optional email list, Kopya News, in Getting Started and under Settings → News. Subscribing is entirely up to you: skipping it costs nothing, and no feature depends on it.

• What is sent: only the email address you choose to enter, plus where you subscribed from (Getting Started or Settings). The app does not send your name, your purchase, or anything about your Mac or your files.
• Where it goes: to kopya.ca, which passes it to Eight-Seven’s own installation of Sendy, the software that sends our email. kopya.ca does not keep a copy. Sendy records the address and the network address it came from, as mailing software does to show a subscription was real.
• What it is used for: sending Kopya news and updates, a few times a year. Nothing else, and it is never sold or shared.
• Leaving: every email has an unsubscribe link, or write to [email protected] and we will remove you.

The app remembers that you subscribed, so Settings can say so. It does not store the address on your Mac.

Your files

Kopya copies files between the locations you choose: a folder on your Mac, an external or network drive, or a server you reach over SSH. Those transfers happen directly between your Mac and the destination you configured.

• Your file contents, filenames, and folder paths are never sent to us or to any third party.
• Kopya is sandboxed with a hardened runtime. It can only reach the folders you explicitly pick, through the standard macOS folder picker. Access is held as a security-scoped bookmark tied to that folder.
• Kopya does not require Full Disk Access.

Credentials

If you sync to a remote server, Kopya stores what it needs to connect, on your Mac only:

• SSH private keys are stored inside the app's own container with 0600 permissions.
• Passwords are stored in the macOS Keychain.
• Host fingerprints go in a known_hosts file inside the app's container. Kopya never reads from or writes to ~/.ssh.

None of this leaves your Mac except as part of authenticating the SSH connection you configured.

The app: network activity

The Kopya app makes two kinds of network connection: the SSH transfers you set up yourself, to the hosts you specify, and, only when you press Subscribe, one request to kopya.ca carrying the address you entered for Kopya News. The app does not check for updates over the network, does not load remote content, and does not contact any analytics or advertising service.

This website

Separately from the app, kopya.ca uses Google Analytics to count visits and see which pages people read. It records things like the pages you view, roughly where in the world you are, and what kind of device and browser you use. It does not tell us who you are, and we do not try to work that out.

• Google Analytics sets cookies whose names begin with _ga.
• In the EU, the EEA and the UK, nothing from Google loads until you accept the banner. Decline and no analytics script is fetched and no cookie is set.
• You can change your mind at any time with the cookie choices link in the footer. Declining after accepting also deletes the _ga cookies already set.
• Google describes its own handling of this data in How Google uses information from sites that use its services.

The site also loads a web font from Google Fonts, which means your browser requests a file from Google's servers and Google sees the IP address making that request. No cookie is set by that request.

Forms on this website

• Kopya News signup. The form at the foot of the home page works like the one in the app: the address you enter goes to our own Sendy installation, on a list kept for website subscribers, and is used only for Kopya news and updates. Every email has an unsubscribe link.
• Contact form. What you send through the contact page is emailed to us as a message to [email protected] and treated like any other support email (see below). It is not stored on the website.
• Spam checks. Both forms use Cloudflare Turnstile to tell people from bots. It runs a check in your browser and Cloudflare sees your IP address and browser details to do so; it is not used for advertising. Cloudflare describes it in its Turnstile privacy addendum. Because it is a security check rather than analytics, it loads even if you decline the cookie banner.

Purchases

Kopya is free for one sync job. Unlocking unlimited jobs is a one-time purchase handled entirely by Apple through the App Store. Apple processes the payment and tells the app whether the purchase exists. We never see your name, payment details, or Apple Account. Apple's handling of that transaction is covered by Apple's Privacy Policy.

Support

If you email [email protected] or use the contact form, we receive whatever you put in that message: your email address and anything you choose to tell us. We use it only to answer you, and we do not add it to any mailing list.

Children

Kopya is not directed at children. Apart from an address someone chooses to give for Kopya News, the app collects no information from anyone, regardless of age.

Changes to this policy

If this policy changes, the revised version will be posted here with a new date.

Contact

Questions about this policy can go to [email protected].

Kopya is made by Eight-Seven Inc.