Privacy Policy

1. Controller

2. EU/EEA representative

Our representative under Art. 27 GDPR is DataRep. You may contact DataRep in any EU/EEA member state or the UK/Switzerland at datarequest@datarep.com (please reference “KyotoTech; SaQura”) or via www.datarep.com/data-request.

3. Our principle: no personal data by default

SaQura Pass is designed to work without collecting your personal data. You need no account, e-mail address or phone number. We do not track you, show no advertising, and use no third-party analytics.

4. Data on your device

Your passwords, entries, notes, folders, activity log and settings are stored only on your device, encrypted at rest with AES-256-GCM. Where your operating system provides a secure key store (for example, the Android Keystore or the Apple Keychain / Secure Enclave), the app uses it to protect your keys; on other systems, your data is encrypted with a key derived from your master password. Your master password and recovery phrase never leave your device and are never sent to us; we have no access to any of this data. Your data is included in operating-system or platform backups only to the extent your platform (for example, Google or Apple) provides; on a desktop system, you manage your own backups.

5. Backups and optional syncing

Backups you create are encrypted files that only you can open (with your recovery phrase or master password); you choose where to store them. Optional device pairing and local-network synchronisation are off until you enable them; when used, your data is end-to-end encrypted on your device with quantum-safe cryptography before it leaves and travels directly between your own devices — it does not pass through our servers.

6. Diagnostics (voluntary)

The app keeps a local, tamper-evident activity log. Nothing is sent to us automatically. From Settings you may choose to share an anonymized diagnostic report (app, operating system, device model and version; event types and timestamps) to help us improve the app. It contains no passwords, secrets, entry names or contents. You decide whether and how to send it using your device’s share options; this is based on your consent.

7. Platform provider

SaQura Pass is available for mobile and desktop operating systems (including Android, iOS, Windows and Linux). Where you obtain the app from an app store (for example, Google Play or the Apple App Store), that provider’s terms and privacy policy apply to the platform and to any platform backups; where you download the app directly from us, no app-store provider is involved. We do not share your data with these providers.

8. International transfers

KyotoTech is based in Japan, which the European Commission recognises as providing an adequate level of data protection (adequacy decision, 2019).

9. Your rights

Because we hold no identifying data about you by default, most requests are fulfilled on your device: you can view, export or erase your data in the app at any time, and removing the app deletes everything it stored. Where applicable law (e.g. GDPR or Japan’s APPI) grants you rights — access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority — contact saqura@kyototech.jp or our EU representative (Section 2).

10. Children

SaQura Pass is not directed to children under the age of 16, and we do not knowingly collect data from them.

11. Security and your responsibility

We apply strong technical measures: client-side quantum-safe encryption, encrypted at-rest storage and tamper-evident logging. However, no method of storage is completely secure, and we cannot guarantee absolute security. Because only you hold your master password and recovery phrase, you are solely responsible for keeping them safe: if you lose them, no one — including KyotoTech — can recover your data. See the Terms of Use.

12. Changes to this policy

We may update this policy. Material changes are indicated by an updated effective date in the app; where required we will ask you to accept again. Your continued use after an update constitutes acceptance of the updated policy.

13. Governing law and contact

This policy is governed by the laws of Japan, without prejudice to mandatory protections available to you in your country of residence. Questions: KyotoTech LLC, saqura@kyototech.jp.