Privacy Policy

This is a draft, not the final version. It has not been reviewed by a lawyer. Items in 【brackets】 are to be confirmed with the operator. This English text is a reference translation of the Japanese draft. If the two differ, the Japanese version prevails.

【Operator name】 (the "Operator") handles personal information and other information about users of "TRAVELERZ", a travel support service (the "Service"), as set out in this Privacy Policy (the "Policy"), in accordance with the Act on the Protection of Personal Information of Japan (the "APPI") and other laws.

Article 1 (Business Operator)

• Name: 【Operator name】
• Address: 【Address】
• Representative: 【Name of representative】
• Contact: see Article 16

Article 2 (Information We Collect)

We collect the following information in the following situations. Some features of the Service can be used without logging in; in that case we do not collect the information stored with an account.

Data saved on your device. The Service saves your display language, theme, the travel preferences you answered at the start (interests, trip length, budget, companions, age group, accessibility preferences), saved spots, itinerary, conversation history with Toraco, viewed spots, travel log, a log of screen operations, your choice about usage analytics (only for users accessing from the European Economic Area, the United Kingdom or Switzerland) and the ID of the account last signed in on this device (used to tell sign-ups from logins; not sent to Google Analytics) in your browser's local storage. These are not sent to the Operator's server, except that your travel preferences and recent conversation are sent when you talk to Toraco (Article 7). Screen operations may be sent to Google Analytics instead of being saved on your device (Article 8). You can delete them in your browser settings (Article 13).

Embedded photo data. Photos are resized and re-compressed on your device, and embedded data such as date/time, shooting location (GPS) and device model (Exif, etc.) is removed before upload. The Operator does not collect this embedded data.

What we do not collect. We collect location for Quest Check-ins, the map's "Near me" feature, or when you explicitly enable TORACON RADAR location sharing. The Service does not use third-party advertising. We use Google Analytics for usage analytics (Articles 8 and 9). We do not send Google Analytics information that directly identifies you, such as your name, email address or account ID.

Article 3 (Purposes of Use)

1. To register accounts, log users in and verify identity
2. To publish and display display names, Posts and the number of Likes on each Post on the Service, and to feature Posts with many Likes on the top page and elsewhere
3. To judge, at Check-in, whether you are near the spot, and to keep a record of it
4. To find and show spots near your current location with "Near me" on the map
5. To manage Quest progress and to grant, record and display Points
6. To provide travel suggestions from Toraco tailored to your questions and preferences
7. To respond to reports on Posts, claims of rights infringement and inquiries
8. To prevent, investigate and respond to violations of the Terms, improper Check-ins or Points, unauthorized access, etc.
9. To handle failures and keep the Service secure
10. To understand usage of the Service and improve its features (only in aggregated form that does not identify individuals)
11. To notify you of changes to the Terms or this Policy and other important notices
12. 【If Point exchanges or shipping of benefits are introduced: to process exchanges and shipping (names, addresses, etc. collected then will be collected with a separate statement of purpose)】

If we change the purposes of use, we will do so within the scope reasonably related to the original purposes and publish the new purposes on the Service.

Article 4 (Location Data)

1. The Service accesses your browser's geolocation for Quest Check-ins, the map's "Near me" feature, or when you explicitly enable TORACON RADAR location sharing. Browser permission is required. You can revoke it in device settings or switch RADAR sharing off in the app.
2. For Check-in, the latitude, longitude and accuracy are sent to the Operator's server, which calculates the distance to the spot and decides whether the Check-in succeeds.
3. If the Check-in succeeds, the latitude, longitude, accuracy, distance to the spot and date/time are stored as the Check-in record. This record is used to investigate improper Check-ins and to review Check-in judgments (investigating bugs), and is not made public. 【Retention period to be discussed, e.g. erase coordinates after ○ months needed for judgment and fraud investigation, keeping only the spot and date.】
4. If the Check-in fails (too far, low accuracy, etc.), the location is not stored.
5. For "Near me", the latitude and longitude are sent to the Operator's server and used only to find nearby spots and calculate distances. This location is not stored and not written to access records (logs) (it is sent outside the URL, so it does not appear in the access records in Article 2). On your device, so that it is not measured again every time you move between screens, the location is kept in that browser tab's memory (it is not written to your device's storage). The next time "Near me" is shown, a location measured within the last 5 minutes is reused; an older one is measured again. The location is discarded when you switch the map to an area. Because the map is centered on your current location, your approximate location reaches the map provider (Google) as the map area being shown (Article 8).
6. With TORACON RADAR sharing enabled, location may be updated on any visible app screen. No new browser readings are sent while the page is hidden or closed, but sharing remains enabled and the last position may be visible to other users for up to three hours. No movement-history listing is provided.
7. While you are viewing an area on the map screen (Map), the Service does not obtain your current location.
8. TORACON RADAR sharing is off by default and requires self-confirmation that you are at least 18 and acknowledgement of safety warnings. When enabled, other signed-in users can see your precise latitude and longitude, update time, display name, avatar and profile, and send meetup requests. Blocking stops mutual visibility; switching sharing off deletes your position. Meetup places and membership are stored temporarily. To deter automated location searches, search counts, query-center coordinates and timestamps are retained with the account. 【Retention, handling and legal review remain to be confirmed.】

Article 5 (Public Information)

The following is public on the Service and can be seen by anyone, including people who are not logged in:

• Display name
• Posts (photo, text, spot, date and time) and the poster's display name
• The number of Likes on each Post

Posts with many Likes may be selected automatically, based on the number of Likes and other factors, and featured on the top page and elsewhere.

Post photos are delivered so that anyone who knows a photo's URL can view it. Deleting a Post also deletes its photo, but the Operator cannot delete copies saved or republished by third parties before deletion.

Check-in records, Points, Quest progress, email addresses, Google account names and profile images, who Liked which Post, and report details are not public. The poster is not told who Liked their Post.

Article 6 (Provision to Third Parties)

We do not provide personal data to third parties without your consent, except:

1. as required by law (including lawful inquiries from courts or police, and requests for disclosure of sender information under the Information Distribution Platform Act);
2. where necessary to protect a person's life, body or property and it is difficult to obtain consent;
3. in other cases under Article 27(1) of the APPI;
4. when entrusting handling under Article 7;
5. in connection with business succession by merger, business transfer or otherwise.

Article 7 (Entrustment and Provision to Third Parties in Foreign Countries)

1. To provide the Service, we entrust all or part of the handling of personal data to, or use the services of, the following providers. All are companies in the United States.

1. Measures taken by each provider to protect personal information: 【The Operator to confirm each provider's contract (DPA, etc.) and certifications.】
   • Supabase: 【certifications such as SOC 2 Type 2; status of data processing agreement】
   • Vercel: 【same】
   • Resend: 【Confirm the data processing agreement (DPA), certifications and log retention】
   • Anthropic: Its commercial API terms state that inputs and outputs are not used to train models. Inputs and outputs are generally deleted after a certain period (【30 days】), but may be kept longer, for example where a usage policy violation is suspected. 【Confirm current terms in Anthropic's Privacy Center.】
2. The United States has no comprehensive federal law equivalent to the APPI covering all sectors. There are sector-specific federal laws, state laws (such as the California Consumer Privacy Act) and enforcement by the Federal Trade Commission (FTC). See the materials published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/news/surveillance/ ).
3. 【We treat these as provision to providers that have established systems meeting the standards under Article 28(1) of the APPI and, under Article 28(3), periodically confirm their implementation of equivalent measures. You may request information about this through the contact in Article 16.】【Or: obtain consent for provision to third parties in foreign countries at account registration and first use of Toraco. Which approach to take is to be decided.】

Article 8 (External Transmission)

Pages of the Service include mechanisms that cause your device to send information to parties other than the Operator. Under Article 27-12 of the Telecommunications Business Act of Japan, we publish the information sent, recipients and purposes below.

