Bracket privacy policy

1. Summary

Bracket does not collect personal data. All app data is stored locally on your device. The app does not include analytics, telemetry, advertising, or crash reporting. No account is required to use the app.

2. Data Bracket stores on your device

Bracket stores its working data (your settings, history, and content) in the app's private storage on your device. This data never leaves your device through Bracket. You can clear it at any time by clearing the app's storage in Android Settings, or by uninstalling the app.

Android's own backup system may include this data in your Google account backup if you have device backup enabled in Android Settings. That backup is controlled by Google and by your device settings; Kuroki Studio cannot access it.

3. Permissions Bracket requests and why

Camera (android.permission.CAMERA)

For live QR and barcode scanning. The camera is active only while you are on the scan screen. No video is recorded; frames are processed in memory and discarded.

Photos and media (android.permission.READ_MEDIA_IMAGES)

To scan a barcode out of an image you pick from your gallery, and to pick a logo image for the QR designer.

Storage (legacy Android) (android.permission.READ_EXTERNAL_STORAGE)

On older Android versions, used in the same way as the media permission above, and to pick a PDF for the scan-from-PDF flow.

Precise location (android.permission.ACCESS_FINE_LOCATION)

Required by Android (since Android 10) to programmatically add a Wi-Fi network configuration when you tap "Connect" on a scanned Wi-Fi QR code. Your location is never read, stored, or transmitted; the permission is solely the gate Android places on programmatic Wi-Fi changes.

Wi-Fi state (android.permission.ACCESS_WIFI_STATE)

To detect that the device has Wi-Fi and to support the one-tap connect-to-Wi-Fi-QR flow.

Change Wi-Fi state (android.permission.CHANGE_WIFI_STATE)

To let you connect to a network by scanning its Wi-Fi QR code.

Internet (android.permission.INTERNET)

Used for the RevenueCat purchase and restore flow, and, if you opt in to Online URL safety in Settings (off by default), for downloading the community threat-intelligence feeds you enable. Bracket matches scanned URLs against those downloaded feeds on your device; the scanned URLs are not sent out.

Vibrate (android.permission.VIBRATE)

Tactile feedback on a successful scan. Toggleable in Settings.

4. Third-party services used in Bracket

Bracket is a paid app. To process your purchase and restore it on reinstall or a new device, it uses Google Play Billing and RevenueCat. Where an app also has an optional feature that reaches the network (for example fetching live currency rates), the service behind that feature is listed below with the exact purpose it serves and the data it receives. No third-party services beyond those listed here are used.

Google Play Billing

Purpose: Processes the in-app purchase itself. All payment handling is performed by Google.

Data shared: Whatever Google Play collects to process a purchase on your Google account. Kuroki Studio never sees your payment details.

Their policy: https://policies.google.com/privacy

RevenueCat

Purpose: Verifies your purchase and restores it on reinstall or device change.

Data shared: An anonymous app-install identifier, the Google Play purchase token, your device platform and app version, and country (derived from IP at the time of purchase). No name, email, contacts, or location is sent.

Their policy: https://www.revenuecat.com/privacy/

URLhaus by abuse.ch (optional · off by default)

Purpose: If you enable it under Settings → Privacy → Online URL safety, Bracket downloads URLhaus's public list of recent malicious URLs to your device and checks scanned codes against that local copy.

Data shared: Only the standard metadata any web server receives when Bracket downloads the public feed: your IP address and a fixed request URL (urlhaus.abuse.ch/downloads/csv_recent/). The scanned URL is matched on your device and is never sent to URLhaus. No installation identifier, device identifier, user identifier, or RevenueCat identifier is attached, and Kuroki Studio operates no server in between.

Their policy: https://urlhaus.abuse.ch/

ThreatFox by abuse.ch (optional · off by default)

Purpose: If you enable it under Settings → Privacy → Online URL safety, Bracket downloads ThreatFox's public lists of recent malicious URLs and domains to your device and checks scanned codes against that local copy.

Data shared: Only the standard metadata any web server receives when Bracket downloads the public feeds: your IP address and fixed request URLs (threatfox.abuse.ch/export/csv/urls/recent/ and the matching domains feed). The scanned URL is matched on your device and is never sent to ThreatFox. No installation, device, user, or RevenueCat identifier is attached.

Their policy: https://threatfox.abuse.ch/

PhishTank (optional · off by default · requires your own API key)

Purpose: If you enable it under Settings → Privacy → Online URL safety and supply your own PhishTank API key, Bracket downloads PhishTank's verified-phishing list to your device and checks scanned codes against that local copy.

Data shared: Only the standard metadata any web server receives when Bracket downloads the public list, including the PhishTank API key you entered (it appears in the request URL, data.phishtank.com/data/<your-key>/online-valid.csv). Your API key is stored only on your device. The scanned URL is matched on your device and is never sent to PhishTank.

Their policy: https://phishtank.org/

5. Children's privacy

Bracket is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Kuroki Studio does not knowingly collect any data from children. Because Bracket does not collect personal data from anyone, this also applies to children who use the app.

6. Your rights

Because Kuroki Studio does not hold any personal data about you in connection with Bracket, there is no personal-data record to access, correct, port, or erase on our end. To remove the app data stored on your device, clear the app's storage in Android Settings or uninstall the app. See the account and data deletion page for details.

Under Japan's Act on the Protection of Personal Information (APPI), under the EU General Data Protection Regulation (GDPR), under the UK GDPR, and under the California Consumer Privacy Act (CCPA), you have rights including access, correction, deletion, and (where applicable) the right to lodge a complaint with your data protection authority. If you have any question or request related to your privacy as it concerns Bracket, contact privacy@kurokistudio.com.

7. Changes to this policy

If Kuroki Studio changes this policy, the new version will be posted at this URL and the effective date at the top will be updated. Material changes (such as introducing a new third-party service) will additionally be noted in the app's Play Store "What's new" entry.

8. Contact

Kuroki Studio (Sole proprietorship, Kumamoto, Japan; D-U-N-S 699200333).
Privacy questions: privacy@kurokistudio.com
General support: support@kurokistudio.com