Privacy Policy

OpenSyntaxx L.L.C-FZ, a limited liability company licensed in the Meydan Free Zone, Dubai, United Arab Emirates, with its registered address at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, operates opensyntaxx.com, api.opensyntaxx.com, and the iosy product. It is the controller of the personal data described in this policy.

Privacy questions and requests can be sent to support@opensyntaxx.com.

iosy runs locally on your machine. OpenSyntaxx web services do not receive IPA files, generated Swift files, app binaries, app names, bundle identifiers, local project contents, or decompilation output.

The website is used for accounts, downloads, subscriptions, billing links, email verification, SSO, and license activation. The decompilation work stays on your workstation.

We collect the information needed to operate OpenSyntaxx accounts, subscriptions, and licensing:

• Account details such as name, email address, account ID, account creation time, and email status.
• Password hashes for password-based accounts. We do not store plaintext passwords.
• Legal consent records, including accepted Terms and Privacy Policy versions and timestamps.
• Session records used to keep you signed in.
• OAuth identity metadata when you use Google or Microsoft SSO.
• Dodo customer, subscription, checkout, invoice, payment status, and billing portal identifiers.
• CLI and license metadata such as machine ID, optional machine name, platform, app version, activation session ID, activation time, last validation time, and revoked session status.
• Short-lived CLI login request metadata, including device/user code hashes, status, expiry, polling metadata, and client key hashes.
• Security and rate-limit metadata, including hashed request keys and attempt counters.
• IP address and the country derived from it, used for rate limiting, abuse prevention, and deciding whether cookie consent is required before analytics can load.
• Browser time zone, used only as a fallback when no country signal is available.
• Product usage events recorded on our own servers: page views, sign-up and email verification steps, CLI sign-ins, checkout starts, subscription changes, downloads, and example-file downloads. Each event holds the page path with its query string removed, the day, the country, your account ID when you are signed in, and a short fixed list of technical fields such as plan code and platform.
• For file downloads we additionally record the IP address the request came from, the browser user agent it sent, and the host of the referring site. We use this to understand how the product is distributed and to tell real downloads apart from automated ones. These fields are kept with the event and removed when the event reaches the end of its retention period.
• A first-party cookie identifier that distinguishes one browser from another before you have an account. If you later create an account, we associate that identifier with it, which means activity we recorded before you signed up becomes linked to your account. The association is made once, to the first account created from that browser, and is not undone by a later sign-up.
• A count of iosy license checks per account. iosy contacts the license server when it decompiles and when you run an authentication status check, so this is a count of license checks and not a record of what you decompiled. As stated in section 2, we never receive IPA files, app names, bundle identifiers, or any decompilation output.
• Acquisition details from the address you arrived on: UTM parameters, the host of the referring site, and the landing page path. These are recorded for the first visit and for the most recent visit that came from an external source.

We use necessary cookies for sign-in, security, legal consent, and account operation. These cookies are required for the service to work. All cookies we set ourselves are first-party, restricted to opensyntaxx.com, and are not readable by other sites.

We measure our own traffic with software we run on our own AWS infrastructure. That measurement covers only opensyntaxx.com, does not follow you to other sites, builds no advertising or marketing profile, and is never sold or shared with advertising networks. The opensyntaxx_attr cookie exists for this purpose alone.

Separately, we use Google Analytics to understand page traffic and basic site usage. In GDPR and privacy-regulated regions, Google Analytics loads only after you accept analytics cookies. Outside those regions, Google Analytics is enabled by default.

Where consent is required you can reject analytics in the cookie banner, and the Cookie settings button reopens that choice at any time. Everywhere else you can opt out with Google's browser add-on or by blocking analytics cookies in your browser. Analytics is never loaded on sign-in, sign-up, password reset, email verification, or CLI approval pages, and the URLs of those pages are never recorded.

We use collected information to:

• Create, secure, and manage accounts.
• Send email verification codes, account notices, and service messages.
• Link Google or Microsoft SSO identities to OpenSyntaxx accounts.
• Create checkout sessions, sync subscription status, and show billing information.
• Activate, validate, revoke, and enforce iosy license access.
• Prevent abuse, rate-limit sensitive flows, troubleshoot errors, and protect the service.
• Measure website traffic and improve public pages when analytics is enabled.
• Measure which pages, campaigns, and referring sites lead to sign-ups and subscriptions, so we know where to invest.
• Understand how far accounts get through sign-up, verification, CLI sign-in, and checkout, and how often licensed accounts actually run iosy.
• Comply with tax, payment, accounting, security, and legal obligations.

We use third-party service providers to operate OpenSyntaxx:

• AWS services, including DynamoDB for application state and SES for email delivery.
• Dodo Payments for checkout, subscriptions, payment methods, taxes, invoices, billing history, and refunds where applicable.
• Google and Microsoft when you choose to sign in with SSO.
• Google Analytics for traffic measurement when analytics is enabled.

These providers process information according to their own terms and privacy notices, and only to the extent needed for the services they provide to OpenSyntaxx or to you.

Our own usage and acquisition measurement is not one of these providers. It is stored in our own AWS account, is not sent to any analytics, advertising, or data-broker service, and is not combined with data from any other site.

Payment card details are handled by Dodo Payments and its payment infrastructure. OpenSyntaxx stores billing identifiers, subscription status, plan information, renewal dates, cancellation state, and payment history summaries needed to show your account and enforce access.

Dodo Payments may send OpenSyntaxx webhook events and subscription snapshots so your OpenSyntaxx account reflects current paid, trial, past-due, cancelled, expired, or failed billing states.

We keep account, subscription, billing, consent, license, and security records for as long as needed to provide the service, maintain account history, resolve disputes, prevent abuse, comply with tax and accounting requirements, and meet legal obligations.

Individual usage events are deleted automatically 180 days after they are recorded, and per-day per-account activity markers after 45 days. The counts and totals derived from them carry no event detail and are kept for as long as we run the service.

Short-lived verification and CLI login records expire or are pruned as part of normal service operation. If you ask us to delete your account, we will delete or anonymize information unless we need to keep it for legal, tax, billing, security, or legitimate operational reasons.

We use technical and organizational measures designed to protect account, billing, license, and service metadata. No internet service can be guaranteed to be perfectly secure.

You are responsible for keeping your password, SSO account, local machine, generated files, and iosy activation tokens secure.

You can update account and billing information through your OpenSyntaxx account and the Dodo billing portal when available. You may contact us to request access, correction, deletion, export, or restriction of personal information.

Your rights depend on your location and applicable law. We may need to verify your identity before completing a request.

OpenSyntaxx and its service providers may process information in countries other than where you live. Where required, we rely on appropriate legal mechanisms for cross-border processing.

OpenSyntaxx is not intended for children. You must be at least 18 years old, or the age of legal majority where you live, to create an account.

We may update this Privacy Policy from time to time. If a change is material, we will take reasonable steps to notify account holders. The latest version will be posted on this page.