Privacy Policy

01Basic Policy

KANOPY Inc. (the "Company") believes that handling users' personal information appropriately in providing the golf community service "ROUNDIE" (the "Service") is part of our social responsibility.

The Company complies with the Act on the Protection of Personal Information of Japan (the "APPI") and other applicable laws, regulations, and guidelines, and handles personal information in accordance with this Privacy Policy (this "Policy").

02Information We Collect

The Company collects the following information in order to provide the Service.

2.1 Information provided by users

2.2 Information collected automatically

• IP address, device type, OS version, and app version
• Access logs, dates and times of use, and feature usage
• In-app screen views and interaction events such as taps (for usage analysis; see Article 6)
• Crash reports and error logs (to improve app quality)
• Identifiers obtained through cookies and similar technologies (see Article 6 for details)

2.3 Information we do not collect

The Company does not collect the following information.

• Continuous location data (we do not continuously collect GPS data in the background)
• Unauthorized access to your contacts, address book, calendar, or photo library (accessed only when necessary for posting and only with your explicit permission)
• Microphone access (the Service does not provide any audio recording features)

03Purposes of Use

The Company uses the personal information it collects for the following purposes.

1. Providing, operating, and maintaining the Service
2. User authentication, account management, and identity verification
3. Providing subscriptions and managing billing
4. User support and responding to inquiries
5. Analysis for improving the Service, developing new features, and enhancing quality
6. Preventing fraudulent use and investigating and responding to violations of the Terms of Service
7. Notifying users of Service announcements, maintenance information, and important changes
8. Notifying those who signed up through the website form when the Android version is released
9. Informing users, with their consent, of new features, campaigns, and the like
10. Creating, using, publishing, and providing to third parties statistically processed information that cannot identify individuals
11. Other purposes incidental to the above

If the Company uses personal information beyond the purposes above, it will obtain the user's prior consent.

04Provision to Third Parties

The Company will not provide personal information to third parties without the user's consent, except in any of the following cases.

1. When required by law (formal requests from courts, police, or other public authorities)
2. When necessary to protect a person's life, body, or property and it is difficult to obtain the user's consent
3. When particularly necessary to improve public health or promote the sound development of children
4. When it is necessary to cooperate with a national government agency or the like in executing affairs prescribed by law
5. When personal information is transferred in connection with a business succession (merger, corporate split, business transfer, etc.) (in which case users will be notified in advance)

05Outsourcing

In providing the Service, the Company may outsource part of its operations to trusted third parties (service providers). Service providers are contractually required to handle personal information appropriately and are supervised by the Company.

The principal service providers are as follows.

Service providers handle personal information in accordance with their contracts with the Company and with their own privacy policies.

06Cookies and Tracking Technologies

The Service uses cookies and similar technologies (local storage, device identifiers, etc.) to analyze usage, improve the user experience, and maintain authentication state, among other purposes.

6.1 Purposes of use

• Keeping you logged in
• Saving user preferences (language, display mode, etc.)
• Statistical analysis and improvement of Service usage
• In-app usage analytics for UX improvement
• Crash reporting and error analysis

6.2 Use of third-party tools

The Service uses industry-standard analytics tools such as the following to analyze usage and improve quality. We do not send your name or email address to these tools. Website analytics tools rely on identifiers such as cookies (except our own website measurement and Cloudflare Web Analytics). For in-app analytics (PostHog) and defect investigation (Sentry), we send your user UUID and ROUNDIE ID (handle) to distinguish users (the items we send are listed in Article 5).

• Google Analytics 4 (measurement ID: G-T8YSVSPZ7E) — statistical analysis of page views, visitor counts, referrers, etc.
• Microsoft Clarity (project ID: w8acp9qnxk) — UX improvement through session replay and heatmaps
• Our own website measurement (roundie.app top pages) — we count page views, taps on the App Store and Android buttons, and form sign-ups as totals per day, language, referrer domain, and country of access. We do not use cookies, device identifiers, or IP addresses, and we do not create records for individual people
• Cloudflare Web Analytics — statistical analysis of website page views, referrers, etc. (measured without using cookies or device identifiers)
• PostHog (EU region) — analysis of in-app screen transitions and interaction events (we do not use session replay, i.e., recording of interactions)
• Sentry (United States) — crash reporting and error analysis
• The standard analytics features of each OS (iOS / Android)

Of these, Google Analytics, Microsoft Clarity, our own website measurement, Cloudflare Web Analytics, and cookies and similar technologies are used only on the Company's websites (such as roundie.app). Data collection within the iOS / Android apps is limited to crash analysis (Sentry) and usage analytics (PostHog); we never collect the advertising identifier (IDFA) or perform cross-app tracking.

For details on how these third-party tools are handled, please also see the Cookie Policy.

