Last updated: September 20, 2026
Introduction
The developer of Custodia ("we", "us", or "our") respects the privacy of users and the confidentiality of the information handled by dental clinics. This Privacy Policy explains how the application "Custodia" ("the App") handles information.
The App comes in two editions. Neither collects nor transmits any information. Where they differ — mainly in where data is stored — each section says so.
- Desktop edition: a Windows and macOS application whose screens are opened in a browser on the same computer.
- App Store edition: an iPad and Mac application (see "About the App Store edition" below).
Information Collection
The App does not collect or transmit any information. We never obtain or view the data stored in the App.
Specifically, the following are never collected or transmitted:
- Personal identification information (name, email address, phone number, etc.)
- Location data
- Device identifiers
- Usage data or analytics
- Advertising identifiers
- Clinic records, documents, or attached files registered in the App
- Login IDs and passwords
Data Processing
The App runs entirely on the device where it is installed. Everything entered is stored on that device. The locations below are those of the desktop edition; for the App Store edition see the section further down.
- Ledger data: Clinic information, staff rosters, equipment ledgers, inspection, training and drill records, documents and their revision history are stored in
Custodia/data inside the user's Documents folder.
- Attached files: PDF, Word, Excel and image files added by the user are stored in the same
Custodia/data folder.
- Exported files: Word/Excel forms and CSV files are written to
Custodia/出力 (the export folder) or to a location chosen by the user.
- Logs: Startup and operation logs are stored in
Custodia/logs.
- Backups: The App creates generational backups on the same computer every night and at startup. If the user designates a second destination (such as an external drive), a copy is also written there. Retention and deletion of backups are the user's responsibility.
- Account information: Login IDs and passwords are stored only on the local computer. Passwords are stored as cryptographic hashes, so neither we nor any third party can recover the original password.
Network Communication
The App does not require an internet connection and never communicates with anything outside the clinic. It performs no update checks, no usage reporting, and no cloud storage.
The screens of the desktop edition are opened in a browser on the same computer. Only if the user enables access from the clinic network can other devices on that network open them; such communication stays within the clinic's local network. Securing that network is the user's responsibility.
In the App Store edition, synchronisation between devices likewise stays within the clinic's local network (see the next section).
Third-Party Sharing
We do not provide, share, or sell any data obtained through the App to third parties. The App includes no third-party SDKs, analytics tools, tracking technologies, advertising frameworks, or crash-reporting services.
File System Access
The App accesses the file system for the following purposes:
- Reading and writing ledger data: Within the
Custodia folder in the user's Documents folder
- Reading attached files: Files explicitly selected by the user
- Importing: CSV files explicitly selected by the user
- Saving exports: Forms and CSV files written at the user's request
All file access results from user action; the App does not scan any other folders.
About the App Store edition (iPad / Mac)
The App Store edition also collects and transmits nothing. Records are kept on the device only.
- Where data is kept: the ledger (records and attached files) is stored only in the app's own container (
Application Support/Custodia). iCloud Drive and CloudKit are not used.
- Device backup: the data folder is excluded from device backup by default. The user may opt in from Settings so that the ledger can be restored if the device is lost; the screen that offers this states plainly that opting in places a copy of the ledger in iCloud by way of the device backup.
- Synchronisation on the clinic network: when a clinic has more than one device, the devices can keep their ledgers in step over the clinic's own local network. Every device holds its own complete ledger; there is no central or always-on machine. Pairing requires a person: one device shows a QR code and a six-digit code, and the other reads and confirms it. All traffic stays inside the clinic's local network and never crosses the internet.
- Camera: used solely to read the QR code described above. No image or video is stored or transmitted.
- Accounts: login IDs and passwords are stored on the device only and are never synchronised. Passwords are stored as cryptographic hashes.
- Exports: the user chooses, each time, where PDF forms and ledger files are written.
- Data collected: none. The App Privacy section of the App Store listing states "Data Not Collected". No advertising, analytics or crash-reporting component is included.
Apple Required Reason API Usage
The desktop edition is not distributed through the App Store and is therefore outside the scope of Apple's privacy manifest requirements.
The App Store edition uses only the two categories below and states its reasons in the privacy manifest bundled with the app (PrivacyInfo.xcprivacy). Both are used only for the app's own data on the device and never to identify a device or track a user.
- User defaults (reason CA92.1): to remember the app's own settings on that device (whether it accepts synchronisation, and whether the data folder is included in backups).
- File timestamps (reason C617.1): to read and write ledger archive files (zip) and to show the size of the data folder in Settings. Only files inside the app's own container are examined.
The App performs no tracking and contacts no tracking domains.
Intended Users
The App is a professional tool for dental clinics. It is not intended for general consumers, nor directed to any particular age group.
Medical Information Notice
The App is not designed to handle dental charts or patient information. It does, however, allow a clinic to register personal information about its own staff, such as names, license numbers, and health examination records.
Collection, use, storage, and disposal of such information are the responsibility of each clinic as the business operator handling personal information. We have no involvement with, and no means of obtaining, that information. Physical and organizational safeguards, such as securing the computer, managing accounts, and storing backups safely, must be implemented by each clinic.
Changes to This Privacy Policy
This Privacy Policy may be revised in response to changes in law or in the App's features. When changes are made, the last updated date on this page will be revised.
Contact Us
If you have any questions or concerns about privacy, please contact us at: