This policy applies to theone-coin.appwebsite, accounts, and apps (web, desktop, and similar). App-specific practices, if any, are also described on each app’s pages. We may update this policy and will announce material changes on the site.The Japanese version is authoritative.English and other languages are for reference only.

1. Operator

Operator:Hokkaido Online / Yoshikazu Shimizu(trade name “Hokkaido Online”). Address and phone number are listed in theoperator info (Specified Commercial Transactions Act notice). For privacy inquiries, access/correction/deletion requests, and security reports, use thesupport form(human replies may be sent from addresses such as support@one-coin.app; for security reports, please indicate that in the subject or message).

2. Information we collect

Depending on how you use the Service, we may collect the following.

• Account information:identifiers from Google sign-in (Googlesub), email address, display name, profile image URL, and other data needed for authentication
• Billing information:plan and contract status, customer IDs, and payment-event metadata. Payment-method details such as card numbers are held by the payment provider (Stripe); the operator generally does not store them
• Device-linking information:one-time codes, device tokens, and confirmation timestamps used to link a desktop app to a web account
• Support information:name, contact details, message content, attachments, and app name/version sent via the form or email. Form submissions also process a Cloudflare Turnstile token for bot protection
• Phone / recordings:call-related data for the 050 support number (caller number, call events, and voice messages recorded for callback). Recordings are used for follow-up and may be shared with staff via notification email
• Email subscription status:whether the Coin-kun newsletter is on (delivery starts when a paid contract begins; includes the stopped state after using the unsubscribe link in email). Stop status for onboarding / how-to email
• Update-check technical information:technical data such as app name, version, and OS that a desktop app may send or receive when checking for updates (does not include capture images or on-device document contents)
• Usage and operations logs:access time, IP address, User-Agent, errors, and events needed for security investigations (we do not normally log image or document contents, auth tokens, or card data)

3. Desktop / on-device data

Data each app handles on the device (for example captures, recordings, hotkey snippets, notes, or settings files) stays on the user’s device by default. The operator does not send that content off-device without an explicit user action. If we add cloud sync or sharing, the app will state confirmation before sending, retention, and how to delete.

4. Purposes of use

• Providing the Service, authentication, session management, and device linking
• Billing, stopping auto-renewal, and receipts for paid features
• Bug handling, support (form, email, phone callback), and security monitoring
• Sending transactional email needed to operate the Service (billing, security, and other important notices)
• Sending the Coin-kun newsletter to Account Users (users whose paid-contract term has started). Unsubscribing is only via the unsubscribe link in each newsletter message (ending a paid contract does not by itself stop the newsletter)
• How-to / onboarding email that starts when a Google account is newly registered. You can stop it from the link in each message (separate from the Coin-kun newsletter)
• Desktop app update checks and update delivery
• Aggregated analysis to improve the Service (preferring non-identifying forms)
• Responding to terms violations and legal requirements

We do not currently measure email opens or clicks. If we do so in the future, we will update this policy and announce it.

5. Third parties and processors

The operator does not sell or rent personal information except as described here. We use the following providers to run the Service (each provider’s privacy policy also applies).

• Google: sign-in; human support replies may use Google Workspace
• Stripe: payments and customer portal
• Cloudflare: hosting, CDN, bot protection (Turnstile), database (D1), object storage (R2), and related services
• Resend: transactional email and newsletters
• Vonage: 050 number, IVR, and voice recordings

We may disclose information when required by law, or when reasonably necessary to protect life or property.

6. Handling outside Japan

Some of the providers listed in section 5 are located outside Japan (mainly in the United States and other countries or regions), or may process personal information on servers or networks outside Japan. Given the nature of the Service, processing for authentication, payments, hosting, email, and phone may involve handling outside Japan.

