Privacy Policy

1. Scope of this Policy

This Policy applies to our Services.

Our Services may link to websites or services operated by third parties. The handling of personal information on such third-party services is governed by the privacy policies of those third parties. We bear no responsibility for the handling of personal information on third-party services.

2. Information we collect

In providing our Services, we may collect the following types of information. We do not always collect all of the following across all of our Services. The actual types of information collected, the purposes of use, and the presence or absence of third-party provision or sharing are specified by the features and settings of each application or service, the "App Privacy" labels on the App Store product page, and any product-specific privacy policy.

Our applications contain no analytics or advertising SDKs. Information about app usage and crashes reaches us only when a user has turned on Apple’s “Share With App Developers” setting, and then only in the aggregated form that Apple provides.

• Information you provide via inquiry forms and similar (name, email address, affiliated organization, content of inquiry, etc.)
• Information you voluntarily enter within applications (profile, settings, user-generated content, etc.)
• Information on the use of applications (operation logs, frequency of feature use, crash reports, performance information, diagnostic information about the operating environment, etc.)
• Device and communication information (OS type and version, device model, language settings, time zone, IP address, etc.)
• Information related to billing, purchases, and subscriptions (transaction identifiers via App Store, purchase history, subscription status, etc. Credit card numbers and other payment authentication information are not collected by us; Apple Inc. processes them in accordance with its own terms.)
• Information collected only when a given application functionally requires it (microphone, camera, location, contacts, photo library, etc. Express consent is obtained via the operating system's permission dialog prior to use.)

2-2. What we do not currently do

The preceding Section sets out the categories of information that may be collected across our Services as a whole. It does not mean that all of it is always collected. As at the last updated date of this Policy, the following do not apply to us. Should we begin any of them, we will update this Policy and, where required, obtain consent in advance.

• Our website has no web analytics tool installed, and it does not use cookies
• None of the applications we currently offer display advertising. We do not use third-party advertising networks or advertising identifiers such as the IDFA
• We do not sell personal information to third parties. Nor do we engage in sharing as that term is used in the CCPA/CPRA, that is, disclosure for cross-context behavioural advertising
• We do not carry out decision-making based solely on automated processing that produces legal effects concerning users or similarly significantly affects them
• For the data each application actually collects, please refer to the App Privacy label on its App Store product page and to its individual policy
• We do not include mainland China among the App Store territories for our applications, and we do not offer, sell, or promote our applications or related services to persons located in mainland China

3. Purposes of use and legal bases for processing

We use collected personal information within the scope of the following purposes.

• Provision, maintenance, and improvement of our Services, and development of new features
• Responding to inquiries and support requests from users
• Provision of paid features and subscriptions, billing processing, purchase history management, and refund handling
• Detection of and response to terms-of-service violations and unauthorized use
• Analysis of usage, quality improvement, and defect remediation
• Notifications of important announcements and update information
• Compliance with legal obligations, dispute resolution, and performance of contracts
• Creation of statistical data (use after processing into a form that does not identify any individual)

3-2. Legal bases under GDPR (users in the EEA)

When processing personal data of users in the European Economic Area (EEA), we rely on the following legal bases set forth in Article 6(1) of the GDPR.

• Performance of a contract and pre-contractual measures (Article 6(1)(b)): provision of our Services, billing processing, subscription management. For inquiry responses, we rely, depending on the content of the inquiry, on performance of a contract / pre-contractual measures, legitimate interests, or consent as the legal basis.
• Consent (Article 6(1)(a)): processing for which we have obtained express prior consent from the user. Users may withdraw such consent at any time, by means as easy as those by which the consent was obtained.
• Legitimate interests (Article 6(1)(f)): usage analysis, service improvement, fraud detection, and service operation, where our legitimate interests are not unduly overridden by the rights and freedoms of the user. We confirm, as necessary, the balance between such interests and the user's rights, and upon a user's request, we will explain, to the extent permitted by applicable law, an outline of that assessment within reasonable scope.
• Compliance with legal obligations (Article 6(1)(c)): responses to laws, government authority requests, and judicial proceedings.

