Privacy Policy

**DRAFT — not legally reviewed.** This document is an engineering draft prepared under QONTAI-119. It must be reviewed and approved by qualified legal counsel before publication.

1. Who we are

QontaineR ("we", "us", "our") is a service that helps you catalogue the contents of physical containers using printed QR codes and a companion mobile app.

• **Legal entity:** _[TO CONFIRM — legal entity name, company number, registered address]_

• **Contact for privacy queries:** support@qontainer.app

• **Data Protection lead:** _[TO CONFIRM — named contact where required]_

This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have over it.

2. Scope

This policy covers:

• The QontaineR website (`qontainer.dev` and related domains).

• The QontaineR mobile app for iOS and Android.

• Related APIs used by the website and mobile app.

It does not cover third-party sites you may reach through links from our service.

3. Data we collect

3.1 Account data

When you create or use an account, we process:

• Email address (stored encrypted at rest; used for sign-in, verification, and transactional communication). Email addresses on pending family invitations are also encrypted and indexed using a keyed, non-reversible hash.

• Display name.

• Password hash (never the plain password).

• Multi-factor authentication material where you enable it: TOTP secret, WebAuthn/passkey public keys and credential IDs.

• OAuth linkage where you sign in with a third-party provider (Google, Apple), including the provider identifier and access, refresh, or ID tokens returned by the provider where Auth.js requires them to maintain the connection. These records are removed during right-to-be-forgotten anonymisation.

• Recovery codes (hashed) where generated.

• Account role (regular user, support, admin — internal).

• Account status (active, deleted, anonymised).

• Timestamps: account created, email verified, last sign-in.

• Legal document acceptance records: document type, version, acceptance or acknowledgement time, and the application surface where it was recorded.

3.2 Container and QR data

When you use the product, we process:

• QR codes you generate or claim, including their opaque codes and creation timestamps.

• Container records you create: label, description, storage location, dates added, alarm/reminder settings.

• Prefix records used to group QR codes.

• Print history (whether a QR has been printed).

3.3 Family / sharing data

• Families you create or join.

• Your role within a family (owner, member, or viewer).

• Pending invitations you have sent or received.

3.4 Session and device data

• Web sessions (opaque session identifiers stored in a cookie).

• Mobile sessions (opaque session tokens, revocation state).

• Registered devices: opaque device identifier, platform (iOS/Android), app version, and last-seen timestamp.

• Web push subscriptions: endpoint URL, key material required to send push. We do not display or export the key material through support tooling.

3.5 Notifications

• Your notification preferences (reminders, security, marketing where relevant).

• Delivery history for transactional notifications where retained.

3.6 Billing and subscription

• If you subscribe to Premium via the App Store or Google Play, the store handles billing; we receive validation events and subscription state (active, expired, renewed) tied to your account.

• Manual Premium grants applied by our support team (with actor, reason, before/after entitlement) are recorded in an entitlement history.

We never see or store your full payment card number.

3.7 Support interactions

Support requests contain your email address, subject, messages, status, and timestamps. Your email address is encrypted at rest. Tickets are separate from your QontaineR account and remain accessible through email verification, including when you cannot sign in. Authorised support staff can read tickets; administrators can reply.

• Support notes staff add to your account for context (visible to authorised staff only).

• Records of support actions (session revocation, entitlement changes, GDPR request handling).

3.8 Audit and security logs

• Sign-in and sign-out events, including failed attempts and MFA challenges.

• Password reset, email change, MFA enrolment/reset events.

• Administrative actions taken on your account.

3.9 Browser preferences

Some preferences are stored only on the device you are using and are not sent to us as data about you or attached to your account:

• **Theme.** A `theme` cookie remembers whether you prefer light or dark mode.

• **Sidebar layout.** A `sidebar_collapsed` cookie remembers whether you have chosen to collapse the left sidebar.

These cookies are read by our servers only while rendering a page for you, so we can serve the right localised text, theme, and layout. We do not persist them alongside your account record, correlate them with other account data, or use them for tracking. If you sign out or clear cookies, they are gone.

3.10 Technical and diagnostic data

• IP address at the time of security-relevant events, where retained.

• Browser or app user agent.

• Server-side error and performance logs (may include identifiers necessary to correlate an event to your account for security and debugging).

• If you opt into diagnostics in Cookie Settings, masked browser error reports, performance traces, and logs. Ordinary sessions are not sampled for replay; a replay may be captured when Sentry records an error. Replay masks text and inputs and blocks media, but may still capture interaction and technical metadata.

We do **not** use advertising trackers or sell personal data. Optional browser diagnostics are provided by Sentry and remain disabled until you opt in.

4. How we collect it

• Directly from you (sign-up, sign-in, container creation, mobile scans, preferences).

• Automatically when you use the service (session cookies, device registration, audit events).

• From authentication providers when you use Google or Apple sign-in (identifier and, where you consent, name/email).

• From payment/store providers via webhook (subscription state, purchase validation).

5. Why we use it and our lawful basis (UK / EU GDPR)

6. Who we share it with

We use Resend to send support access links and reply notifications, and Cloudflare Turnstile to protect the support forms against automated abuse. Turnstile processes browser and network signals for this security check. Support messages are not included in notification emails.

We share personal data only with:

• **Hosting infrastructure** used to run the service _[TO CONFIRM — self-hosted on Nomad/Vault or named provider]_.