When entrusting or otherwise providing information to these providers, the operator reviews each provider’s contractual safeguards and privacy policy, and handles personal information as required by the Act on the Protection of Personal Information and other applicable laws. For details of each provider’s practices, see their policies (Google,Stripe,Cloudflare,Resend,Vonage). For information on personal-data protection regimes in the countries where providers are located, see materials published by Japan’s Personal Information Protection Commission (for example, theUnited States).

7. Retention

We use the following as a guide (records needed for law or disputes may be kept longer).

• Accounts, sessions, device linking:kept while you use the Service; an account may remain after a paid contract ends. After an account-deletion or personal-data deletion request, we delete or anonymize within about 30 days, except records we must keep
• Billing / contract records:may be kept for periods required by accounting or tax rules (about up to 7 years as a guide)
• Support messages / attachments:kept up to about 1 year for handling and prevention, then deleted or anonymized
• Call recordings / caller numbers:kept for the period needed for callback (about up to 90 days). Vonage retention also follows Vonage’s terms
• Operations logs:kept up to about 180 days for security investigations, then deleted or anonymized (may be revised with operating cost)

8. Security

We take reasonable measures such as access control, HTTPS, isolating secrets, input validation, and rate limiting. Details follow our internal security policy.

9. Your choices

• Review sign-in state and sign out (web login-related screens; a full self-service account page is being prepared)
• Review billing or stop auto-renewal (each app’s pricing page and the Stripe customer portal)
• Unsubscribe from the Coin-kun newsletter (only via the unsubscribe link in each newsletter). You cannot stop it from the sign-in screen or the support form. Transactional email (billing, security, and other important notices) and onboarding how-to email are not covered by newsletter unsubscribe
• Requests to delete account information or personal data (via thesupport form). Ending a paid contract’s active term does not by itself delete the account. Access, correction, suspension of use, and similar requests follow the next section

10. Requests for disclosure, correction, suspension of use, etc.

When the data subject requests disclosure, correction, addition, deletion, suspension of use, erasure, suspension of third-party provision, or disclosure of records of third-party provision of retained personal data, the operator will respond within a reasonable period and within the scope required by the Act on the Protection of Personal Information and other applicable laws.

• How to request:Use thesupport form, state that the message is a personal-data request, and include the type of request and enough detail to identify the data concerned. Human replies may be sent from addresses such as support@one-coin.app
• Identity verification:To confirm the request is from the data subject or a duly authorized agent, we may match the registered email address or ask for further confirmation. Agents may be asked to submit proof of authority
• Fees:Requests are free in principle. If disclosure or similar handling would incur substantial cost, we may ask you to bear actual expenses within the scope of law, and we will tell you in advance
• When we cannot comply:If we cannot grant all or part of a request for a reason provided by law, we will inform you of that fact and the reason

11. Cookies and local storage

We use cookies and similar technologies for:

• Session: keeping you signed in (near-essential)
• Security:bot protection such as Cloudflare Turnstile (e.g. support form)
• Stable operation: delivery and incident investigation as needed

Language preference, the version of terms/privacy accepted, and device-linking state may be stored in browser or app localStorage / on-device storage. We do not use non-essential tracking-ad cookies as a primary purpose.

12. Children

The Service is intended for general business and personal use. We do not knowingly collect personal information from personsunder 16without a parent or guardian’s consent. Please contact support if this applies.

13. Sensitive personal information

The operator does not intentionally collect sensitive personal information (as defined under Japanese law, such as medical history, disability, or beliefs) for providing the Service. If a user voluntarily includes such information in support contacts, we handle it only as needed for that response.

14. Data breaches

If a leak, loss, or damage of personal data occurs or is likely to occur, the operator will take measures required by the Act on the Protection of Personal Information and other applicable laws, including notifying affected individuals and reporting to the Personal Information Protection Commission where required.

15. Changes

When we change this policy, we update this page. For material changes, we will notify on the site or by registered email where practical.

16. Related

• Terms of Use
• Operator info (Specified Commercial Transactions Act notice)
• Support