Bracket privacy policy

1. Summary

Bracket does not collect personal data. All app data is stored locally on your device. The app does not include analytics, telemetry, advertising, or crash reporting. No account is required to use the app.

2. Data the app stores on your device

Bracket stores its working data (your settings, history, and content) in the app's private storage on your device. This data never leaves your device through Bracket. You can clear it at any time by clearing the app's storage in Android Settings, or by uninstalling the app.

Android's own backup system may include this data in your Google account backup if you have device backup enabled in Android Settings. That backup is controlled by Google and by your device settings; Kuroki Studio cannot access it.

3. Permissions Bracket requests and why

Camera (android.permission.CAMERA)

For live QR and barcode scanning. The camera is active only while you are on the scan screen. No video is recorded; frames are processed in memory and discarded.

Photos and media (android.permission.READ_MEDIA_IMAGES)

To scan a barcode out of an image you pick from your gallery, and to pick a logo image for the QR designer.

Storage (legacy Android) (android.permission.READ_EXTERNAL_STORAGE)

On older Android versions, used in the same way as the media permission above, and to pick a PDF for the scan-from-PDF flow.

Precise location (android.permission.ACCESS_FINE_LOCATION)

Required by Android (since Android 10) to programmatically add a Wi-Fi network configuration when you tap "Connect" on a scanned Wi-Fi QR code. Your location is never read, stored, or transmitted; the permission is solely the gate Android places on programmatic Wi-Fi changes.

Wi-Fi state (android.permission.ACCESS_WIFI_STATE)

To detect that the device has Wi-Fi and to support the one-tap connect-to-Wi-Fi-QR flow.

Change Wi-Fi state (android.permission.CHANGE_WIFI_STATE)

To let you connect to a network by scanning its Wi-Fi QR code.

Internet (android.permission.INTERNET)

Used for the RevenueCat purchase and restore flow, and, if you opt in to Online URL safety in Settings, for the URLhaus threat-intelligence lookups described in Bracket's privacy policy (off by default).

Vibrate (android.permission.VIBRATE)

Tactile feedback on a successful scan. Toggleable in Settings.

4. Third-party services used in Bracket

Bracket is a paid app. To process your purchase and restore it on reinstall or a new device, it uses Google Play Billing and RevenueCat. Where an app also has an optional feature that reaches the network (for example fetching live currency rates), the service behind that feature is listed below with the exact purpose it serves and the data it receives. No third-party services beyond those listed here are used.

Google Play Billing

Purpose: Processes the in-app purchase itself. All payment handling is performed by Google.

Data shared: Whatever Google Play collects to process a purchase on your Google account. Kuroki Studio never sees your payment details.

Their policy: https://policies.google.com/privacy

RevenueCat

Purpose: Verifies your purchase and restores it on reinstall or device change.

Data shared: An anonymous app-install identifier, the Google Play purchase token, your device platform and app version, and country (derived from IP at the time of purchase). No name, email, contacts, or location is sent.

Their policy: https://www.revenuecat.com/privacy/

URLhaus by abuse.ch (optional · off by default)

Purpose: If you opt in to Online URL safety in Bracket's Settings → Privacy, scanned URLs can be checked against the community URLhaus threat-intelligence database. Two modes: a Bundled feed (downloaded at most once every 24 hours on an unmetered connection; per-URL lookups then happen offline against the cached list) or Live (each scanned URL sent for a one-shot lookup, which requires a separate one-time acknowledgment first). Turning the feature off purges the local cache.

Data shared: In Live mode, the URL you scanned. In Bundled mode, nothing per-URL — only the feed itself is downloaded. No installation identifier, device identifier, user identifier, or RevenueCat identifier is attached in either mode. Kuroki Studio does not log, proxy, or observe these requests — there is no Kuroki infrastructure between you and URLhaus.

Their policy: https://urlhaus.abuse.ch/

5. Children's privacy

Bracket is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). Kuroki Studio does not knowingly collect any data from children. Because Bracket does not collect personal data from anyone, this also applies to children who use the app.

6. Your rights

Because Kuroki Studio does not hold any personal data about you in connection with Bracket, there is no personal-data record to access, correct, port, or erase on our end. To remove the app data stored on your device, clear the app's storage in Android Settings or uninstall the app. See the account and data deletion page for details.

Under Japan's Act on the Protection of Personal Information (APPI), under the EU General Data Protection Regulation (GDPR), under the UK GDPR, and under the California Consumer Privacy Act (CCPA), you have rights including access, correction, deletion, and (where applicable) the right to lodge a complaint with your data protection authority. If you have any question or request related to your privacy as it concerns Bracket, contact privacy@kurokistudio.com.

7. Changes to this policy

If Kuroki Studio changes this policy, the new version will be posted at this URL and the effective date at the top will be updated. Material changes (such as introducing a new third-party service) will additionally be noted in the app's Play Store "What's new" entry.

8. Contact

Kuroki Studio (Sole proprietorship, Kumamoto, Japan; D-U-N-S 699200333).
Privacy questions: privacy@kurokistudio.com
General support: support@kurokistudio.com