• **Transactional email provider (Resend)** for verification, security, and family-invitation emails.

• **Feature-flag provider (LaunchDarkly)** for evaluating feature availability. Browser evaluation is optional. Evaluation context can contain your internal user ID and display name.

• **Diagnostics provider (Sentry)** for server reliability and security diagnostics and, where you opt in, masked browser diagnostics and replay.

• **App Store or Google Play** where you purchase Premium, so they can process billing and inform us of subscription state.

• **Authentication providers (Google, Apple)** where you choose to sign in with them.

• **Law enforcement or regulators** where legally required.

We do not sell personal data. We do not share data for third-party advertising.

Each processor is bound by a data processing agreement.

Third-party processors — content moderation

Uploaded images and their thumbnails are stored in Cloudflare R2. When image moderation is enabled, our servers send the image bytes to Amazon Web Services (AWS) Rekognition for content moderation to identify potentially unsafe content.

We currently use Rekognition in the AWS Europe (London) region (eu-west-2), in the United Kingdom. For operational or resilience reasons, we may move Rekognition moderation processing to another AWS region within the United Kingdom or European Economic Area, including Europe (Ireland) (eu-west-1) or Europe (Frankfurt) (eu-central-1). Any such transfer remains subject to the safeguards described in section 7.

We store the returned moderation labels and confidence scores with the moderation decision for audit and review. Images rejected by automated moderation or subsequent review, including their thumbnails, are deleted from Cloudflare R2 storage.

7. International transfers

Where processors are located outside your jurisdiction, transfers are protected by an appropriate mechanism (adequacy decision, UK IDTA, EU Standard Contractual Clauses, or supplementary measures as required).

_[TO CONFIRM — specific provider locations and transfer mechanisms]_

8. How long we keep it

• **Account data:** while your account is active. Closing an account marks it deleted and revokes access. A separately verified erasure request triggers anonymisation of directly identifying fields. _[TO CONFIRM — whether a recovery period will be offered and its duration]._

• **Container and QR data:** until you delete the record or your account.

• **Session and device data:** until the session/device is revoked, expires, or you sign out.

• **Audit and security logs:** retained for a bounded period sufficient for incident review and legal obligations _[TO CONFIRM — specific retention window]_.

• **Support notes and entitlement history:** retained for as long as needed to support the account and demonstrate audit trail.

• **Legal acceptance records:** retained with the account, and afterwards where needed to establish which terms applied or to meet a legal obligation. _[TO CONFIRM — final limitation-period-based retention window]._

• **Billing records:** retained per statutory accounting requirements (typically 6 years in the UK).

Closing an account and requesting erasure are separate operations. Erasure anonymises directly identifying account fields and deletes authentication-provider links. Container, QR, audit, entitlement, support, and request records may be retained only where a documented legal or operational ground applies. _[TO CONFIRM — category-specific retention and deletion schedule]._

9. Your rights

Under UK / EU GDPR you have the right to:

• **Access** the personal data we hold about you.

• **Rectify** inaccurate data.

• **Erasure** ("right to be forgotten") subject to legal retention exceptions.

• **Restrict** processing in certain circumstances.

• **Object** to processing based on legitimate interest.

• **Data portability** for data you provided under contract or consent.

• **Withdraw consent** at any time for anything you opted into.

• **Lodge a complaint** with your supervisory authority (in the UK, the Information Commissioner's Office; in the EU, your national DPA).

You can exercise these rights from within the app (account settings) or by contacting us. Some rights are subject to identity verification.

10. Security

• Email addresses are encrypted at rest with an environment-managed key.

• Passwords are stored as one-way hashes, never in plaintext.

• Multi-factor authentication (TOTP, passkeys) is supported and recommended.

• Sessions can be revoked from the app; support staff can revoke sessions to help you regain account control.

• All traffic is served over TLS.

• Access to production data is restricted, role-gated, and logged.

No system is perfectly secure. Please keep your credentials safe and enable MFA.

11. Children

QontaineR is not currently designed for independent use by children. _[TO CONFIRM — minimum contractual age and the outcome of the Children's Code “likely to be accessed” assessment]._ If the Service is likely to be accessed by children, we will apply age-appropriate design, high-privacy defaults, data minimisation, appropriate age assurance, and child-friendly explanations before offering it to them.

12. Cookies

The website uses cookies necessary for authentication and security. Optional browser preferences, diagnostics, and feature flags remain off until you choose them. See the [Cookie Policy](./cookie-policy.md) for details.

13. Changes to this policy

We assign each published policy a version and last-updated date. We record when an account holder acknowledges the current policy; acknowledgement is not consent to optional processing. Material changes are shown in the Service and must be acknowledged before continued account use where required.

14. Contact

support@qontainer.app

_[TO CONFIRM — postal address and DPO contact where required]_

Draft appendix — engineer notes (remove before publication)

• **Placeholders to resolve:** legal entity, contact addresses, hosting/email provider names, retention windows, age gate, transfer mechanisms.

• **Cross-references:** relies on Cookie Policy (QONTAI-121) and Admin console GDPR workflow spec (`docs/superpowers/specs/2026-07-14-admin-support-console.md`).

• **App-store alignment:** ensure this policy answers every question on the Apple Privacy Nutrition Label and Google Play Data Safety form.