COMPONENTS
Sign in

Privacy
Policy

How TOBIRA STUDIO handles personal information and usage data.

Component commerce stores your Google user ID, email, display name, purchase rights, allowances, project collections and team information in Neon PostgreSQL. Signed cookies maintain authentication and validate login requests. Vercel serves the site and API; Stripe processes billing details and card payments. Our server does not store card numbers.

Component commerce terms

Effective: 26 July 2026Last updated: 3 August 2026Controller: TOBIRA STUDIO (sole proprietor: Kensei Yasue)

1. Our approach

TOBIRA STUDIO (sole proprietor: Kensei Yasue) ("we", "us") handles the personal information and related data we collect in providing TOBIRA STUDIO (the "Service") properly and in accordance with applicable law.

This policy covers the Service’s website, its in-browser features, the account features built on Supabase, enquiries, and — once sales open — purchasing and support.

Paid plans and payment are still being prepared.
Legacy account features use Supabase and Google OAuth for Google sign-in. Stripe is connected for component commerce, but sales remain closed.

2. What we collect

The website and account features today

  • Account information: display name, email address, authentication identifiers, authentication and login records, and account status
  • Google sign-in: if you sign in with Google, the name, email address, profile image and authentication identifier within the scope you granted
  • Usage data: favourites, viewing history, copy counts, display settings and other interaction state — held in your browser or in Supabase depending on the feature
  • Enquiries: the name, email address, message and correspondence history you send us by email
  • Delivery and technical data: IP address, browser, device, referrer, access time, and error and security logs processed by our hosting providers

Once sales open

When paid plans go on sale we will collect the plan you chose, contract status, purchase date and time, billing history, payment identifiers and whatever else the contract and payment require. We will update this policy to reflect the actual payment processing before that starts.

3. Why we use it

  • Authenticating you; creating and maintaining your account, login state, favourites, viewing history and display settings
  • Answering enquiries and sending important notices
  • Preventing and investigating misuse, security incidents and breaches of the terms
  • Improving the quality, usability and stability of the Service
  • Once sales open: payments, Premium access control, renewals, cancellations, refunds and billing support
  • Meeting our legal, accounting, tax and dispute-related obligations

4. Third-party services

In use now

  • Vercel: Delivering the website and live previews, operational logging, security and performance
  • Supabase: authentication, account information, authentication cookies, profile, favourites and application data storage
  • Google OAuth: authenticating you and retrieving profile information when you sign in with Google
  • Google Fonts: delivery of web fonts
  • Cloudflare R2: delivery of image and video previews
  • Amazon CloudFront: delivery of video previews
  • MotionSites: delivery of some image previews

When these external assets are displayed, the providers delivering them may process your IP address, browser and device information, referrer and access time.

The payment integration for new components is connected.When we do begin selling, we will enable only the features required and update this policy beforehand.

Planned once sales open

  • Stripe:payments, subscriptions, billing management and fraud prevention

Each provider processes data under its own terms and privacy policy and its contract with us.

5. Payment information

The Service does not currently accept card details.Once sales open, the plan is for Stripe to process card numbers, security codes and the like directly, with nothing stored on our servers.

Once sales open we may receive the payment result, amount, date and time, contract status and Stripe identifiers needed to manage the transaction.

For your own safety, never email us a card number or security code.

6. Cookies and local storage

The gallery’s in-browser features keep your sign-in display state, favourites, viewing history, copy counts and display settings in your browser’s local storage.

Server-side account features use cookies to keep your Supabase authentication session, and send account information and server-stored favourites to Supabase. If you clear or disable cookies or local storage in your browser, parts of signing in and saving may stop working.

7. Disclosure to third parties and processing abroad

We do not sell or disclose personal information to third parties, except with your consent, to processors needed to run the Service, in a business succession, or where the law requires it.

Because we use third-party services, data may be stored or processed on servers outside Japan. We check our processors’ security measures and contract terms and apply the protections required.

8. Retention and security

Information in local storage stays on your device until you clear your browser data. Account information is held in Supabase for as long as we need it to provide the account, keep it secure, prevent fraud, answer enquiries and respond to legal claims. Enquiry records are kept for as long as handling them requires, then securely deleted. Logs processed by external delivery providers are retained for the period set by each provider’s configuration and contract.

Contract and transaction data collected once sales open is kept for as long as performing the contract, answering enquiries, accounting, tax and legal claims require. We apply security measures appropriate to the nature of the data, including access control, encrypted transport, permission management, log monitoring and processor oversight.

9. Your rights

Within the limits of the law, you may request disclosure, correction, suspension of use or deletion of your personal information, or closure of your account. We may verify your identity using your registered email address or other information.

Where the law or a legitimate business need requires records — transaction records, for instance — to be kept, we may retain them for the prescribed period even after such a request.

10. Changes and contact

If we make a material change to this policy we will announce it on the Service or by email to your registered address, stating the date it takes effect.

For questions about how we handle personal information, write to contact pageorinfo@tobira.studio.