• When you log in with Google, you are taken to Google's sign-in page. Information there is handled under the Google Privacy Policy.
• Toraco's read-aloud feature (off by default) uses the speech synthesis built into your browser. Depending on the browser and voice chosen, the text read aloud may be sent to the browser provider's servers.
• You can stop data from being sent to Google Analytics with Google's opt-out browser add-on (https://tools.google.com/dlpage/gaoptout ). For users accessing from the European Economic Area, the United Kingdom or Switzerland, Google Analytics cookies are not used until consent is given, and these users can withdraw their consent at any time with "Usage analytics" in the Service's settings (the gear button).
• The Service does not send information externally for advertising. If introduced, this Article will be revised first.

Google Analytics (GA4) measurement and choices. This feature is intended for use after the Operator reviews this Policy and configures production measurement. This is a draft description of the implementation; the legal basis for consent and notice in each region is [pending Operator and specialist review].

• In the European Economic Area, the United Kingdom and Switzerland, we do not load the GA4 script or send anything to GA4, including cookieless requests, before permission. Nothing is sent when the region is unknown. Retrying the region lookup preserves saved permission or refusal. In other regions, the implementation enables measurement unless a refusal is saved.
• The European consent notice offers Allow and Don't allow. You can withdraw or grant permission again through Usage analytics in settings. Actions taken while stopped or during the tutorial are not sent later. This stops Google Analytics, not service requests needed for login, purchases or game progress, including the Service's own game records.
• Events also include search result counts and zero results, copied itinerary counts, mission completion, actual points earned, and actual points spent with purchased item counts and types. We do not send GA4 purchase receipt identifiers, balances, account IDs, names, post or conversation text, or precise current location. We mask email/phone-like text in searches and URLs and omit unnecessary URL parameters and referrer paths. This does not detect every personal name or address.
• Your consent choice and the last account ID used to avoid counting repeated logins are kept in localStorage. Up to 200 recently observed purchase receipt identifiers are kept in sessionStorage to avoid double counting. These identifiers are not sent to GA4. You can remove this storage by clearing site data in your browser.
• The intended GA4 user/event data retention setting is 14 months [Operator to verify the actual production setting and its scope]. Google's policies are at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites . The opt-out add-on is https://tools.google.com/dlpage/gaoptout .

Article 9 (Cookies and Device Storage)

1. The Service uses an authentication cookie to keep you logged in. The cookie is set so that scripts in the browser cannot read it (HttpOnly). Deleting it logs you out.
2. The Service saves the "data saved on your device" described in Article 2 in your browser's local storage.
3. The Service uses Google Analytics cookies for usage analytics (Article 8). How to stop it is described in Article 8. The Service does not use third-party advertising cookies (except cookies Google Maps may use, as described in Article 8).

Article 10 (Security Measures)

We take the following measures to prevent leakage, loss or damage of personal data. 【To be revised to reflect the Operator's actual practices.】

1. Organizational: a person responsible for handling personal data is designated and handling is monitored. 【Responsible person; reporting system for breaches】
2. Human: people who handle personal data are informed of confidentiality and proper handling. 【Staff training】
3. Physical: devices handling personal data are protected against theft and loss. 【Device management】
4. Technical:
   • Your browser never connects directly to the database; access goes through the Operator's server.
   • Row-level access control in the database prevents users from reading other users' Check-in records, Points, etc.
   • Data can be written only through processes that perform the prescribed checks.
   • The authentication cookie is HttpOnly and, in production, sent only over encrypted connections (HTTPS).
   • Passwords are stored in a form that cannot be turned back into the password (a hash).
   • Who Liked which Post cannot be read by anyone other than the User who Liked it.
   • Post photos have embedded data such as location removed on the device before upload.
   • Database administration keys are not stored in hosting or CI environments and are handled only by limited staff.
5. Understanding the external environment: personal data is handled using services of providers located in the United States (Article 7). We take security measures with an understanding of that country's personal information protection regime. 【Confirm and state the data storage countries (Supabase and Vercel regions).】

