Bloody hell, stop this bullshit already. Users uploads payment hashes to zaplocker.  Zaplocker decides to rug-pull and replaced the user payment hashes with their own payment hashes. Users Bitcoin is gone.

When a user gives their payment hash to a third party and has to trust that third party won't rug-pull them, that's custodial. Being the custodian of payment hashes is still a custodial service.  

Just be honest and tell your users that using your address service requires a certain amount of trust in your company.

The more you keep saying you're lightning address service doesn't rely on trust and is non-custodial, the more you sound like scammers setting up a rug-pull.