Privacy Policy

About this policy

Tokaru helps you sort garbage correctly in Japan. This policy explains what data the app collects, how it is used, and what choices you have.

Data we collect

• Account: your email address (used only for sign-in; we do not store a password — sign-in happens via Supabase magic link).
• Address you set up: the prefecture / city / district you choose, stored so we can show the right collection schedule.
• Recognition history (item name, category, location, disposal steps, timestamps): stored per-user in our database so you can access it across devices and we can improve classification accuracy. Photos themselves are not stored — they are only sent to the AI service for analysis (see third-party services). You can delete records anytime.
• Collection schedules you edit or scan: stored per-user in our database so you can access them across devices.

Third-party services

• Supabase — hosts our database and handles authentication.
• Alibaba Cloud Dashscope (Qwen) — classifies photos and extracts schedules. Photos are sent for analysis and not retained.
• OpenStreetMap Nominatim — optional address lookup if you use "Auto Locate".

Cross-border data transfer

• Image recognition and schedule extraction are powered by Alibaba Cloud's Qwen large-model service. Image data is sent overseas for processing but is not retained by the service.
• Authentication and the database are hosted on a self-hosted Supabase instance in Alibaba Cloud's Singapore region. Your email, area settings, recognition history and collection schedule are stored there.
• By using this service you consent, under Japan's Act on the Protection of Personal Information (APPI) Article 28, to the transfer of your personal data to the regions above. We take reasonable measures to ensure protections equivalent to those in Japan.

Data retention

• Recognition history and schedules: kept while your account is active, deleted when you delete the account.
• Authentication logs: retained for 90 days, then automatically deleted (used for security investigations).
• Crash reports and error logs: retained for 30 days, then automatically deleted.

Security

• All traffic is encrypted with HTTPS (TLS 1.2 or higher).
• The database enforces Row-Level Security, so each user can only read and modify their own data.
• For third-party sign-in (LINE / Google / Apple), we never receive your password.

Cookies and analytics

• We use a first-party session token (via Supabase Auth) to keep you signed in.
• We use Sentry to collect crash and error reports to improve stability. Sentry does not receive directly identifying information such as your name or email.
• We do not use any third-party advertising trackers.

Your choices

• Clear your recognition history anytime: Settings → Clear recognition history.
• Delete your account (including schedules): Settings → Delete account.
• Change your language or address anytime in Settings.

Updates to this policy

• We may update this policy from time to time as laws change or features are added. We will notify you in-app of material changes.
• This service is not intended for children under 13. If we learn that we have unintentionally collected personal information from a child under 13, we will delete it promptly.
• The most recent revision date is shown at the top of this page. Detailed revision history is available on request via the contact below.

Contact

For privacy inquiries or account-deletion requests, please contact support@tokaru.app. We reply within 3 business days.