Privacy Policy

This Privacy Policy explains how Sakigake Labs ("we") handles information about users of our household expense-sharing app "Pashawari" (the "App") and of this website (sakigake-labs.com).

1. Information we collect

1.1 Account information

To sign in to the App, you use a Google account, an Apple ID, or an email address and password. The information we collect is limited to the following.

• An ID that identifies you
• Your display name (if you registered with an email address and password, the part of your email address before the @)
• The email address you used to sign in
• The type of sign-in method you use

We never collect the passwords of your Google account or Apple ID. If you sign in with an email address and password, your password is sent to Firebase's authentication system (Section 5) and stored in a form that cannot be turned back into the original characters (a hash). We cannot see the password itself.

1.2 Household data you enter

• Store name, purchase date, amount, items, and split ratios
• Settlement records
• Items you registered as fixed costs

1.3 Receipt images and scan results

The text obtained as a scan result is not sent, except in the case described in 1.4 below.

1.4 Information for improving scanning accuracy

To improve scanning accuracy, we collect the following two kinds of information.

(a) Statistics about scan results (sent automatically)

We send only numerical values such as whether the scan succeeded, the number of items, the number of lines, the tilt, and the judgment category. They do not include the receipt's text or the store name. We attach to this information a random identifier generated on your device. This identifier is not linked to your account ID.

(b) Scan reports (only when you take the action yourself)

Only if you use "Report this scan" and agree on the confirmation screen, we send the text read from that receipt and the item names, amounts, total, and purchase date that you finalized on the confirmation screen. We also send the device type (iPhone or Android), the model, the OS version, and the statistics and identifier in 1.4 (a). The report is sent when you leave the confirmation screen (including when you retake the photo or go back), not at the moment you agree. We do not send the store name itself; we send only whether you corrected the store name.

Before sending, the following are automatically masked (applied to both the scanned text and the item names).

• Digit strings that look like card numbers
• Runs of 7 or more consecutive digits
• Digit strings that look like phone numbers (from version 1.0.1, build 37)
• Store names (both as scanned and as you entered them)

From version 1.0.1 (build 37), any line of the scanned text that contains a word for a phone, fax, address or postcode, or that looks like an address or a branch name, is also masked as a whole line. However, lines where misreading has garbled the word or number, and addresses or branch names that do not fit these patterns, may still be sent unmasked.

In this case too, the image itself is not sent. As described in 1.10, we also read the contents of reports with Anthropic's AI (Claude).

1.5 Notification information

If you turn on push notifications, we collect a device identifier used to deliver them. In addition, each time you open the home screen, we record, linked to your account, the result of setting up notifications (including if you did not allow them, and the reason for any failure), the device type, the App version, and the date and time. Only the most recent date and time is kept, and it is erased when you delete your account.

1.6 Advertising information

In the free plan in Japan, the App shows ads on the home screen. Ads are delivered through Google LLC's advertising system, "AdMob". The AdMob component built into the App sends the following information directly from your device to Google.

• Numbers assigned to your device for advertising, such as the advertising ID (the "advertising ID" on Android, the "IDFA" on iPhone)
• Communication information such as your IP address (a number used for communication, which may be used to estimate your approximate region) and the type of device and OS
• Records of ads being shown or tapped, and records of actions such as opening the App or tapping the screen
• Information about the App, such as its name and version

Google uses this information for serving ads, showing ads matched to your interests (personalized ads), measuring ad effectiveness, and preventing fraud. You can check how Google uses information on Google's page "How Google uses information from sites or apps that use our services".

On iPhone: The first time you record a payment, a screen appears once asking whether to allow tracking across other companies' apps and websites. Your advertising ID (IDFA) is sent to Google only if you allow it. If you do not allow it, you can still use every feature of the App (ads are still shown). You can change this later in Settings → Privacy & Security → Tracking on your iPhone.

On Android: In the "Ads" item of your device's Settings (depending on the model, it is under "Google" or "Privacy"), you can delete your advertising ID. Once you delete it, the advertising ID is no longer sent to Google. On models that have "Opt out of Ads Personalization", turning it on stops the advertising ID from being used for ads matched to your interests.

1.7 Usage records and crash records

To make the App better, we record the following information.

