⚡ ZapQR

Privacy Policy

Last updated: September 2, 2026

Overview

ZapQR is designed with privacy as a core principle. Your passwords and sensitive data are stored locally on your device and are never transmitted to or stored on our servers.

Data We Collect

Data We Do NOT Collect

  • Your passwords or credentials
  • Your master password
  • Contents of your password vault
  • Websites you visit
  • Personal identification information

Data We May Collect

  • Anonymous usage analytics: App opens, feature usage (no personal data)
  • Crash reports: Technical information to fix bugs
  • Device type: iOS version, device model (for compatibility)

How ZapQR Works

Password Storage

All passwords are encrypted using AES-256 encryption and stored locally on your device using iOS Keychain. Your master password never leaves your device.

QR Code Autofill

When you scan a QR code to fill a password:

  1. The browser extension creates a temporary session ID
  2. Your phone connects to our relay server using this session ID
  3. Credentials are transmitted directly to the browser
  4. The relay server only sees encrypted data — never your actual credentials
  5. The session is deleted immediately after use

ZapQR for Android

What we collect: nothing. ZapQR for Android has no account system, no analytics, no crash reporting and no advertising. The app does not transmit your vault, your passwords, your passkeys, your one-time-code secrets, or any usage data to DaSecure or to anyone else.

Where your data lives

Everything you save is stored in an encrypted database on your phone (SQLCipher, AES-256). The encryption key is generated on your phone and protected by Android's hardware-backed Keystore (StrongBox where the device has it), and can only be used after you unlock with your fingerprint, face, or screen lock. There is no master password and DaSecure never has a copy of your key. Your vault is excluded from Android cloud backup and device-to-device transfer.

Autofill and passkeys

When you choose ZapQR as your Android autofill service or passkey provider, the Android system asks ZapQR for a credential for the app or website you are using. ZapQR answers from your on-device vault after you authenticate. Nothing is sent to us. Passkey private keys are created on your phone and stored only in your vault.

QR sign-in, camera, clipboard, backups

  • Scanning a "Sign in with ZapQR" code opens the ZapQR sign-in page (auth.zapqr.ai) in your browser; the app itself only opens the link.
  • The camera is used only while the scanner is open, to read QR codes on-device. No images are stored or uploaded.
  • Copied passwords and codes are marked sensitive so Android hides them from previews, and are cleared after 30 seconds.
  • Export produces a file encrypted with a passphrase you choose. We never see the file or the passphrase; if you lose the passphrase the file cannot be opened.

Deleting your data

Uninstalling the app permanently destroys the vault and its key. You can also clear the app's storage in Android Settings. We will update this section before any version of the Android app starts using a network service (for example optional vault sync or push notifications).

ZapLock (Mac, iPhone, iPad, Android)

ZapLock encrypts a folder you choose, in place, and unlocks it after you sign in with ZapQR. Unlike the apps above, ZapLock does use an account, because the key that opens a folder is split between your device and our server.

What we collect

  • Your email address and account identifier — to sign you in, to hold your account, and so a folder can be shared with you by address. Required.
  • A device identifier and public key for each device you enrol — generated by the app, not read from your phone or computer. It binds your key shares to the devices you approved. Required.
  • The identifier and name of each protected folder, and the encrypted key share for it — so the right half-key is released to the right device.
  • A security event log — sign-ins, device enrolments, folders shared and access revoked.

All of it is used only to make the app work and to manage your account. None of it is shared with third parties, sold, or used for advertising, analytics or tracking. ZapLock contains no advertising or analytics SDKs. Everything is encrypted in transit.

What we never collect

Your files. ZapLock encrypts and decrypts on your device: file contents and file names never leave it, and neither does a whole key. We hold one half of a split key and cannot open a folder with it. Your folders stay on your own disks and in your own cloud storage.

Deleting your ZapLock data

Deleting your ZapQR account removes everything listed above except the security event log, which we keep for security and fraud prevention. Unlock anything you still want to read before you delete: once the account is gone, the server half of the key is gone with it and a locked folder cannot be opened again by anyone, including us. See how to delete your account.

Chrome Extension

The ZapQR Chrome extension:

  • Only activates when you click the ⚡ button
  • Does not track your browsing history
  • Does not store any passwords
  • Does not send data to third parties
  • Stores only your preferences (theme settings) locally

Third-Party Services

We may use the following third-party services:

  • Apple App Store: For app distribution
  • Vercel: For hosting our website
  • Railway: For hosting our relay server

These services have their own privacy policies and do not have access to your passwords.

Data Security

  • AES-256 encryption for all stored passwords
  • iOS Keychain for secure storage
  • TLS 1.3 for all network communications
  • Zero-knowledge architecture — we cannot access your data

Your Rights

You have the right to:

  • Delete your data at any time by uninstalling the app
  • Export your passwords from the app
  • Request information about data we may have
  • Opt out of analytics (in app settings)

Children's Privacy

ZapQR is not intended for children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We will notify users of significant changes through the app or website.

Contact Us

If you have questions about this privacy policy:

privacy@dasecure.com

DaSecure Solutions LLC
United States

← Back to ZapQR