MUGSHOT Privacy Policy

Last updated: July 8, 2026

MIZUKICHI LAB (“we,” “us,” or “our”) establishes this Privacy Policy (the “Policy”) regarding the handling of User information in the application “MUGSHOT” (the “App”).

This is a reference translation. The Japanese version is the authoritative text; if there is any discrepancy between the Japanese version and a translation, the Japanese version prevails.

1. Basic Principle (Local-First)

The App adopts a local-first design. The App does not require the User to register an account and, in principle, does not send the User’s personal data to our servers or any other external server. As described below, the information the App handles is, in principle, kept entirely on the User’s device. We do not perform any analytics for tracking User behavior, nor do we collect advertising identifiers, location data, or contacts.

2. Information Handled and Its Purpose

To provide its functions, the App handles the following information on the device.

(1) Passcode verification value

• If the User sets a passcode lock, the App does not store the passcode itself. It performs key derivation using PBKDF2-HMAC-SHA256 and stores only the salted verification value (hash) in the device’s secure storage (such as the Keychain on iOS/macOS or the Keystore on Android).
• The plaintext passcode is never stored, logged, or transmitted externally.

(2) Evidence photos

• When a breach is detected, the App takes photos with the device’s camera (if camera-based evidence capture is enabled).
• Captured photos are temporarily stored on the device and are automatically deleted when the lock is released.
• If the User has enabled notifications, the captured photos are, as described below, sent to the ntfy topic that the User has configured. They are not sent to any other destination.

(3) Notification settings (ntfy topic name)

• If the User enables notifications, the App sends the notification body, evidence photo, and topic name to an ntfy server (by default ntfy.sh, or a server specified by the User) in order to send the notification.
• The ntfy topic name functions in effect as a password. We do not collect, store, or log the topic name. The topic name is stored only on the User’s device.

(4) App settings

• Setting values such as whether sensors are enabled/disabled, the siren volume and duration, camera device selection, and whether notifications are enabled are stored in the device’s settings area (such as shared_preferences). These are used only for the operation of the App.

(5) Device permissions

The App may require the following permissions to provide its functions. Information obtained is used only for the purpose of the relevant function.

• Camera: capturing evidence photos when a breach is detected
• Microphone: ultrasonic Doppler proximity detection (when enabled)
• Biometric / device authentication: setting and releasing the lock (we do not obtain biometric information; we receive only success or failure from the OS)

3. Provision to Third Parties / External Transmission

1. The only case in which the App transmits information externally is transmission to ntfy when the User has enabled the notification function and set a topic name themselves. The destination is the default ntfy.sh or a server specified by the User.
2. The handling of information by the ntfy service is subject to the privacy policy of that service provider. When using the default ntfy.sh, by the nature of the communication, information may be processed on servers outside Japan. Users who place a high value on privacy may specify an ntfy server they manage themselves.
3. Except as stated above, we do not sell or provide User information to third parties. This does not apply, however, where we respond to a disclosure request based on law.

4. Information We Do Not Collect

We do not collect the following information:

• Registration information such as name, address, phone number, or email address (because there is no account registration)
• Location data, contacts, or call/SMS history
• Analytics data for tracking behavior history, or advertising identifiers
• Information via third-party tracking SDKs

5. Retention Period and Deletion of Data

• Information stored on the device is deleted when the User uninstalls the App.
• Evidence photos are automatically deleted when the lock is released.
• The passcode verification value and lock method are deleted when the User re-sets or resets the lock.

6. Children’s Privacy

The App is not specifically directed at children. It is intended to be used only under the supervision of a guardian.

7. Security Management

We take reasonable security measures appropriate to the nature of the information handled, such as storing the passcode verification value in the device’s secure storage and not retaining the plaintext passcode. That said, no method guarantees complete security.

8. User’s Rights

Because the information handled by the App is, in principle, kept entirely on the User’s device, the User can manage and delete this information themselves through device operations (changing settings, deleting data, or uninstalling the App).

9. Changes to This Policy

We may revise this Policy as necessary. When making a significant change, we will provide notice again on the App’s consent screen or the like.

10. Governing Law and Language

This Policy is governed by the laws of Japan. The Japanese version of this Policy is the authoritative text, and translations into other languages are for reference only. If there is any discrepancy between the Japanese version and a translation, the Japanese version prevails.

11. Contact

For inquiries regarding this Policy or the handling of information, please contact us at:

• Business name: MIZUKICHI LAB
• Contact: yamamoto@mizukichilab.com