Privacy Policy

TOKU, LLC. (hereinafter “we,” “our,” or “the Company”) establishes this Privacy Policy regarding the handling of personal information across all services we operate (hereinafter “the Services”).

Services covered by this Policy

• tabiin (iOS app)
• Tabiato (iOS app)
• Tabippi (iOS app)
• Tabiniwa (iOS app)
• Tabigo (iOS app)
• Tabibako (iOS app)
• Tabisapo (iOS app)
• たべていい？ / Tabeteii (MamaScan) (iOS app)
• tabitabi (web service)
• FanPath Japan (fanpathjapan.com)
• Anime Spots (animespots.travel)
• TOKU, LLC. Corporate Website (toku.llc)

Note: The iOS apps tabiin, Tabiato, Tabippi, Tabiniwa, Tabigo, Tabibako, and Tabisapo share a unified cloud backend (Firebase project “toku-shared”). When users sign in with the same Apple ID or Google account, the same profile and friend information becomes available across these apps.

Note: たべていい？ / Tabeteii (MamaScan) also runs on the same cloud backend (toku-shared), but it does not share profile or friend information with the seven apps above. It uses its own dedicated data area, and content saved in Tabeteii is not visible to users of those apps.

(1) All Services

• Access logs (IP address, browser information, referring URL, access date/time)
• Data collected via cookies and similar technologies
• Information submitted through contact forms (name, email address, message)
• Usage data (Firebase Analytics): In our iOS apps, usage statistics — screen views, feature usage counts, time of use, approximate region (inferred from IP address at a level coarser than city), device and OS information, and an app instance ID — are sent to Firebase Analytics (Google LLC / USA) to improve our services. This data is used solely for quality and feature improvement analysis and does not include directly identifying information such as name or contact details. It is not used for ad personalization. Note that Tabisapo uses a configuration that does not depend on the advertising identifier (IDFA). Tabeteii (MamaScan) does not embed Firebase Analytics and sends no usage data.
• Crash diagnostics (Firebase Crashlytics): In our iOS apps, when a crash or critical error occurs, diagnostic information (device model, OS version, stack trace, and an anonymous app instance ID) is sent to Firebase Crashlytics (Google LLC / USA) and used solely to identify defects and improve quality. It does not include directly identifying information such as name or contact details. Tabeteii (MamaScan) does not embed Firebase Crashlytics and sends no crash diagnostics.
• Tabitabi ID (membership number): For accounts that sign in with Sign in with Apple, a Google account, or an email address and password to use any of our Tabi series apps other than tabiin (Tabiato, Tabippi, Tabiniwa, Tabigo, Tabibako, Tabisapo) or Tabitabi (Web), we issue a 10-digit membership number, the “Tabitabi ID,” and store it, linked to the user identifier (UID), in Cloud Firestore (Google LLC / USA, Firebase project “toku-shared”). We do not issue it before sign-in (while the account is anonymous). We do not issue it to users who use only Tabeteii (MamaScan). The Tabitabi ID is shown only on your own screens and is not disclosed to other users. It is not used as a means of logging in or verifying your identity. When you delete your account, we delete the link between your Tabitabi ID and your UID (the same number is never reissued to anyone else).

(2) tabiin App (Specific)

• Account information: Email address and user identifier (UID) obtained via Sign in with Apple or Google authentication. Used solely for account management and friend features.
• Visit records: Shrine/temple name, visit date, and notes entered by the user, stored on Cloud Firestore.
• Friend information: User ID and display name of friend-registered users.
• Sharing impressions with friends (“Everyone's impressions” feature, v2.7.0): For friends (accepted) you record as having visited together, a shared record is stored on Cloud Firestore so that participants can view each other's impressions and display names for that visit. Sharing is limited to the participants of that visit, and this feature (Tabiin's “Everyone's impressions”) never makes them public beyond those participants.
• Visit photos (optional): Photos attached during a visit (up to 5) are stored on Firebase Storage (Google LLC / USA). Photo library access occurs only when attaching photos; attachment is optional.
• tabiin does not access location, camera, or microphone.
• Advertising identifier (IDFA): Google AdMob banner and interstitial ads are displayed. The advertising identifier is used only when the user selects “Allow” in the App Tracking Transparency (ATT) dialog; otherwise only non-personalized ads are shown.
• External service integration (Rakuten Travel): Tapping the “Book on Rakuten Travel” button on a facility detail screen opens an external page operated by Rakuten Group, Inc. The link includes our affiliate identifier, but no personal information of the user is transmitted to Rakuten. Booking and browsing history on Rakuten Travel is governed by Rakuten's privacy policy.
• Account deletion is available via in-app Settings → Delete Account. All user data on Firestore and Firebase Storage is deleted immediately upon account deletion.

