Privacy Policy

1. Information we collect

We collect your email address and login identifiers, profile information (account name, display name, image and biography), date of birth for age checks, and consent records. Passwords are managed as hashes by our authentication service. Depending on the features you use, we process creation prompts, voice recordings, uploaded images, video, audio and 3D assets, app source code, creation chats, posts, comments, ratings, pull requests, saved app data and leaderboard records. We also process purchase, membership and credit histories, transaction identifiers, reports and blocks, notification device identifiers, IP addresses, device, OS and browser information, access and error records, and inquiries. Payment providers handle payment card numbers; we do not store them.

2. How we use information

We use information to authenticate and manage accounts, apply age restrictions, create, store, validate and deliver apps, enable their use, provide posts and collaboration, manage purchases, subscriptions, credits and refunds, deliver notifications and respond to inquiries. We also use it to protect safety, prevent abuse and infringement, address violations, meet accounting, tax and legal obligations, and improve the Service. Optional usage analytics is described in section 6. Before saving or publishing user content, we send text and images, including profile avatars, app listing images and saved test screenshots, to OpenAI for AI safety checks.

3. Public and shared information

Profiles, published apps, posts, comments, ratings and rankings may be visible to other users and the public according to their visibility settings. Collaboration content is shared with authorized organization members and pull request recipients. Do not publish private information or personal information about others without permission. Beyond processing and integrations needed to provide the Service, we disclose personal data with your consent, where required by law, to protect life, health or property, or as otherwise permitted by law. Information may be transferred as part of a business succession.

4. Information sent to AI services

App creation sends prompts, creation chats, app source code and relevant assets to OpenAI. For image asset generation, OpenAI also processes the instructions and necessary assets. Voice input sends audio continuously to OpenAI while you speak for real-time transcription. In-app AI sends conversations and relevant app context to OpenAI. We may send text, images and app screenshots for AI safety checks. Providers process information needed for these functions and identifiers used to prevent abuse. Do not include names, contact details, health information, confidential information or other personal information unnecessary for your request.

5. External services and international processing

We use the following services depending on the feature and configuration. We limit the information sent to what is needed for that function. Providers and their subprocessors may process information outside Japan, including in the United States. Their linked policies explain their handling of information.

• Supabase — Authentication, account and app databases, and file storage.
• Vercel — Web and API delivery, creation and validation environments, access and error information.
• OpenAI — App creation, transcription, in-app AI and content safety checks.
• Stripe — Web purchases, subscriptions, refunds and payment information.
• Adapty — In-app purchases and membership entitlements, user identifiers and purchase information.
• Apple — Apple sign-in, iOS purchases, distribution and notifications.
• Google — Google sign-in, Android purchases, distribution and notifications, and inquiry forms.
• OneSignal — Push notifications, device and subscription identifiers, and user identifiers.
• PostHog — Consented usage analytics, page views, actions, device information and user identifiers.
• Cloudflare — Turnstile bot and abuse prevention, including device and browser information.

6. Cookies, device storage and analytics

We use cookies and device storage for authentication, display preferences, consent records, app data and downloads. You can remove or restrict them through your browser or OS settings, although this may affect sign-in and saved data. Optional PostHog analytics runs when configured and you have consented. On the web, you can decline through the consent banner. To choose again, clear this site's data in your browser and make a new choice when the banner appears. We do not sell personal information.

7. Microphone, photos and notification permissions

We request permissions when required for a feature you choose, such as microphone access for voice input or photo and camera access for importing assets. Recordings and uploads are sent to the services that process that feature. Push notifications are delivered to devices that allow them; permissions can be changed in OS or browser settings. Individual apps use device capabilities according to the environment and permitted access. Declining optional permissions does not prevent use of features that do not need them.

8. Retention and deletion

We retain information for as long as necessary to provide the Service, respond to inquiries, maintain safety and meet legal obligations, and delete information or remove its account association when no longer needed. Deleted published apps may have a recovery period. After account deletion, we retain necessary transaction, accounting, tax and abuse-prevention facts, such as transaction IDs, amounts, currencies, products, dates and payment states, with names and email addresses removed, detached from your account and under restricted access. These records are not fully anonymous because payment-provider transaction IDs may permit re-identification. Specific retention periods are determined according to applicable obligations. Backups and information held by external providers follow their retention and deletion procedures; payment providers may retain legally required records. We cannot necessarily delete copies of published content saved by others.

9. Security

We use measures such as encrypted communications, access controls, authentication safeguards and operational records to help prevent unauthorized access, disclosure, loss or damage. We manage access by staff and service providers and respond as required by law.

10. Your rights and account deletion

You can request information about our purposes, access, correction, addition, deletion, restriction of use or disclosure, and other rights available under applicable law through the inquiry form in section 13. We may need to verify your identity. You can edit your profile and delete your account in account settings on the web or in the app. Account deletion may not cancel a store subscription. Check your subscriptions with the store where you purchased them.

11. Children and minors

The Service is not available to children under 13. Users under 18 must obtain consent from their legal guardian. We use date of birth for age checks and restrictions; it is not shown on public profiles.

12. Changes to this policy

We may update this policy as the Service or applicable laws change. We publish the updated policy and date here. We communicate significant changes through suitable channels, including Service notices, and request consent where legally required.