KhaznaTech Privacy Policy

Effective date: 14 November 2026

This policy explains what information KhaznaTech handles and why. It covers the KhaznaTech apps for Android, Windows and Linux, the optional KhaznaTech account and web dashboard, and the KhaznaTech relay. KhaznaTech is provided by Mega Plus Trading LTD, Damascus, Syria ("we", "us"). We are the controller of the personal data that our server and relay process.

1. The short version

Files you put in a vault are encrypted on your device before they are stored. File contents, file names, folder paths and vault passwords never reach our servers.
Encrypted vault data goes from your device straight to the storage you choose. It passes through our infrastructure in one case only: when you sync your own devices through the KhaznaTech relay. That traffic is end-to-end encrypted between your devices, so we cannot read it.
The app has no ads, no analytics SDK and no crash-reporting SDK.
To know how many people use KhaznaTech, the app sends us an anonymous count once a day: a random install number, the platform and the app version (section 5a). You can switch it off in Settings.
The password manager keeps your passwords in an encrypted KeePass file on your devices and, if you sync it, in the storage you choose. The browser extension talks only to the KhaznaTech app on the same computer (section 3a).
An account is optional. Without one, the app contacts our servers only for that daily count and, while a password vault syncs, for the current time (section 3a).
If you create an account, you can delete it yourself at any time, in the app or on our website.
We do not sell your data or share it for advertising.

2. Information that stays on your device

Storage settings (the rclone configuration): your logins to storage services and your vault passwords. They are encrypted with a key held by Android Keystore, Windows DPAPI or your Linux system keyring.
Sync tasks, their settings and their run history.
App settings such as language and app lock. Fingerprint checks are done by the operating system; KhaznaTech never receives fingerprint data.
Camera (Android): used only while you scan a pairing QR code. The app asks for permission to use the camera the first time you tap Scan QR code. The code is read from the picture on your device; the picture is not saved and is never sent anywhere. You can type or paste the pairing code instead.

We cannot see or access any of this. The one exception is the short backup status that the app sends when you use Pro while signed in to an account (section 5).

3. Your files and the storage you choose

You decide where each vault lives: a folder on your device, a USB drive or a network share; an S3-compatible service (for example AWS, Backblaze B2, Wasabi, Cloudflare R2, MinIO or Hetzner); or Google Drive. The app connects directly from your device to that storage. Before anything is written to a vault, KhaznaTech encrypts file names and contents with rclone crypt.

What your storage provider can still see: that encrypted files exist, their approximate sizes and modification times, how many files and folders there are, your account with that provider and your IP address. Your use of that provider is governed by its own terms and privacy policy.

Google Drive: you sign in on Google's own page in your browser; we never see your Google password. KhaznaTech asks only for the drive.file permission, so it can access only the files and folders it creates. The access token is stored encrypted on your device and is never sent to us. KhaznaTech's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Direct sync between your devices: your phone and computer are paired once by QR code, and only paired devices can connect. On the same Wi-Fi they connect to each other directly. Elsewhere they first try a direct connection over the internet: to find a path through your routers, each device asks a public STUN service (Cloudflare's or Google's) for its own public IP address, and your two devices exchange those addresses through the relay. The STUN service sees only the IP address it answers. You can turn direct connections off in the app (Devices tab); then your devices never ask a STUN service or share their public IP address with each other, and everything away from home goes through the relay (section 6). Either way the connection is mutual TLS between the two devices, pinned to the keys exchanged at pairing. Files arrive on your other device in the place you chose there.

3a. Password manager, autofill and the browser extension

Password vaults are KeePass (KDBX 4) files encrypted on your device with your master password, and your key file if you use one (Argon2id and AES-256). They are kept in the app's own folder. If you sync a vault, the encrypted file is copied to the storage you choose (section 3). We never receive your master password, your key file, your entries or the vault. Quick unlock on phones keeps the master password sealed with a key held by Android Keystore; it is released only after the system checks your fingerprint, face or screen lock.

Time check: while a password vault syncs, the app asks khaznatech.app for the current time about once an hour, to tell edits made on devices with wrong clocks apart. The request carries nothing about you or your vaults; like any request, it is logged as described in section 6.