(3) Tabiato App (Specific)

• Location data (GPS): Used only during a check-in action to verify whether the user is within 500m of the pilgrimage spot. Collected only with explicit permission and not stored persistently on our servers.
• Account information: Email address and user identifier (UID) obtained via Sign in with Apple, Google authentication, or email/password registration. Used solely for account management and friend features. Before sign-in, a Firebase anonymous UID is used to associate data with a device.
• Check-in history (work ID, spot ID, visited date/time): Stored on Cloud Firestore for visit logging and history display.
• Check-in photos (optional): Photos attached during a check-in (up to 5) are stored on Firebase Storage (Google LLC / USA). Photo library access occurs only when attaching photos; attachment is optional.
• Friend information: User ID and handle name of friend-registered users.
• Work requests (optional): Work title, comments, and UID submitted via the request feature are stored on Firestore. Request content is used solely for internal listing review and will not be made public.
• Advertising identifier (IDFA): From v2.0.0 onwards, Google AdMob banner and interstitial ads are displayed. The advertising identifier (IDFA) is used for ad delivery only when the user selects “Allow” in the App Tracking Transparency (ATT) dialog shown at app launch. If “Ask App Not to Track” is selected, only non-personalized ads are shown.
• Crash diagnostics (Firebase Crashlytics): From v2.6.0 onwards, when the app crashes or encounters a critical error, diagnostic information (device model, OS version, stack trace, and an anonymous app instance ID) is sent to Firebase Crashlytics (Google LLC / USA) and used solely to identify defects and improve quality. It does not include directly identifying information such as name or contact details.

(4) Tabippi App (Specific)

• Account information: Email address and user identifier (UID) obtained via Sign in with Apple or email/password registration. Used solely for account management, friend features, and Trip sharing. Before sign-in, a Firebase anonymous UID is used to associate data with a device.
• Profile image (optional): A user-set profile avatar image is stored on Firebase Storage (Google LLC / USA). Photo library access occurs only when setting the image; setting an image is optional. The same image is also shown in tabiin, Tabiato, Tabiniwa, Tabigo, and Tabibako, which share the same toku-shared backend. It can be removed from the app's Settings screen.
• Trip information: Title, destination, dates, party size, budget, cover emoji, and cover photo (optional). Text data is stored on Cloud Firestore; cover photos are stored on Firebase Storage (Google LLC / USA). Photo library access occurs only when setting a cover photo; attachment is optional.
• Expense information: Item title, amount, category, payment date, and notes. Used for personal expense tracking and never shared with third parties, except for trips you choose to publish to Tabitabi. When you choose to publish, the scope shown on Tabitabi (Web) is described under “Publishing to Tabitabi (optional)” below; individual expense line items (item title, payment date, notes) are never published.
• Viewing and editing on tabitabi (Web) (optional): If you sign in to tabitabi with the same account, you can view and edit trip information, the day-by-day plan, and expense information from tabitabi. The data is stored in the same place as this app, and tabitabi keeps no copy of its own. See “Viewing and editing Tabippi trips in the browser” in (10) tabitabi for details.
• Publishing to Tabitabi (optional, off by default): Only when you choose “Publish to Tabitabi” for a given trip, a public snapshot of that trip is stored on Cloud Firestore (Google LLC / USA) and made publicly available on Tabitabi (Web). Published items: trip title, destination, prefecture, year and month (never the day), number of nights, number of travellers, the day-by-day plan (time, category, heading, notes), per-category expense totals, per-person total, and budget. Items never published: your user identifier (UID), trip member names and companion information, photos, individual expense line items, and the day component of dates. Publishing can only be selected after the trip has ended, and you can revert to private at any time using the same toggle in the app (doing so deletes the published data; it is also deleted when you delete the trip or close your account). ⚠ Published pages are served from a cache, so content may remain visible for up to about 10 minutes after you make it private.
• Friend information: User ID and handle name of friend-registered users.
• Trip-sharing information: When the user optionally shares a trip with a friend, the list of member UIDs (ownerUID / memberUIDs) is stored. The owner and members can each record and view expenses for the shared trip. Members can leave a shared trip at any time using the “Leave shared trip” action.
• Trip member names (when sharing is not used): Labels entered by the user for personal expense management (e.g., “Alex”, “myself”). We will not provide or disclose information about any third parties named in these labels.
• Settlement link (optional, v3.0.0): When the user chooses “Send as link” on the settlement screen, the app creates a link that embeds the trip title, dates, party size, total, the trip member names entered by the user, each member's paid and owed amounts, and the payments needed to settle (who pays whom, and how much) in the fragment portion of the URL (after #). Because browsers do not transmit the fragment to servers, we do not receive or store the content of the link. The user decides whom to send the link to. Anyone who knows the link can view this content, so please handle it with care. We cannot invalidate a link once it has been sent.
• Receipt scanning (optional, v3.0.0): When the user takes a photo of a receipt or selects one from the photo library, text is recognized from the image on the device (Apple's Vision framework) and the amount, date, and similar details are shown as suggested expense entries. The image and the recognized text are not sent off the device and are not stored on our servers. Photos taken with the camera for this purpose are not saved to the photo library.
• Tabippi Premium subscription information: When a user purchases a monthly or annual subscription, the app obtains transaction information (purchase and renewal status) on the device from Apple Inc.'s App Store (USA). This is used solely to check subscription status via StoreKit 2 and is not stored on our servers. We have no involvement in payment processing itself (card numbers, etc., are managed solely by Apple Inc.).
• Tabippi does not access location or the microphone. The camera is accessed only when the user chooses to take a photo for receipt scanning.
• Advertising identifier (IDFA): From v2.0.0 onwards, Google AdMob banner and interstitial ads are displayed. The advertising identifier is used only when the user selects “Allow” in the ATT dialog. Otherwise, only non-personalized ads are shown.