(a) Usage records

These are records such as how far you have progressed from first use to pairing, which features you opened or used, and whether you shared the card shown after settlement (including the size of the difference shown on the card). They do not include store names, item names, or any partner information. We attach the same random identifier as in 1.4 (a) (it is not linked to your account ID).

(b) How you got the App (Android only)

The install referrer information (where you came from) that Google Play provides to the App when you install it is converted into one of a fixed set of tags (this website, note, Instagram, X, TikTok, YouTube, the card after settlement, invite, referral to a friend, directly from the store, or other; plus the number attached to each post, if there is one) and recorded. The original information (which may include advertising identifiers or search terms) is not taken off your device and is not stored.

The tag is recorded only once, together with the identifier above. Also, when the space where the two of you keep your household data is first created, the same tag is attached to that space as well (the space is linked to your account).

(c) Crash records

When the App stops or an unexpected problem occurs, we send, through Google LLC's "Firebase Crashlytics", a log of what was being processed at the time, the App version, the device model and OS version, an identifier assigned to each installation, and similar information. We do not add your account ID or household data.

(d) Answers to multiple-choice questions in the App

When the App shows a short question (for example, how you would feel if you could no longer use it, or why you have not started using it as a pair), we record the answer you chose (one of the fixed choices, or "no answer"), the order in which the choices were shown, the device type, the App version, and the year and month the space where the two of you keep your records was created. Answering is optional, and these questions have no field for writing text. We attach the same random identifier as in 1.4 (a), and it is not linked to your account ID. The AI survey, where you answer in writing, is handled as described in 1.8.

1.8 AI survey

In the App, we may ask you to take an optional survey. You answer fixed questions in writing, and an AI (Google's Gemini) writes a short acknowledgment and the next question based on your answers. It starts only if you press "Agree and start" on the request screen. You can use every feature of the App without answering. To decide when to ask you, we use the number of settlements and the date you started using the App.

(a) Information we collect

• The text you write as answers
• The acknowledgments and questions the AI wrote; the AI's classification of your answers (whether it is an answer to the question, a request for advice, serious content, and so on); and the records the AI made organizing your answers (points you would like improved, why something is hard for you, how hard it is, the type of situation, and so on)
• The date and time of the answers, the display language, the region used to choose which support service to show if serious content is written (based on your household currency), and the situation in which we asked you to take the survey
• Records of your pressing "Report" on an AI message
• Records that we asked you to take the survey, the number of answers, and the date, time, and way the survey ended

We store these linked to your account ID (this is handled differently from the answers to multiple-choice questions in 1.7 (d)). They are not shown to your partner.

Please do not write information that can identify an individual, such as the name of yourself or your partner. If you write about private matters such as illness or your physical or mental condition, or about other people such as your partner, they are handled as described in this section.

(b) Purposes of use

Answers are used only to improve the App (reviewing existing features and considering new ones) and to consider how we describe the App. The only time we publish the text of an answer as it is is the single sentence you agreed to have posted under (e). The record that we asked you to take the survey is also used so that we do not ask the same person twice.

When we read improvement points from the answers, we use a tally, counted across multiple people, of the records organized in (c) (counting only points raised by 3 or more people). The answers, and the records organized person by person, are not submitted to Anthropic's AI described in 1.10.

(c) Sending to Google (entrusted to Google by us)

To write the next question and acknowledgment, classify answers, choose candidate sentences to ask you about posting, and organize answers by improvement point, our server sends the text of your answers and the question that came before each answer to Google's "Vertex AI". When choosing candidate sentences and organizing answers, your earlier answers are also sent. When tallying the organized records, records from several people are sent together in a form that does not show whose they are. We do not send your account ID, display name, or email address. To make sure that names are not included in the organized records, we use your display name and your partner's display name inside our server (they are not sent to Google, and we do not keep the result of the check).

Under its contract with us, Google has promised to handle the information only within the scope of our instructions, to take security control measures, not to use it for AI training without our permission, and to delete information we have deleted from its facilities within 180 days at the latest.

Google processes information in facilities in various places, including outside Japan, and has not promised us which countries it processes in, so we cannot identify the countries where processing takes place. You can check the countries and regions where Google has facilities on the "Google Data Centers" page. For the US legal framework, where Google LLC is located, see the Personal Information Protection Commission's material listed in Section 5.