Autofill and passkeys on Android: when you fill a login, Android gives the app the name and signing certificate of the app you are in, or the address of the site your browser shows, and the layout of the form. The app uses them on your phone only, to find matching logins.

Browser extension (Chrome, Edge, Brave, Vivaldi, Firefox): on the pages you visit, the extension finds login and passkey forms. It sends the site's address to the KhaznaTech app on the same computer through the browser's native messaging, and receives a login only when you choose one or confirm. When you choose to save a login, it sends the username and password to that app. Nothing goes to our servers or to anyone else, and the extension keeps no record of the sites you visit. It stores only its own settings in the browser, and uses the clipboard only when you click Copy. The app asks you once before each browser extension may use it.

Auto-type (computers): types a login into the window you chose, using your system's own tools; nothing leaves the computer.

4. Google services used by the app

Google Play Billing, when you buy Pro on Android. Google processes the payment under the Google Privacy Policy; we never receive your card or bank details. The app receives a purchase token and the product you bought. If you are not signed in, these stay on your phone. If you are signed in, the app sends them to our server, which checks the purchase with Google Play and adds Pro to your account (section 5).
Google sign-in in the browser, when you connect Google Drive (section 3).

5a. Anonymous daily count of active installs

Once a day, unless you switch it off (Settings › Privacy), the app sends our server a random install number created on your device, the platform (Android, Windows or Linux) and the app version. It is not your account's device ID and is never linked to your account, files or devices. Our server works out the country from the connection and does not store your IP address; it keeps only a one-way hash of the install number. We use these records only to count active and new installs by day, platform, version and country. Each day's record is deleted after 400 days, and the day an install was first counted is deleted 400 days after its last count. Switching the count off deletes the install number on your device; nothing more is sent.

5. If you create a KhaznaTech account

An account is optional. You need one for alerts, for sync through the relay, to redeem activation codes and to use one Pro licence on several devices. If you create one, our server stores:

Information	Why we use it
Email address, password (stored only as an argon2id hash), language	Signing in, messages in your language, contacting you about your account
Devices: a random device ID derived from a key created on the device, device name (such as the phone model or computer name), platform, app version, last seen	Showing and managing your devices, issuing licences to them, connecting them through the relay
Sign-in sessions: a hashed session token, the type of app or browser, times	Keeping you signed in, security
Licence and purchases: plan and expiry; Google Play purchase token, product and order ID; activation codes you redeemed; for bank transfer or ShamCash, the payment reference, amount, currency and status	Providing Pro, preventing fraud, keeping accounting records
Notification settings: linked Telegram chat (chat ID and the chat name Telegram gives us), email address for alerts, webhook URL, ntfy topic, which alerts you want, quiet hours and time zone	Delivering your alerts
Pro backup status: task names you chose, schedules, last run time and status, run counts (number of files, bytes, duration) and an error category such as "network" or "quota"	Detecting failed or missed backups and alerting you
Emergency access, if you use it: who you trusted and who trusted you, the vault's name, the waiting time, the status and its times, a public key from each person's device, a copy of the vault encrypted with a random key, that key sealed to the trusted person's public key, and a record of what each person did	Letting your trusted person open the vault after the waiting time, telling you about each step; we cannot open the copy or the sealed key

When you use Pro while signed in, the app sends the backup status above to the server automatically, so that it can notice a backup that did not run. It never sends file names, folder paths, file contents or vault passwords. Telegram is linked with a one-time key that you open in our Telegram bot. We send email alerts only to an address you have confirmed by opening the link we email to it.

The web dashboard uses only necessary cookies: a session cookie, a security (CSRF) cookie and a language cookie. There are no tracking or advertising cookies.

6. Server logs and the relay

Server logs: our server records IP addresses to limit abuse (rate limiting) and for security. These logs are kept for 30 days.

Relay: the relay forwards encrypted connections between devices of the same account and nothing else. Inside each relay connection your devices run mutual TLS with each other, so the relay only ever sees ciphertext. It sees your account ID, the device IDs, the IP addresses of the connecting devices, connection times and the number of bytes transferred. It counts those bytes per account to apply a daily fair-use quota. Its logs are kept for 30 days.