3-3. Right to object

Where processing is carried out on the basis of legitimate interests, users in the EU have the right to object to such processing under Article 21 of the GDPR.

4. Provision to third parties

We do not provide personal information to third parties without the user's consent, except in any of the following cases.

• Where required by law
• Where necessary to protect the life, body, or property of a person, and obtaining the user's consent is difficult
• Where particularly necessary for improving public health or promoting the sound upbringing of children, and obtaining the user's consent is difficult
• Where cooperation with a national agency, a local government, or a party entrusted by them in executing affairs prescribed by law is necessary, and obtaining the user's consent could impede the execution of such affairs
• Where personal information is provided in connection with succession of business by merger, business transfer, or other reasons

4-2. Service providers that handle personal information on our behalf

We may outsource all or part of the handling of personal information to external service providers as necessary for the provision, maintenance, support, and security of our Services. In such cases, we exercise necessary and appropriate supervision over those providers, and they handle personal information in accordance with our instructions.

As of the last updated date of this Policy, we use the following service providers.

• Cloudflare, Inc. (United States) — hosting, content delivery (CDN), and DNS for this website. Access logs, including IP addresses, are retained in accordance with its standard retention periods
• Microsoft Corporation (United States) — the inquiry form on this website (Microsoft Forms) and our business email (Microsoft 365)

4-3. Companies that handle personal information independently

Apple Inc. determines its own purposes and legal bases for handling personal information relating to App Store accounts, purchases, payments, downloads, and platform integrity. For that handling, Apple Inc. is not our service provider but a company that handles personal information independently, and its own privacy policy applies. What we receive from Apple Inc. is aggregated information such as sales figures.

If we introduce analytics, crash reporting, advertising, or authentication services that we do not currently use, we will carry out the necessary legal and technical assessment beforehand, update this Policy and the relevant App Store privacy details, and obtain any consent that is required.

5. International data transfers

Some of the service providers we use locate their data centers outside Japan (primarily in the United States, EU member states, Singapore, the United Kingdom, etc.). As a result, users' personal information may be transferred to and stored outside Japan.

Where an international transfer takes place, we confirm the valid transfer basis — an adequacy decision, applicable standard contractual clauses, a data processing agreement or another lawful ground — according to the origin and destination of the transfer and the law applicable to the processing. Where necessary we also assess the legal framework of the destination and the contractual and technical safeguards in place, and we review this periodically.

When we provide personal data to a third party located in a foreign country, we provide the necessary information, obtain consent, or confirm equivalent safeguards in accordance with the APPI and other applicable laws.

For details on the personal information protection regimes of countries where each provider is located, please refer to the publication of the Personal Information Protection Commission of Japan (https://www.ppc.go.jp/enforcement/infoprovision/laws/ ).

6. Retention period

We retain collected personal information only for the period necessary to achieve the purposes of use. After such period, we delete or anonymize the information in an irreversible manner. However, backup data may be deleted gradually in accordance with the ordinary backup management cycle, with restoration use restricted in the meantime.

Where retention is required by law, we retain the information for the period prescribed by such law.

Retention periods or the criteria for determining retention periods, by main data category, are as follows.

• Inquiry response records: retained for a period reasonably necessary for dispute prevention and quality improvement after the response is complete.
• Billing- and purchase-related information: retained for the period legally required or for the period necessary for App Store transaction management.
• Crash logs and diagnostic information: retained for the period necessary for analytical purposes, then deleted or anonymized.
• User data within applications: where account functionality exists, retained until account deletion or termination of use; where no account functionality exists, retained on the user's device or for the period necessary to provide the relevant feature.

7. Your Rights

To the extent permitted by applicable law, users have the following rights with respect to their own personal information held by us. Even where we are not strictly legally required to do so, we will respond to these requests to the extent reasonably practicable, regardless of users' place of residence.