On Google's side, to speed up responses, answers are held temporarily in memory for up to 24 hours. Also, if Google's automated judgment finds suspected misuse, the data is kept for up to 90 days for review, and Google staff may review it. These are not used for AI training.

(d) Retention period and deletion

We store answers in a Firebase database in Tokyo (Japan). We do not set a fixed retention period.

You can delete your answers at any time with "Delete survey answers" on the Settings screen. When you delete them, we erase the text of your answers, the acknowledgments and questions the AI wrote, the classification of your answers, and the records organizing your answers, and this cannot be undone. Tallies counting the answers of several people (in a form in which it is not possible to tell whose answers they are) remain after deletion. Records such as that we asked you to take the survey, the number of answers, and the date and time it ended remain until you delete your account, so that we do not ask the same person twice.

If you delete your account, we erase the survey information at the time of the deletion operation (this is not subject to the 30-day retention in 7. If we could not erase it, we will erase it within 30 days).

Copies in databases and facilities (such as backups) disappear according to the rules of each system (within 180 days at the latest in Google's facilities). The posted sentence is as described in (e).

(e) Posting on this website

At the end of the survey, we may show on the screen one sentence (80 characters or fewer) that the AI chose from your answers, and ask whether we may post it. Only if you press "Yes, post it", we post that sentence on this website.

• We do not post your name. We post the wording exactly as it was shown on the screen, without changes.
• We choose sentences so that they do not include words that reveal a person or their life, such as names, place names, store names, workplaces, amounts, dates, and contact details. Before you agree to posting, please check the sentence that is shown.
• For surveys in which serious content was written, we do not ask about posting.
• Your permission to post is limited to posting on this website free of charge. The copyright in the text remains with the person who answered. We may stop posting at our discretion.
• If you delete your answers or your account, we take down the posting within a few days (within 7 days at the latest). We erase the sentence in our database at the time of the deletion operation. Copies saved by search services and the like cannot be erased by us, so we have to wait for each company to update.
• If you want only the posting taken down while keeping your answers, please contact us at the contact address in 11, attaching the posted sentence.

(f) When serious content is written

If the AI determines that an answer contains serious content, such as violence or a risk to someone's physical or mental safety, we show a support service (one for the region based on your household currency) on the screen (the AI's judgment can be wrong). If you want to continue the survey, you can. From a survey in which serious content was written, we do not create the organized records in (c).

We do not read answers in real time, so we do not contact support services, the police, or similar bodies. If you are in danger now, please contact the emergency number for your area directly (110 in Japan, 911 in the United States and Canada).

1.9 Inquiries

If you send an inquiry from the App's settings screen ("Contact us"), we receive the text you wrote, your email address (only if you wrote one), the screen you sent it from, the App version, and the device model and OS version.

Inquiries also carry the same identifier as in 1.4 (a). For that reason, if you wrote your email address, it is technically possible to match that email address against the records carrying the same identifier (1.4 (a) and 1.7 (a)(b)). We match them only when it is necessary to answer that inquiry.

The text you wrote is also read by us with Anthropic's AI (Claude), as described in 1.10, to reply to you and to improve the App. The email address field is not included.

1.10 The AI we use (Anthropic's Claude)

We use the AI "Claude" of Anthropic, PBC in the United States to read and organize the following information and to use it for replies and for improving the App. We use Claude under Anthropic's Consumer Terms (its terms for individual users). Anthropic is not our contractor (processor) and handles information under its own terms. Entering information into Anthropic's service therefore counts as providing it to a third party in a foreign country. We notify you of this on the screen before you send, and we enter only what you chose to send (we do not enter anything sent from versions of the App before we began giving this notice).

• The scan reports in 1.4 (b)
• The text of the inquiries in 1.9 (the email address field is not included)

The answers to the AI survey in 1.8 and the records organizing each person's answers are not submitted to Claude. What we read with Claude is the monthly tally counting the answers of several people (counting only points raised by 3 or more people, in a form in which it is not possible to tell whose answers they are).

(a) How Anthropic handles it

• We have set things so that Anthropic does not use what we submit for AI training. However, Anthropic's terms say that it may use what we submit to provide, maintain, and improve Anthropic's services and to develop other products and services, and that content that is flagged for safety review is also used for AI training.
• Under Anthropic's terms, if ratings or feedback are sent to Anthropic, the related content is also used for training. We do not use any feature that sends ratings or feedback to Anthropic about what we submit.
• Anthropic deletes what we submit within 30 days. If it is flagged for safety review, Anthropic keeps it for up to 2 years (and the safety classification scores for up to 7 years).
• Anthropic states that it takes appropriate security measures and does not sell personal data.

