Upstairs collects nothing. This page explains why that is a structural fact rather than a promise, and what the few local exceptions are.
Last updated: 7 August 2026 · Applies to Upstairs for iPadOS, iOS and macOS, version 1.0 and later.
We do not collect, transmit, store, sell or share any personal data. We could not if we wanted to: the app ships without network permission, has no account system, and there is no server behind it.
None.
Specifically, and matching the answers we filed in Apple's App Privacy questionnaire, where every category is marked Data Not Collected:
| Category | Collected |
|---|---|
| Contact info (name, email, phone, address) | No |
| Health, fitness, financial info | No |
| Location | No |
| Contacts | No |
| User content (your mail, attachments, search terms) | No |
| Browsing or search history | No |
| Identifiers (user ID, device ID, advertising ID) | No |
| Usage data, analytics, diagnostics, crash logs | No |
| Purchases | No. See In-app purchases |
A privacy policy is usually a statement of intent. This one describes a property of the software that you can check yourself.
The macOS build is distributed without the
com.apple.security.network.client entitlement. Under macOS's App Sandbox, an
app without that entitlement is prevented by the operating system from opening outbound
network connections, regardless of what its code tries to do. To confirm it, run:
codesign -d --entitlements - /Applications/Upstairs.appand look for com.apple.security.network.client in the output. It is not
there.
On the development side the same rule is enforced mechanically: an automated test scans every source file for networking symbols and fails the build if any appear outside the single file that talks to Apple's StoreKit framework.
Archives you open stay on your device. Upstairs opens them read-only and cannot modify them. It builds a local search index alongside the archive so that searching is fast; that index lives in the app's own storage on your device, is never transmitted, and is deleted when you remove the app.
When you grant access to a file, the app stores a security-scoped bookmark so that it can reopen the same file later without asking again. The bookmark is an operating-system token stored locally. It is not readable by us and goes nowhere.
Mail messages frequently contain images hosted on someone else's server. Loading one tells that server you opened the message. Upstairs blocks all remote content by default and shows a banner instead. If you choose to load images for a specific message, your device fetches them directly from whoever hosts them, and that request goes to them, not to us, and it happens only because you asked for it.
Premium is a one-time purchase sold through Apple's In-App Purchase system. There is no subscription. Payment and refunds are handled entirely by Apple. We never see your payment details, and we receive no personally identifying information about you from Apple.
The app asks Apple's StoreKit framework whether this Apple Account currently holds a Premium entitlement and stores the yes-or-no answer locally. That exchange is between your device and Apple. Apple's own privacy policy governs it: apple.com/legal/privacy.
| What | Why |
|---|---|
| Recent archives list | So you can reopen a file without finding it again |
| Security-scoped bookmarks | So reopening does not re-prompt for permission |
| Search index | So search is fast on large archives |
| Free-tier read ledger | To apply the five-message free limit, and to keep messages you already opened free to reopen |
| Premium entitlement flag | So Premium works offline |
All of it is local, all of it is removed when you delete the app, and none of it is transmitted anywhere.
Upstairs is rated 4+ and is safe for any age, because it displays only files the user already has. It collects no data from anyone, including children under 13.
There are none. No analytics provider, no advertising network, no crash reporter, no third-party SDK of any kind. Nothing is shared, because nothing is collected.
Regulations such as the GDPR, the CCPA and Brazil's LGPD give you rights to access, correct, port and erase personal data a company holds about you. We hold none, so there is nothing to access, correct, port or erase. Deleting the app removes everything Upstairs stored, all of which was on your device.
If a future version of Upstairs ever needs to collect anything, this page will be updated before that version ships, and the change will be described in the app's release notes rather than made quietly.
Questions about this policy: bissuh@gmail.com