Article 11 (Retention Periods)

We keep personal data for as long as needed for the purposes of use and endeavor to delete it without delay when no longer needed. 【Periods below to be discussed.】

• Account information, Quest records, Point records, Posts, Likes: until you leave the Service (Account deletion) (deleting a Post also deletes the Likes on it)
• Check-in location (latitude, longitude, accuracy): 【○ months after Check-in】
• TORACON RADAR latest position: deleted when sharing is turned off, otherwise no longer visible three hours after its last update; scheduled physical deletion may occur later. Ended meetup records are generally deleted after 24 hours. Search-abuse-prevention data: 【retention and deletion policy to confirm】
• Report details: 【○ years after the report is handled】
• Inquiry details: the contact mailbox retains them for 【period after resolution to be confirmed】. Retention of sending records and content by Resend is 【awaiting confirmation】
• Inquiry delivery records: HMACs of IP addresses and acknowledgement recipients are removed on the next new submission after the applicable 24-hour limit windows end (they remain if no submission occurs). Submission ID hashes, content HMACs, delivery status and related records are not automatically deleted, to prevent duplicate delivery. 【Final retention periods and deletion procedures are awaiting confirmation】
• Access records: according to the log retention period of the providers used (【confirm】)
• Input to Toraco: not stored by the Operator. Retention at Anthropic is as described in Article 7.

Article 12 (Requests for Disclosure, etc.)

1. You may request notification of purposes of use, disclosure (including records of provision to third parties), correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties of your retained personal data (Articles 32 to 35 of the APPI).
2. Send requests to the contact in Article 16 with the details and information that can verify your identity (such as your registered email address). We will verify your identity, for example by confirming via your registered email address, and respond without delay. Requests by an agent require documents proving the authority of representation.
3. Requests for notification of purposes or disclosure are 【free of charge / subject to a fee of ○ yen per request】.
4. Disclosure is made by 【sending electronic data by email】.
5. You can change your display name, delete your Posts and remove your Likes yourself on the Service.

Article 13 (What You Can Do Yourself)

• Change your display name: on My Page.
• Delete Posts: from your own Posts at any time.
• Remove a Like: press it again on the Post you Liked.
• Reset your password: from the login screen, send a reset link to your registered email address.
• Revoke location permission: in your browser or device settings.
• Stop usage analytics: use the opt-out add-on described in Article 8. Users accessing from the European Economic Area, the United Kingdom or Switzerland can also turn off "Usage analytics" in the settings (the gear button).
• Delete data saved on your device: clearing this site's data (cookies and site data) in your browser settings deletes the itinerary, conversation history, etc. on your device and logs you out.
• Leave the Service: contact us via Article 16. 【An in-app account deletion feature is not yet implemented.】

Article 14 (Minors)

1. Minors should use the Service with the consent of a parent or other legal guardian and review this Policy together with them.
2. 【Regarding children under 16: the 2026 amendment to the APPI (promulgated July 17, 2026, to take effect within two years) requires that consent and notices concerning children under 16 be obtained from or given to their legal guardians. Before it takes effect, decide whether to allow registration by children under 16 and, if so, how to obtain guardian consent.】
3. Legal guardians may make the requests in Article 12 regarding a minor User's retained personal data.

Article 15 (Changes to This Policy)

1. We may change this Policy in response to changes in laws or the Service.
2. We will post the revised content and effective date on the Service. Where consent is legally required (such as a change of purpose beyond the related scope), we will obtain it.

Article 16 (Contact)

Inquiries about this Policy, requests for disclosure, etc., and complaints are accepted at:

• 【Operator name】 Personal Information Inquiries
• 【Address】
• The contact form is available only when shown in Help. If it is not shown, the form is unavailable. Planned contact email: info@worksjp.biz 【Mailbox readiness and responsible staff are awaiting confirmation】

Supplementary Provisions

• 【Established: 20XX-XX-XX】
• 【Effective: 20XX-XX-XX】