6.3 Opting out

You can restrict cookies and tracking features through your browser settings or your OS privacy settings. Note, however, that doing so may make some features of the Service unavailable.

6.4 Affiliate links (links to external e-commerce sites)

The Service may display links to products on external e-commerce sites (such as Rakuten Ichiba), for example as competition prize suggestions. These links may use affiliate programs under which the Company receives a referral fee; where that is the case, we will clearly indicate that the link is sponsored (e.g., with a "PR" label). The Company does not collect any information about your browsing or purchases on the linked sites (such as your name, payment details, or purchase history). The handling of personal information on linked sites is governed by the privacy policy of the respective operator.

07Cross-Border Transfers of Personal Information

The Service transfers personal information to businesses outside Japan as described below (including entrusting storage and processing). In each case, the information is sent over the network, using encrypted communication (TLS), as you use the Service. The Service's core database, authentication infrastructure, and storage (Supabase) operate in the Singapore (ap-southeast-1) region, and core data such as sign-ups, round records, and competitions is processed and stored on servers in Singapore.

• Supabase Inc. (Singapore)
  Items transferred: Information handled by the Service (account information, posted content, etc. under Article 2)
  Purpose: Providing the Service (data storage and authentication)
  Retention period: Until you delete your account (Article 8)
  Contact: [email protected]
• PostHog, Inc. (Germany, EU region)
  Items transferred: User UUID, ROUNDIE ID, sign-in method, sign-up date, display language, device language and region, device / OS / app version and similar information, and interaction events
  Purpose: Usage analytics
  Retention period: 1 year from collection (the retention period of PostHog's current plan; data older than this is subject to deletion. Not linked to account deletion, but we will delete it upon request)
  Contact: [email protected]
• Functional Software, Inc. (Sentry, United States)
  Items transferred: Crash and error information, device / OS / app version and similar information, user UUID, and ROUNDIE ID
  Purpose: Investigating defects
  Retention period: Up to 90 days from collection
  Contact: [email protected]
• RevenueCat, Inc. (United States)
  Items transferred: User UUID and purchase / subscription status
  Purpose: Managing in-app purchase status
  Retention period: Until the Company stops using RevenueCat (after which it is deleted in accordance with RevenueCat's terms. Not linked to account deletion, but we will delete it upon request)
  Contact: [email protected]
• 650 Industries, Inc. (Expo, United States)
  Items transferred: Push notification tokens, notification content, and information needed to check for app updates (such as the app version)
  Purpose: Delivering push notifications and app updates
  Retention period: Push notification delivery records are deleted after 24 hours. Information associated with checking for app updates is retained in accordance with Expo's privacy policy (only as long as necessary for its purposes)
  Contact: Contact form on expo.dev
• Plus Five Five, Inc. (Resend, United States; emails are sent from Tokyo)
  Items transferred: Email addresses and email content
  Purpose: Delivering authentication emails, notices, and report notifications, and notifying the operator when someone signs up through the website form
  Retention period: Sending records are kept for 30 days (Resend's retention period)
  Contact: [email protected]
• Apple Inc. / Google LLC (United States)
  Items transferred: Push notification tokens and notification content
  Purpose: Delivering push notifications (via Expo)
  Retention period: According to each company's privacy policy
• Cloudflare, Inc. / Google LLC (Google Analytics) / Microsoft Corporation (Clarity) (United States)
  Items transferred: Website browsing information (identifiers such as cookies, pages viewed, IP address, etc.), and email addresses and related information submitted through the website form (Cloudflare only)
  Purpose: Website delivery and usage analytics, and storage of website form submissions
  Retention period: According to each company's privacy policy (for website form submissions, as set out in Article 8)

Regarding the personal information protection regimes of the destination countries and regions: in Singapore, the Personal Data Protection Act (PDPA) applies; in Germany (EU), the General Data Protection Regulation (GDPR) applies; the United States has no comprehensive federal law, and sector-specific federal laws and state laws (such as California's CCPA) apply. In accordance with the APPI and other applicable laws, the Company verifies the personal information protection regimes of destination countries and the security measures taken by recipients, and maintains an appropriate level of protection.

Because these transfers are necessary to provide the Service, if you do not wish your information to be transferred, please delete your account (in which case you will no longer be able to use the Service).

08Retention Periods

The Company retains personal information only for the period necessary to achieve the purposes of use. Specific retention periods are as follows.

Accounts that have not used the Service for an extended period (24 months or more since the last login) may be deleted after prior notice to the user.

09Users' Rights

Users have the following rights with respect to their own personal information held by the Company.