(5) Tabiniwa App (Specific)

• Account information: Email address and user identifier (UID) obtained via Sign in with Apple, Google authentication, or email/password registration. Used solely for diary storage, garden growth tracking, and friend features. In guest mode, only a Firebase anonymous UID is obtained.
• Diary information: Text, mood (5 levels), tags, date, and attached photos (up to 5, optional) entered by the user are stored on Cloud Firestore and Firebase Storage (Google LLC / USA).
• Sharing diaries with friends (Timeline feature, v1.3.0): Depending on the visibility you set for each diary entry, your accepted friends can view that entry's content and your display name. Visibility (“share with friends” on/off) is chosen per entry; by default, entries created before this feature (v1.3.0) are private. This feature (Tabiniwa's Timeline) never makes entries public beyond your friends. You can change visibility at any time to stop friends from viewing an entry.
• Garden information: Garden name, emoji, cover color, scope (trip / visited place / freeform), and 5-stage growth (seed / sprout / cotyledon / bud / bloom) are stored on Cloud Firestore. In v1.0.0, only the user can view it. A future update may add an option to share the garden with friends if the user explicitly opts in (we will update this Policy at that time).
• Visited place name (optional): If a photo attached to a diary entry contains location data in its EXIF metadata, we read those coordinates via ImageIO and transmit them to Apple Inc.'s geocoding service (CLGeocoder, USA) to convert them into a place name string (e.g., prefecture, municipality, country). Raw latitude and longitude are never stored on our servers; only the converted place name string is saved as the visit location. We do not request GPS device access permission (NSLocationWhenInUseUsageDescription). For photos without EXIF location data, the visit location is not auto-populated (the user can enter it manually).
• Friend information: User ID and handle name of friend-registered users. The same friend list is shared with tabiin, Tabippi, and Tabiato.
• Tabiniwa Premium subscription information: When a user purchases a monthly (¥480/month) or annual (¥4,800/year) subscription, we obtain the purchase receipt, transaction ID, purchase date/time, and renewal date/time from Apple Inc.'s App Store servers (USA). This information is used solely for subscription state verification via StoreKit 2. We have no involvement in payment processing itself (card numbers, billing amounts, etc., are managed solely by Apple Inc.).
• Tabiniwa does not request GPS device access permission or access the microphone. Camera and photo library access occurs only when attaching photos to a diary; attachment is optional.
• Advertising identifier (IDFA): From v1.0.0 onwards, Google AdMob banner and interstitial ads are displayed. The advertising identifier is used only when the user selects “Allow” in the ATT dialog.