(b) Countries where it is processed, and their systems

Anthropic processes information in facilities in the United States and elsewhere. Anthropic has not shown which countries other than the United States, so they cannot be identified. For the US legal framework, see the Personal Information Protection Commission's material listed in Section 5.

(c) Differences from the handling that Japanese law requires of us

As in (a), Anthropic may use the information beyond our purposes of use (to improve Anthropic's services, to develop other products, and for training on content flagged for safety review). This differs from our handling, which is only within our purposes of use.

(d) If you do not want it submitted

Scan reports and inquiries are not submitted unless you send them. If you do not want something submitted after you have sent it, please contact us at the contact address in 11. We will not submit it from then on (what has already been submitted will disappear within the period in (a)).

Submitted content also remains as a work log on the device we use for this work, and is set to be deleted automatically after 30 days.

1.11 Information we collect on this website

(a) Access logs

When you open a page of this website, the server that hosts the site (Xserver Inc.) automatically records your IP address, the date and time, the URL of the page you opened (including any tag added at the end), the URL of the page you were on just before, and the type of browser and device. Under the server's standard setting, the last 30 days are kept and older logs are deleted.

(b) Source tags

If you come to this website from a link in an article or post that has a tag added (for example "?s=note"), we save only that tag inside your browser (local storage; the name is "wp_s"). The tag is a short string of letters and digits and contains no information that identifies an individual.

The saved tag is carried over to links to other pages of this website, to the body of the application email (the line labeled "経路（自動）", meaning "Route (automatic)"), and to links to the stores. It reaches our server as part of a page URL. If you installed the App from Google Play, it is recorded as the route in 1.7 (b).

It disappears if you delete this website's data in your browser settings.

This website does not use advertising or external access analytics.

2. Purposes of use

From the information above, we create numbers that do not show whose they are, such as how many people used the App or how many pairs were formed, and use them to improve and run the App.

We never use household data, receipt content, or account information for advertising. The only information sent for advertising is that in 1.6.

As described in 1.10, we also read scan reports and inquiries with Anthropic's AI. What we read with Anthropic's AI about the AI survey is only the tally counting the answers of several people.

3. Sharing with your partner

The App assumes that two people share their household finances. If you set up a pair, the household data you register is shown to your partner. This is a core feature of the App. This includes data you registered on your own before setting up the pair: it is combined into the pair's records, and unsettled items are included in the settlement calculation for the two of you. (Records you used with a previous partner are not shown to a new partner.) However, if you join by entering an invite code in a version earlier than 1.0.1 (build 37), the data the joining person registered on their own is not combined and is no longer shown, including to that person (it is kept as described in 7). After you unpair, the records made until then (including those not yet settled) remain in your partner's space and are shown to your partner. You will no longer be able to see them.

We never disclose your partner's account information (such as email address) to the other party.

4. Provision to third parties, and information sent externally

Except in cases based on laws and regulations and where you have agreed (the posting in 1.8 (e) and the provision to Anthropic in 1.10), we do not provide the information we collect to third parties (including selling it).

However, the following information is sent to the following companies from your device, or from our server or our working device.

5. External companies we use

The App uses the following services provided by Google LLC.

• Firebase (sign-in, data storage, delivery of notifications, crash records): handles your information on our behalf, entrusted by us
• Vertex AI (writing the AI survey's questions and acknowledgments, and classifying and organizing answers): handles the information in 1.8 on our behalf, entrusted by us
• AdMob (ads): Google handles the information in 1.6 under its own privacy policy

For Firebase and Vertex AI, Google handles your information under our instructions, and has promised by contract to take security control measures and to keep it confidential. The companies we entrust (Firebase and Vertex AI) provide, by contract, protection equivalent to this Policy. For AdMob, Google has promised by contract to comply with the laws on the protection of personal information.

As described in 1.10, we also use the AI "Claude" of Anthropic, PBC in the United States. Anthropic is not our contractor (processor), and handles information under Anthropic's privacy policy and terms (see 1.10 (c) for the differences in handling).

