Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how Shogun Dot Dev (Pty) Ltd ("Shogun Dot Dev", "we", "us", or "our") processes personal information when you use the Bucketly desktop application, website, account, subscriptions, downloads, feedback form, and related support services (together, the "Services"). Shogun Dot Dev is a private company incorporated in the Republic of South Africa under registration number 2025/181300/07.

We are the "responsible party" under the Protection of Personal Information Act 4 of 2013 ("POPIA") for personal information whose purpose and means we determine, and the "controller" where another applicable privacy law uses that term. This Policy does not govern a third-party storage provider, Google, Polar, or another service acting for its own purposes.

2. Information We Process

Depending on how you use the Services, we process the following categories:

• Account and identity data: name, email address, account identifiers, authentication method, email-verification status, and account status. If you sign in with Google, we receive the basic profile information and identifiers that Google makes available with your permission.
• Authentication and security data: protected authentication credentials, session tokens, password-reset and verification records, sign-in events, and information used to prevent abuse. We do not have access to your password in plain text.
• Subscription and transaction data: plan, subscription status, product and customer identifiers, renewal or cancellation information, discount information, and transaction references received from Polar. Polar and its payment partners process your full payment-card and checkout details; we do not receive your full card number.
• Feedback and support data: username, email address, category, rating, message, and any other information you choose to include in feedback, bug reports, or support communications.
• Technical and service data: IP address, approximate location derived from IP, device and operating-system information, browser or Application version, timestamps, requested pages or download files, security events, and diagnostic or server logs generated by our website, API, authentication, hosting, and download infrastructure.
• Local Application data: S3 connection names, endpoints, protected access keys and secret keys, regions, bucket settings, public URLs, display preferences, last-used sign-in method, and protected sign-in session data stored on your device as described below.

We do not intentionally request special personal information such as health, biometric, religious, political, or precise-location data. Please do not include sensitive personal information in feedback or support requests unless it is necessary.

3. Sources of Information

We collect information:

• directly from you when you create an account, subscribe, submit feedback, or contact us;
• automatically from your device or browser when you use the Services;
• from Google when you choose Google sign-in;
• from Polar concerning purchases and subscription status; and
• from service providers that help us operate, secure, deliver, and troubleshoot the Services.

Supplying account, authentication, and purchase information is voluntary, but we cannot create an account, authenticate you, or provide paid features without the information required for that function. You may use guest features where available.

4. Why We Process Information

We process personal information to:

• create and secure accounts, authenticate users, and provide the Services;
• activate, administer, cancel, and support subscriptions and licences;
• send verification, password-reset, service, security, and transaction communications;
• receive and respond to feedback, bug reports, privacy requests, and support enquiries;
• maintain, troubleshoot, secure, and improve the Services;
• detect fraud, abuse, security incidents, and violations of our Terms;
• establish, exercise, or defend legal claims and enforce agreements; and
• comply with legal, tax, accounting, regulatory, and law-enforcement obligations.

Under POPIA, our lawful justifications include your consent where requested, actions necessary to conclude or perform a contract with you, compliance with legal obligations, protection of your or another person's legitimate interests, and pursuit of our legitimate interests or those of a third party where permitted. Where the EU or UK GDPR applies, we rely on the corresponding bases of contract, legitimate interests, consent, and legal obligation. You may withdraw consent at any time, without affecting earlier lawful processing.

5. S3 Credentials, Storage Content, and Local Data

• Ordinary S3 connections: Non-secret connection details are stored locally, while access keys and secret keys are protected using the operating system's secure-storage facility and kept out of browser local storage. They are not sent to Shogun Dot Dev's servers. Bucketly uses them to send authenticated requests directly from your device to the S3-compatible provider you select.
• Cloudflare API credentials: Optional Cloudflare account identifiers and API tokens used for R2 statistics are protected using the operating system's secure-storage facility before being saved locally.
• Configuration exports: If you export your configuration, the Application creates a password-encrypted .bucketly file at the location you choose. You are responsible for protecting the file and its password.
• Storage content: Bucketly sends requests and content directly between your device and your chosen storage provider. We do not receive or host that content merely because you use the Application.
• Local preferences: The Application and website may use local storage for non-sensitive preferences and the last-used sign-in method. Reusable Application sign-in sessions are kept out of browser local storage and protected using operating-system secure storage. Clearing Application or browser data may remove locally stored information.

Local storage and operating-system credential protection are not substitutes for device security. Protect your operating-system account, restrict device access, use least-privilege storage credentials, and keep independent backups.

