Privacy Policy

Effective date: October 4, 2026

1. Information We Collect

1. We collect the following information to the extent necessary to provide the Service.

2. Access Logs

1. When you access the Service, our hosting servers automatically record information such as your IP address, browser type and version, referring page, access time, pages viewed, and error records. We use these records to investigate failures, prevent unauthorized access, and improve the Service.

3. Device Information

1. We may collect your device type, operating system, screen size, language settings, and theme settings to adjust how the Service is displayed.

4. Personal Information

1. Account information: email address, password (stored in encrypted form so that we cannot view the original value), authentication identifiers, and login records.
2. When you sign in with Google: your name, email address, profile image, and identifiers within the scope authorized through Google.
3. Information selected during onboarding, such as your occupation and industries of interest.
4. Usage records: saved designs, works whose code you unlocked and unlock counts, browsing history, and display settings.
5. Subscription and payment information: plan, subscription status, purchase dates, billing history, and Stripe identifiers. Stripe directly handles card numbers and security codes; we do not store them.
6. Inquiry information: name, email address, inquiry content, and records of our responses.
7. Referral information: invitation codes and the relationship between the person inviting and the person invited.

5. Grounds for Processing Personal Information

1. We process personal information to perform our agreement with you (including providing accounts and plans), with your consent, to fulfill legal obligations, or for our legitimate interests, such as preventing fraud and improving the Service.

6. Purposes of Use

1. Verifying identity, creating and maintaining accounts, and keeping users signed in.
2. Providing Service features, including saved designs, code-unlock counts, and display settings.
3. Handling payments, subscription renewals, cancellations, and billing.
4. Responding to inquiries and sending important notices.
5. Preventing and investigating misuse, security incidents, and violations of the Terms.
6. Improving the quality and usability of the Service by analyzing usage.
7. Addressing legal, accounting, tax, and dispute-related matters.

7. Security Measures

1. We take security measures appropriate to the nature of the information, including encryption of communications, access-permission management, log monitoring, and supervision of service providers. However, we cannot guarantee complete security for communications or storage over the internet.

8. Retention Periods

1. Account information is retained until the account is deleted. Subscription and payment records are retained for the periods required by accounting and tax laws. Inquiry records are securely deleted after the period necessary to handle the inquiry. Access logs are retained for the periods configured by the hosting provider.

9. Information About Minors

1. Users under 16 must obtain the consent of a parent or other legal guardian before using the Service. If we learn that we collected personal information from a person under 16 without that consent, we will promptly delete it.

10. Disclosure to Third Parties

1. We do not provide or sell personal information to third parties except:
   1. With the individual’s consent.
   2. When entrusting information, to the extent necessary to provide the Service, to the service providers listed below.
   3. When the business is transferred through a merger, business transfer, or similar transaction.
   4. Where required by law or necessary to protect a person’s life, body, or property.

11. External Services We Use

Each provider handles information in accordance with its own terms and privacy policy and its agreement with us.

12. Processing Outside Japan

1. Because we use the external services above, personal information may be stored and processed on servers outside Japan, primarily in the United States. We use these providers after confirming that they take measures necessary to protect personal information.

13. Your Rights

1. Within the scope provided by law, you may request disclosure, correction, suspension of use, or deletion of your personal information, or deletion of your account. Contact info@tobira.studio. We may verify information such as your registered email address to confirm your identity.
2. Information that must be retained by law or for legitimate reasons, such as accounting records, may be retained for a period after your request.

14. Cookies and Local Storage

1. The Service uses cookies to keep you signed in. It also stores theme and language settings, display state, and similar information in your browser’s local storage.
2. You can delete or disable cookies and local storage through your browser settings. Doing so may prevent login or make some features unavailable.

15. Business Transfers

1. If the business operating the Service is transferred through a merger, business transfer, or similar transaction, personal information will be transferred to the successor. The successor will handle personal information in a manner equivalent to this Policy.

16. Scope of This Policy

1. This Policy applies to the handling of personal information within the Service. It does not apply to information handled by external sites linked from the Service. Please review those sites’ policies.

17. Changes to This Policy

1. We may change this Policy in response to changes in law or the Service. We will announce material changes through the Service or by notice to your registered email address and specify their effective date.

18. Contact

1. For questions about how we handle personal information, contact info@tobira.studio.
   Operators: TOBIRA STUDIO (sole proprietors: Kensei Yasue and Kotaro Okada)
   Contact: info@tobira.studio

MCP connections and your chosen AI provider

When you connect an AI client, TOBIRA uses your account, plan, permissions, connection identifier and usage records to authenticate requests and enforce your allowance and connection budget. Tool responses, including content you explicitly open, are sent to the client you authorize. That provider handles received content under its own terms and privacy policy. You can inspect and revoke connected applications and API keys in Security settings. Revocation prevents later requests and does not remove copies already held by the provider.