Google LLC and Anthropic, PBC are US companies. The United States has no comprehensive nationwide law like Japan's Act on the Protection of Personal Information; it has laws by sector and laws by state. According to the Personal Information Protection Commission's material (updated January 25, 2022), the United States participates in the APEC Cross-Border Privacy Rules (CBPR) system but has not received an adequacy decision from the EU, and its federal laws are described as having no provisions corresponding to four of the eight OECD privacy principles (data quality, purpose specification, openness, and accountability). You can check the US system in the material compiled by the Personal Information Protection Commission.

This website is hosted on servers of Xserver Inc.

• Privacy and Security in Firebase
• Google Privacy Policy
• How Google uses information from sites or apps that use our services
• Vertex AI data retention (zero data retention)
• Google Data Centers
• Anthropic Privacy Policy
• Anthropic Consumer Terms of Service
• Personal Information Protection Commission, "Foreign systems (United States)" (in Japanese)

6. Where information is stored

Household data, scan statistics and reports, usage records, AI survey answers, and inquiries are stored in a Firebase database in Tokyo (Japan).

Sign-in information (1.1, including the password hash if you sign in with an email address) is handled in data centers in the United States through Firebase's authentication system. Delivery of notifications, crash records, advertising information, and the operator's email (Gmail by Google) carrying the copies of the morning summary in 7 may be handled in facilities that Google has in various places, including outside Japan. When AI survey answers are sent to Vertex AI, the processing takes place in facilities that Google has in various places, including outside Japan (1.8 (c)). Content submitted to Anthropic's AI under 1.10 is handled in Anthropic's facilities in the United States and elsewhere.

7. Retention period and deletion

You can delete your account at any time from the settings screen in the App.

Also, the expense and settlement records in the space you shared with your partner (including those not yet settled) are also your partner's household records, so they remain until your partner deletes their account (including after your partner pairs with someone else and they are no longer shown; once your partner deletes their account, the 30-day rule above applies). In those records, you are identified only by a random ID, and we erase your display name at the time of the deletion operation.

Your own records that are no longer shown because you paired with someone else are also kept until you delete your account. If you would like them erased, please contact us below.

Separately from account deletion, we handle the following information as described below.

• Crash records: Google keeps them for 90 days and then starts erasing them
• This website's access logs: they disappear after 30 days
• Source tags (in your browser): they disappear if you delete this website's data in your browser settings
• Scan statistics, usage records, records of how you got the App, and answers to multiple-choice questions in the App (1.4 (a), 1.7 (a)(b)(d)): because they are not linked to your account, they do not disappear when you delete your account. Records more than 2 years old are erased
• Scan reports (1.4 (b)): we keep them with no set period, to use in testing fixes to scanning. The masked text is also copied into our test data. Because they are not linked to your account, they do not disappear when you delete your account
• AI survey answers: erased with "Delete survey answers" on the Settings screen. If you delete your account, they are erased at the time of the deletion operation (1.8 (d))
• The sentence posted on this website: taken down within a few days (within 7 days at the latest) after you delete your answers or your account (1.8 (e))
• Inquiries: if you want them erased, please contact us at the contact address below. We also erase the copies in the morning summary below (what was submitted to Anthropic's AI under 1.10 disappears within the period in 1.10 (a))
• Copies of inquiries and scan reports: we copy the text of inquiries (the beginning, if it is long) and the first few lines of the text in scan reports into the summary we read each morning (in the Firebase database in Tokyo and in the operator's email). Email addresses are not copied. The copies are erased within 90 days
• What was submitted to Anthropic's AI: it disappears on Anthropic's side, as in 1.10 (a)
• Advertising information: Google keeps it in accordance with Google's privacy policy

Copies in databases and facilities (such as backups) disappear according to the rules of each system.

8. Security

• All communication is encrypted
• Access from the App is limited to the users concerned with that data. Access for our work is limited to the operator
• Because personal data is handled outside Japan (in the United States and elsewhere), we take security control measures after understanding the systems of those countries

9. Use by minors

The App is not intended for minors.

10. Revisions

If we revise this Policy, we will announce it in the App or on this website.

11. Contact

We also accept requests for disclosure, correction, deletion, cessation of use, and cessation of provision to third parties regarding your information, and complaints about how information is handled, at the contact below.