9.1 Requests for disclosure, correction, suspension of use, and deletion

• Disclosure request: the right to request disclosure of the user's own personal information held by the Company
• Correction, addition, and deletion request: the right to request correction and the like where the content of personal information is inaccurate
• Suspension of use and erasure request: the right to request suspension of use or erasure of personal information
• Request to stop third-party provision: the right to request that provision to third parties be stopped

9.2 Account deletion

Users can delete their own account at any time from the account settings screen in the Service. Upon deletion, all posted content, reactions, competition participation history, and other data tied to the account will be deleted from the Company's database. Please note that deleted accounts cannot be restored. Records sent to external businesses for usage analytics, defect investigation, and billing management (Article 7) are not automatically deleted together with your account; they are deleted when each business's retention period (Article 7) ends. If you would like them deleted sooner, please contact us at the address at the end of this Policy, and we will ask each business to delete them.

9.3 Data export

A feature for exporting the data you have registered and posted in JSON or CSV format is currently under development. We will announce its availability in this Policy when it launches. Until then, if you send a request to the contact listed at the end of this Policy, we will verify your identity and disclose the data we hold within a reasonable period.

9.4 How to make a request

To exercise any of the rights above, or for inquiries about the handling of personal information, please contact us at the address listed at the end of this Policy. We will respond within a reasonable period after verifying your identity.

10Security Measures

The Company takes appropriate measures, including the following, to prevent the leakage, loss, or damage of personal information and to otherwise manage personal information securely.

• Organizational measures: appointment of a personal information protection manager, establishment of internal rules, and regular training
• Technical measures: encrypted storage of passwords, TLS encryption of communications, minimization of access privileges, and detection of unauthorized access
• Physical measures: physical security of server facilities (via the facilities of our service providers)
• Personnel measures: confidentiality obligations for employees and information management including after separation from employment

11Use by Children

The Service may not be used by anyone under the age of 14. The Company does not knowingly collect personal information from anyone under 14.

If you reside in the EU, under Article 8 of the GDPR the consent of a parent or legal guardian is required for children under 16 (member states may lower this age to 13). The Company responds without delay to deletion requests from parents or guardians.

If we discover that we have collected personal information from anyone under 14, we will delete it promptly. If you believe a child's personal information has been registered, or if you wish, as a parent or guardian, to request its deletion, please contact our inquiry desk.

12Additional Information for Overseas Users

The Service also supports the EN and KO languages and may be used by users residing overseas, including in the EU, the United States, and South Korea. The following describes the Company's compliance with the principal data protection laws of each region.

12.1 EU users (GDPR)

• Legal bases: GDPR Art. 6(1)(a) consent / Art. 6(1)(b) performance of a contract / Art. 6(1)(f) legitimate interests
• Data subject rights: right of access (Art. 15), right to rectification (Art. 16), right to erasure / right to be forgotten (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), and right to object (Art. 21)
• Deadline for responding to erasure requests: within 30 days of receipt (GDPR Art. 12(3))
• Data Protection Officer (DPO) contact: [email protected]
• Transfers outside the EU: the Supabase Singapore (ap-southeast-1) region is the primary processing location (for transfers outside the EU, adequacy decisions and Standard Contractual Clauses (SCC) are applied as necessary)
• Complaints to supervisory authorities: you may lodge a complaint with the data protection supervisory authority of your country of residence (e.g., the Irish DPC, the German BfDI)

12.2 California (US) users (CCPA / CPRA)

• Data subject rights: the right to request disclosure of information collected and used, the right to request deletion, the right to request correction, and the right to opt out of the sale or sharing of data
• Sale and sharing of data: the Company does not sell or share personal information with third parties for monetary or other valuable consideration
• Do Not Track: the Company does not currently respond to browser Do Not Track (DNT) signals
• Contact: [email protected]
• Supervisory authority: California Privacy Protection Agency (CPPA)

12.3 South Korean users (개인정보 보호법 / Personal Information Protection Act)

• Personal information processing policy: governed by the provisions of this Policy
• 개인정보 보호책임자 (Personal Information Protection Officer): Kazushige Shiba, Representative Director, KANOPY Inc.
• Contact: [email protected]
• Supervisory authority: 개인정보보호위원회 (Personal Information Protection Commission, PIPC) — https://www.pipc.go.kr/
• Additional disclosures for residents of South Korea: the items required under the PIPA (procedures and methods for destroying personal information, the right to refuse processing, remedies for infringement, security measures, etc.) are set out in the Korean version

13Where to File Complaints

Complaints, opinions, and inquiries regarding this Policy or the handling of personal information are accepted at the following contact point (the contact point under Article 40 of the APPI).

If the Company is unable to resolve your complaint, or if you are dissatisfied with our response, you may consult the Personal Information Protection Commission of Japan.

14Revisions to This Policy and Contact

14.1 Revisions to this Policy

The Company may revise this Policy in response to changes in laws and regulations, changes to the Service, or as otherwise necessary. In the case of material revisions, we will notify users before the effective date via the Service's app, the website, email, or other means.

14.2 Contact and personal information protection manager