Privacy Policy

1. Information We Collect

The Operator collects the following information in providing the Service.

• Account information: email address, display name, and an internal username automatically assigned by the Operator. Passwords are stored only in hashed form; the original password itself is never retained
• External account information: the user ID, email address, display name, and profile image provided by Google when you sign in with Google
• Learning and usage data: your requests to and conversations with the Built-in AI, programs and other deliverables created by the Built-in AI, submissions, grading results, learning cards, learning progress, XP/League data, and Built-in AI usage
• Access information: IP address, browser information (User-Agent), referrer URL, pages viewed, time spent, campaign parameters, and approximate country/region
• Identifiers stored on your device: cookies and similar technologies (see Section 3)
• Inquiry information: the name, contact details, and content you provide when contacting us
• Error information: error logs used to investigate failures. Personal information such as email addresses is automatically masked before being recorded
• Payment information: information about paid-plan contracts and payments (subscription status, payment dates, amounts, etc.). Card information such as credit card numbers is collected and managed by the payment processor; the Operator does not retain it

2. Purposes of Use

We use the collected information for the following purposes.

• Providing and operating the Service, identity verification, and authentication
• Providing development and explanation features through the Built-in AI, automatically grading and evaluating submissions, and managing and visualizing learning progress
• Providing features such as the League, learning records, and the Gallery
• Billing, payment processing, and contract management
• Managing Built-in AI usage (such as applying daily limits)
• Responding to inquiries
• Preventing misuse and maintaining security
• Analyzing usage, improving the Service, and developing new features
• Sending important announcements and other necessary notices

3. Cookies and Similar Technologies

The Service uses the following cookies and similar technologies. We do not use third-party advertising cookies or external analytics tools such as Google Analytics; access analytics run on servers managed by the Operator.

We also use the browser's sessionStorage (cleared when the tab is closed) to analyze usage within a visit. You can disable cookies in your browser settings, but features such as signing in will no longer work.

4. Transmission to External Services

We use the following external services to provide the Service, and information is transmitted to them to the extent necessary.

• Amazon Web Services (AWS) (Built-in AI): to provide the Built-in AI feature, your requests to the Built-in AI, the programs being worked on, and similar data are processed on their servers in the Tokyo region (Amazon Bedrock)
• Stripe, Inc. (United States) (payment processing): we outsource payment processing for the paid plan, and information necessary for payment is processed by them
• Google LLC (external sign-in): only when you choose to sign in with Google, information is exchanged with Google for authentication
• Resend (email delivery): we outsource the delivery of emails such as account confirmation and password reset, and recipient email addresses are processed on their servers in the United States
• Cloudflare, Inc. (network relay and protection): traffic to the Service passes through their network, and IP addresses and similar data are processed for security purposes

Information sent to Amazon Web Services (Tokyo region) for the Built-in AI is handled in accordance with its terms. The Operator endeavors to use offerings (such as APIs) configured so that transmitted information is not used to train AI models. Please do not enter confidential information or personal information of third parties into the Built-in AI. Our error monitoring, access analytics, and feature configuration platforms run on servers managed by the Operator, and this data is not sent to external providers.

5. Provision to Third Parties

We do not provide personal information to third parties except in the following cases.

• With the user's consent
• When required by law
• When necessary to protect a person's life, body, or property and it is difficult to obtain the user's consent
• When entrusting processing to contractors to the extent necessary to achieve the purposes of use (we supervise contractors appropriately)

Provision to or entrustment with third parties located outside Japan (including the payment processor (United States), and the email delivery described in the preceding section) is handled in accordance with the Act on the Protection of Personal Information. Information about the personal information protection systems of the destination countries can be found in materials published by the Personal Information Protection Commission of Japan.

6. Information Made Public on the Service

By design, the following information is visible to other users and visitors. Your email address, the full text of your conversations with the Built-in AI, and the content of your learning cards are never made public.

• Learning records (display name, League tier, XP earned, tasks attempted and a summary of results)
• League (display name, weekly XP and ranking, learning streak)
• Gallery (works the user has chosen to publish: files created, a summary of results, a summary of the Built-in AI's work, display name, and any description the user enters)

7. Security Measures

We take technical and organizational measures to protect the information we collect, including TLS encryption of communications, hashed password storage, running created and submitted programs in execution environments isolated from other users, keeping external AI provider credentials out of users' execution environments, access control, and automatic masking of personal information in error logs.

8. Retention Period

We retain collected information only as long as necessary to achieve the purposes of use, and delete or anonymize it without delay when it is no longer needed. After account deletion, we may retain certain information for a limited period to the extent necessary to comply with legal obligations or prevent misuse.

9. Disclosure Requests and Account Deletion

Under the Act on the Protection of Personal Information, you may request notification of the purposes of use, disclosure, correction, addition, deletion, or suspension of use of your retained personal data. For these requests, including account deletion, please contact us through the Service's contact form. After verifying your identity, we will respond without delay in accordance with the law.

10. Minors

Minors should use the Service with the consent of a parent or other legal guardian.

11. Changes to This Policy

The Operator may revise this Policy as needed. Significant changes will be announced in advance by posting on the Service or by other appropriate means.

12. Operator Information and Contact

Inquiries about this Policy and the handling of personal information are accepted through the Service's contact form. The Operator's name and address will be provided without delay upon request. The notation based on the Act on Specified Commercial Transactions is published on a separate page.