Privacy notice · updated 2026-10-23

Temporary ciphertext, minimal metadata.

Dermoptera Handoff is operated from Japan by an individual using the Dermoptera brand. Operator-information, privacy, complaint and data-rights requests use legal@dermoptera.work; security reports use security@dermoptera.work. Do not send credentials, continuation URLs, AES keys or transferred state.

Transfer and Developer data

The browser encrypts state with AES-256-GCM. The service temporarily stores ciphertext and bounded metadata, never intentionally receiving the fragment-held AES key. Developer data includes email/authentication subject, account/Project configuration, credential hashes, quota and aggregate usage. Client-side encryption reduces backend access but does not protect a compromised app, browser, device, extension, screenshot or copied continuation URL.

Providers and international processing

Clerk provides authentication; Cloudflare provides DNS/CDN, Workers and D1. When Paid checkout becomes available, Paddle acts as reseller and Merchant of Record for checkout, payment, subscriptions, invoices, transaction taxes, refunds, disputes and its customer portal. Dermoptera does not receive complete payment-card details. These providers may process data outside Japan under their published terms, data-processing terms, subprocessors and infrastructure arrangements.

Billing data

Paid billing uses provider customer, subscription and transaction IDs; product/price references; status and billing period; currency and limited totals; account/Project binding; cancellation/dispute state; and a minimal signed-webhook ledger. Purposes are checkout, entitlement, quota, reconciliation, self-service billing, fraud prevention, refunds/disputes, accounting and legal compliance.

Retention and requests

Transfers follow their short TTL. Account/Project data remains until deletion, subject to technical completion. Minimal financial, security and audit records may remain where law requires or permits. Use Dashboard deletion where available or email the legal address. Dermoptera may verify a request through the signed-in account, fresh email verification or limited account information and will not request more information than reasonably needed.