6. When We Share Information

We do not sell or rent personal information. We disclose only what is reasonably necessary to:

• Service providers: hosting, authentication, database, security, email-delivery, support, and download-infrastructure providers that process information for us under appropriate terms.
• Polar: Polar acts as merchant of record and processes checkout, payment, tax, refund, and subscription information under its own checkout terms and privacy policy. We exchange customer and subscription identifiers and status information needed to provide paid features.
• Google: Google processes information when you choose Google sign-in or when your browser retrieves Google-hosted fonts, subject to Google's privacy terms and your settings.
• Resend and email delivery: We provide the recipient address and email content needed to send verification, password-reset, service, and support messages.
• Your chosen storage provider: The Application communicates with the provider you configure, at your direction. That provider is separately responsible for its processing.
• Legal and safety recipients: regulators, courts, law enforcement, advisers, insurers, or affected parties where disclosure is required by law or reasonably necessary to protect rights, safety, and security.
• Business transfers: a buyer, investor, or successor in connection with a genuine financing, reorganisation, merger, or sale, subject to confidentiality and applicable law.

7. International Processing

We are based in South Africa and make the Services available internationally. Our providers may process information in South Africa, the United States, the European Economic Area, and other countries where they operate. Those countries may have different privacy laws from your country.

For a transfer from South Africa, we use a basis permitted by section 72 of POPIA, such as adequate protection under law or binding agreement, your consent where appropriate, or a transfer necessary for a contract or your benefit. Where another law applies, we use the transfer mechanism it requires, where available. Contact us for information about safeguards relevant to your data.

8. Retention

We keep personal information only for as long as reasonably necessary for the purpose described above, including:

• account and subscription information while the account is active and afterwards for the period needed to complete deletion, resolve disputes, prevent fraud, and meet legal duties;
• transaction, tax, and accounting records for the period required by applicable law;
• feedback and support records generally for up to three years after the matter closes, unless a longer period is reasonably needed;
• security and technical logs for a shorter operational period unless needed to investigate an incident or legal claim; and
• local Application data until you remove it, delete the relevant connection, clear local data, or uninstall the Application, subject to backups you control.

When retention is no longer required, we delete or de-identify the information, subject to secure backup cycles and legal preservation requirements.

9. Security and Incidents

We use reasonable technical and organisational safeguards appropriate to the nature of the information, including access controls, protected authentication, encryption in transit, provider due diligence, and incident-management procedures. No system is completely secure. If a security compromise affects personal information, we will notify the Information Regulator and affected people where and when applicable law requires.

10. Your Rights and Choices

Subject to applicable law and any lawful exception, you may ask us to:

• confirm whether we hold personal information about you and provide access to it;
• correct, update, delete, or de-identify inaccurate, excessive, outdated, or unlawfully obtained information;
• object to processing or ask us to restrict it in qualifying circumstances;
• provide portable account data where a right to portability applies;
• withdraw consent where processing depends on consent; or
• complain to the Information Regulator or another competent privacy authority.

You can delete your account through the available Application controls or submit a request to [email protected]. We may need to verify your identity. We will respond within the period required by applicable law. Account deletion does not automatically erase records we must keep by law and may require cancellation of an active subscription first.

Residents of jurisdictions with additional privacy rights may exercise those rights through the same email. We do not sell personal information or use it for cross-context behavioural advertising, and we will not discriminate against you for exercising a privacy right.

11. Cookies and Similar Technologies

The website may use strictly necessary browser storage for functionality. Download totals are aggregated by release file and stored by our download infrastructure; the public counter does not identify individual users. Our hosting and security providers may use necessary cookies or similar technologies to deliver and protect the site. We do not currently use advertising cookies or cross-site behavioural tracking. Third-party pages such as Google or Polar may use their own technologies under their policies.

12. Children

The Services are intended for people aged 18 or older. We do not knowingly collect personal information from a child. If you believe a child has provided personal information to us, contact us so that we can investigate and take appropriate action.

13. Information Regulator

If you believe we have not resolved a POPIA concern, you may lodge a complaint with the Information Regulator (South Africa):

14. Changes to This Policy

We may update this Policy to reflect changes in the Services, law, providers, or our practices. We will post the revised Policy and update the date above. If a change is material, we will provide reasonable advance notice through the website, Application, or account email where practicable. If consent is legally required for a new purpose, we will request it.

15. Company and Privacy Contact