7. Why we may process your data (legal bases)

Where the EU or UK GDPR or similar laws apply, we rely on:

Contract: to provide your account, devices, licences, purchases, alerts and the relay.
Legitimate interests: to keep our services secure, limit abuse and prevent fraud (for example the misuse of a purchase or of activation codes).
Legal obligation: to keep purchase and payment records required by accounting and tax law.

8. Sharing

We do not sell your data and do not share it for advertising. We share it only with:

Service providers that run our infrastructure on our behalf and under our instructions: hosting (Contabo GmbH, data centre in Germany) and email delivery.
Google Play, to verify a Play purchase you made.
Destinations you choose: alerts to your linked Telegram chat pass through Telegram; alerts also go to the webhook URL and ntfy topic you enter. An alert contains the task name, device name, event, time and error category; webhook alerts also contain the account, device and task IDs. These services apply their own privacy policies.
Authorities, when the law requires it; or a successor company if KhaznaTech is merged or sold, in which case this policy keeps applying to your data and we will tell you first.

9. International transfers

Our server and relay are hosted by Contabo GmbH in a data centre in Germany. If you live in another country, your account data is transferred there. Where the law requires it, we use appropriate safeguards such as the European Commission's standard contractual clauses.

10. How long we keep data

Account, devices and notification settings: until you delete your account or remove the item.
Task records: until you delete the task or remove the device.
Emergency access: the encrypted copy and the sealed key until you or the trusted person remove the access, or either account is deleted; the record of what each person did until your account is deleted.
Alert events and delivery history: 90 days.
Sign-in sessions: until they expire or you sign out. Telegram link keys: until used or expired.
Server and relay logs: 30 days.
Purchase and payment records: for as long as your account exists. When you delete your account, we keep completed payment records in anonymised form, without your email address, for as long as accounting law requires.

When you delete your account, everything tied to it is deleted from our server, except the anonymised payment records above. Copies in our server backups disappear as those backups are replaced, within 3 months. IP addresses in server and relay logs are deleted when the logs expire after 30 days.

11. Security

All connections to our server and relay use TLS. Passwords are stored as argon2id hashes, and session tokens and Telegram link keys are stored only as hashes. Licences are digitally signed. No system is perfectly secure; if a breach affects your personal data, we will inform you and the authorities as the law requires.

12. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, limit or object to its use, or send it to you in a portable format. You can also complain to your local data protection authority. Contact us at contact@khaznatech.app; we answer within one month.

Deleting your account. You can delete your account yourself at any time:

in the app: Settings → Account → Delete account (you confirm with your password); or
on the web: sign in at https://khaznatech.app/account/delete.

If you can no longer sign in, write to contact@khaznatech.app from the account's email address and we will delete the account for you.

Deleting your account deletes everything tied to it: your email address and password hash, devices, sign-in sessions, licences, notification settings (including the Telegram link, the alert email address, webhook URL and ntfy topic), task records and alert history. Pro licences held by the account (for example from activation codes, bank transfer or ShamCash) end and cannot be restored. Completed payment records are kept in anonymised form, without your email address, for as long as accounting law requires (section 10).

Deleting your account does not delete your vaults, which stay in your own storage. It also does not cancel a Google Play subscription or refund a Google Play purchase: manage or cancel those in Google Play (Payments & subscriptions → Subscriptions, or play.google.com/store/account/subscriptions).

Without deleting your account, you can remove devices in the dashboard (which deletes their task records) and disconnect Telegram at any time.

Without an account the app contacts our servers only for the anonymous daily count (section 5a), which holds no personal data, so we hold no personal data about you unless you write to us. If you email us, we use your address and message only to answer you.

13. Children

KhaznaTech is not directed at children. We do not knowingly collect personal data from children under 13, or under the minimum age set by the law of their country. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes

If we change this policy we will update the effective date. If the change is significant, we will tell you in the app or by email before it takes effect.

15. Contact

Mega Plus Trading LTD, Damascus, Syria. Email: contact@khaznatech.app. Website: https://khaznatech.app.