• Right of disclosure: the right to request disclosure of personal information held by us
• Right of correction, addition, or deletion: the right to request correction, addition, or deletion of personal information where its content is inaccurate
• Right of cessation of use or erasure: the right to request that we cease using or erase personal information
• Right of cessation of third-party provision: the right to request that we cease providing personal information to third parties
• Right of data portability: the right to receive or transfer personal information in a structured, machine-readable format
• Right to request cessation of sale or sharing of personal information ("Do Not Sell or Share My Personal Information"): where permitted by applicable law, the right to request that we cease selling or sharing personal information with third parties
• Rights regarding automated processing: the right, in relation to automated decision-making including profiling, to request human intervention, to express one's views, and to contest the decision
• Right to lodge a complaint with a supervisory authority (for users in the EU)

7-2. How to exercise your rights

To exercise these rights, please contact us at the contact points listed in Section 12.

The procedure for responding to requests is as follows.

• Identity verification: we may request additional information at the time of contact in order to verify that the requester is the person concerned.
• Fees: free of charge as a general rule. However, where permitted by applicable law, in cases where the same request is repeated within a short period, or where the request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to respond.
• Response timeframe: we respond within one month of receiving the request as a general rule. Where the request is complex or where we receive a number of requests, we may extend this period by up to two further months. In that case we will inform you of the extension and its reasons within the initial one-month period.
• Grounds for non-disclosure: we may treat information as non-disclosable where disclosure is not permitted by law or where it could infringe the rights of a third party, etc.

7-3. Global Privacy Control (GPC) and complaints

To the extent technically detectable by us, we respect "Global Privacy Control (GPC)" signals as an expression of the user's intention to "stop selling or sharing personal information."

Users in the EU may, if dissatisfied with our handling, lodge a complaint with the personal information protection supervisory authority of their member state of residence.

8. Children's personal information

Our Services are not, in principle, primarily intended for children.

In accordance with the laws of each country and region, we do not intentionally collect personal information from children below the age at which parental or legal-guardian consent is required, without such consent. Age thresholds vary by jurisdiction (e.g., 13 years in the United States, 13 to 16 years in the EU).

Where we provide an application primarily intended for children, the application's product-specific privacy policy will separately specify the target age range and the concrete mechanism for obtaining consent.

If we learn that we have collected personal information from a child without the required consent, we will delete or cease using that information as soon as reasonably possible. Guardians with any concerns are invited to contact us using the details in Section 12.

9. Cookies, device identifiers, and tracking technologies

Our website does not use cookies. It has no mechanism for identifying visitors and no web analytics tool installed.

Our website stores a small amount of preference data in the browser local storage in order to remember the display language and colour theme you have chosen. Only the language code (for example, ja) and the theme selection are stored. This data contains nothing that identifies you and is never transmitted to our servers. You can erase it at any time by clearing this site data in your browser settings. If you do so, the display language will be determined again from your browser language settings on your next visit.

As at the last updated date of this Policy, the applications we distribute do not display advertising and do not use the IDFA or any other advertising identifier, third-party advertising network or advertising mediation. Should we introduce any of these, we will update this Policy and our App Store privacy disclosures beforehand, and obtain any prior consent required by applicable law and by Apple.

Where we use cookies, device identifiers, or similar technologies that require user consent, we obtain the necessary prior consent in accordance with applicable law.

10. Data security and data incidents

We take the following technical and organizational security measures to prevent leakage, loss, damage, or other data incidents involving personal information (including a concept corresponding to a "personal data breach" under the GDPR; hereinafter "data incidents").

• Encryption of communication channels (appropriate encryption technologies such as TLS 1.2 or higher)
• Encryption of stored data (within applicable scope)
• Management and periodic review of access permissions
• Recording of operation logs and access logs, and confirmation as necessary
• Confirmation of security information, public disclosures, contract terms, and other materials of third-party service providers at the time of selection and as necessary
• Confirmation by personnel handling personal information of the handling procedures and legal obligations
• Understanding of the external environment: where personal data is stored in a foreign country, we implement security control measures having ascertained the personal data protection regime of that country. As at the last updated date of this Policy, the storage locations of the main service providers we use include the United States. For details of each country regime, please refer to the materials published by the Personal Information Protection Commission (https://www.ppc.go.jp/enforcement/infoprovision/laws/)

10-2. Response to data incidents

When a data incident occurs, we report to the relevant supervisory authority and notify affected users in accordance with the laws applicable in each region. The main statutory deadlines are as follows.

