Privacy Policy of QRVault Pro

1. Data controller

• Controller: CraftingBits (Aïda Díaz Giménez)
• Tax ID: 77632530D
• Address: Plaza Maruja Mallo, Pontevedra, Spain
• Contact: legal@craftingbits.es

2. Local storage

Every code you scan or create, along with your notes, tags, favorites and folder structure, is stored 100% locally on your device. We do not transmit, sync or remotely access this content, and we keep no copy on our servers.

The app lets you export your data to CSV, JSON or plain text and import JSON backups. Those exports are generated and kept by you, in the location you choose; they never pass through us.

3. Camera, OCR and NFC

The app may request access to the camera to scan QR and barcode codes, and to capture images you want to convert to text via OCR. It may also read NFC tags when you choose to.

• All processing (code reading, OCR and NFC reading) happens on your device.
• Images are not sent to our servers or third parties, and are not stored unless you choose to save them.
• You can revoke permissions at any time from your operating system settings. If you do, the related features become unavailable, but the rest of the app keeps working.

4. Biometric lock and encryption

The app and private vault lock use biometrics (fingerprint or face) or the device's PIN, pattern or password through the operating system APIs. We never receive or store your biometric data: verification is performed by the system, and the app only receives whether unlocking succeeded.

You can optionally enable local database encryption (SQLCipher). In that case, content is stored encrypted on your device and the key is managed locally.

5. Purchases and Google Play

QRVault Pro is purchased through a one-time payment on Google Play. The purchase, charge and refund management are handled by Google under its terms and privacy policy. We do not receive or store your card details or payment information.

The app has no in-app purchases, subscriptions or advertising.

6. System backup

If you have Android backup enabled, the system may include the app's data in that backup. The backup is managed by Android/Google under your own settings and does not pass through us. You can disable it in your device settings.

7. Children

The app is not specifically directed at children and we do not deliberately collect data from children. Because it includes no advertising or analytics, no advertising-related processing of children's data takes place.

The minimum age to use the app is 16 years old, as detailed in our Terms and Conditions. In accordance with Article 8 of the GDPR, where the applicable digital consent age in your country is lower, the consent of your parent or legal guardian will be required.

8. Your rights

Under the GDPR and LOPDGDD, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase your data.
• Object to the processing.
• Restrict processing in certain cases.
• Data portability, where applicable.

Since the content you create (codes, notes, folders) is exclusively local, you can exercise these rights over that content by clearing the app's data from your device settings or uninstalling the app. You can also export it before deleting it.

For any other request, contact us at legal@craftingbits.es.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es, or with the data protection authority of your country of residence.

If you reside in the United Kingdom, you can lodge a complaint with the Information Commissioner's Office (ICO) — ico.org.uk —.

9. California / United States residents (CCPA/CPRA)

If you reside in California, the CCPA/CPRA may give you additional rights over your personal data. We do not sell or share personal data for advertising purposes: the app includes no ads, analytics or trackers.

• Right to know what personal data we process.
• Right to delete your personal data.
• Right to correct inaccurate data.
• Non-discrimination for exercising any of these rights.

Because content is local, you can delete it directly by clearing the app's data or uninstalling it.

10. Users in Brazil (LGPD)

If you reside in Brazil, this policy is also governed by the Brazilian General Data Protection Law (LGPD). Because the app includes no advertising or analytics, we do not process data for advertising purposes.

For any questions about the processing of your personal data under the LGPD, contact our Data Protection Officer (Encarregado de Proteção de Dados) at legal@craftingbits.es.

You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) — www.gov.br/anpd —.

11. Data retention and deletion

As we do not store your content on our own servers, we do not set a retention period on our side: that content stays on your device until you delete it or uninstall the app.

Deletion of your data: you can delete it at any time by clearing the app's data from your device settings or uninstalling the app. We store no data on servers, so there is no data for us to delete.

12. Changes to this policy

We may update this policy occasionally. Any change will be reflected by updating the "Last updated" date at the top of this document. If the change is substantial, we will notify you via an in-app notice before it takes effect.

13. Contact

For any questions about this policy or how we handle your data, write to us at legal@craftingbits.es.