• Users in the EU: under Article 33 of the GDPR, we notify the competent supervisory authority within 72 hours of becoming aware of the incident. Where the incident is likely to result in a high risk to the rights and freedoms of users, we also notify the affected users without undue delay under Article 34 of the GDPR.
• Users in Japan: under Article 26 of the APPI and its enforcement regulations, we file a preliminary report with the Personal Information Protection Commission (https://www.ppc.go.jp/ ) within approximately 3 to 5 days of becoming aware of the incident, and a final report within approximately 30 days (or approximately 60 days for incidents involving special-care-required personal information or in certain other cases). We also notify affected users without undue delay.
• Other regions: handled appropriately in accordance with the laws of the applicable region.

11. Changes to this Policy

We may change this Policy due to changes in laws, changes to our Services, or other reasons.

Where we make material changes, we will provide notice with a reasonable advance period depending on the nature of the change. For changes that materially affect users' rights and obligations, we will, as a general rule, notify users at least 30 days before the effective date, via our Services, our website, or messages sent to registered email addresses.

Minor changes (such as typo corrections, clarifications, or updates to referenced URLs) may be made without prior notice.

The date this Policy was last updated is shown at the top of the page.

12. Contact and operator information

For inquiries about this Policy, consultations on the handling of personal information, or the exercise of users' rights, please contact us at the following. Either the inquiry form or email is equally accepted.

CONEX, K.K. — Data Protection Contact

Inquiry form: https://conex-cp.com/en/contact/

Email: [email protected]

Contact for data subjects located in Brazil and for the ANPD (Brazilian National Data Protection Authority) — the encarregado under Article 41 of the LGPD: Sadayori Michiura, Representative Director. The contact details are the same as above. Inquiries in Portuguese are accepted.

For personal information-related requests, we respond within the periods specified in Section 7 as a guideline. For other inquiries, we will endeavor to respond within a reasonable period.

Our operator information is as follows.

• Operator name: CONEX, K.K.
• Address: Futaba Bldg. 8b, 1-16-6 Dogenzaka, Shibuya, Tokyo 150-0043, Japan
• Representative: Sadayori Michiura, Representative Director

12-2. Complaint channels

Channels for complaints regarding the handling of personal information are as follows.

• Us (using the contact points above)
• Personal Information Protection Commission of Japan: https://www.ppc.go.jp/
• The personal information protection supervisory authority of each EU member state (for users in the EU): the supervisory authority of the user's member state of residence

12-3. Governing law and jurisdiction

The interpretation and application of this Policy shall be governed by the laws of Japan.

In the event of a dispute arising in connection with this Policy, the Tokyo District Court shall have exclusive jurisdiction as the court of first instance by agreement.

However, where the consumer protection laws of Japan or other countries grant jurisdiction to the courts of the user's home country, those laws shall prevail.

This Section does not limit any jurisdiction or remedy available to users under applicable law. We have no establishment in an EU Member State; where the GDPR or other applicable law allows users to bring proceedings before the courts of their habitual residence or elsewhere, users may exercise that statutory right. The right to lodge a complaint with a supervisory authority set out in Section 12-2 is likewise unaffected by this Section.

12-4. Severability

If any provision of this Policy is determined to be invalid or unenforceable in any jurisdiction, this shall not affect the validity of the other provisions.

12-5. Language

This Policy is drafted in Japanese, and we provide translations in each language for users’ convenience and for transparency in each region. The Japanese version serves as our source text for version control and for interpretation.

However, any right or protection available under applicable law on the basis of the translated version presented to a user is not limited by reason of a discrepancy with the Japanese version. Where local mandatory rules or mandatory disclosure requirements apply, those prevail.

If we become aware of a discrepancy in translation, we will correct it as soon as reasonably possible.