(6) Tabigo App (Specific)

• Account information: Email address and user identifier (UID) obtained via Sign in with Apple, Google authentication, or email/password registration. Used solely for account management and friend features. Before sign-in, a Firebase anonymous UID is used to associate data with a device.
• Phrase information: Japanese phrases entered by the user, generated English sentences, and extracted English words with their meanings are stored on Cloud Firestore (Google LLC / USA). Only the user can view them; we never disclose them to third parties.
• About translation: Japanese→English and word translation is performed entirely on the user's device via Apple's Translation framework, and the text to be translated is not transmitted to external servers (language data is downloaded from Apple only on first use). Key-word extraction is also performed on-device (NaturalLanguage).
• Friend information: User ID and handle name of friend-registered users. The same friend list is shared with tabiin, Tabippi, Tabiato, and Tabiniwa.
• Tabigo does not access location, camera, microphone, or photo library.
• Advertising identifier (IDFA): Google AdMob banner and interstitial ads are displayed. The advertising identifier is used only when the user selects “Allow” in the ATT dialog; otherwise only non-personalized ads are shown.

(7) Tabibako App (Specific)

• Account information: Email address and user identifier (UID) obtained via Sign in with Apple, Google authentication, or email/password registration. Used solely for account management, friend features, and packing-list sharing. Before sign-in, a Firebase anonymous UID is used to associate data with a device.
• Packing data: Packing lists, items (name, category, quantity, assignee, notes, carry type), bags, and templates are stored on Cloud Firestore (Google LLC / USA).
• Trip import from Tabippi: When the user imports a trip they created in Tabippi (title, destination, dates, itinerary), it is displayed for reference on the same toku-shared backend. Only the user's own data is referenced and never provided to third parties.
• Friend information: User ID and handle name of friend-registered users. The same friend list is shared with tabiin, Tabippi, Tabiato, Tabiniwa, and Tabigo.
• Tabibako does not access location, camera, microphone, or photo library.
• Advertising identifier (IDFA): Google AdMob banner and interstitial ads are displayed. The advertising identifier is used only when the user selects “Allow” in the ATT dialog; otherwise only non-personalized ads are shown.
• Account deletion is available via in-app Settings → Delete Account.

(8) Tabisapo App (Specific)

• Account information: When authenticating via Sign in with Apple or a Google account, we obtain the email address and user identifier (UID). These are used solely to provide account management and friend features. Before sign-in, records are kept per device using a Firebase anonymous UID.
• Stadium visit records: Stadiums, visit dates, information about matches attended, notes, and earned badges recorded by the user are stored on Cloud Firestore (Google LLC / USA).
• Publishing to Tabitabi (optional, off by default): Only when you choose “Publish to Tabitabi” for a given visit record, a public snapshot of that record is stored on Cloud Firestore (Google LLC / USA) and made publicly available on the stadium pages of Tabitabi (Web). Published items: stadium, year and month (never the day), competition, fixture, the team you support, score, and your match note. Items never published: your user identifier (UID), friend information, earned badges, and the day component of the visit date. Match notes can only be published for visits recorded as attended in person. You can revert to private at any time (doing so deletes the published data; it is also deleted when you delete the record or close your account). ⚠ Published pages are served from a cache, so content may remain visible for up to about 10 minutes after you make it private.
• Match entry assistance: Based on the stadium and visit date selected by the user, we display candidate matches from match data we maintain, as a draft for the user's own record. This processing is completed within our own cloud backend, and no personal information of the user is sent to any external match data provider.
• Friend information: User ID and handle name of friend-registered users. The same friend list is shared with tabiin, Tabiato, Tabippi, Tabiniwa, Tabigo, and Tabibako.
• External social account names (optional, v2.11.0): X and Instagram usernames entered by the user in in-app Settings are stored in the user's profile on Cloud Firestore (Google LLC / USA). Providing them is optional and nothing is stored by default. They are used only to display the user's own profile and, if the user turns the option on in Settings, to show the username on share images the user creates. We do not use the X or Instagram APIs in any way — no connected-account authentication (OAuth), no posting on the user's behalf, and no retrieval of posts. We store only the text the user typed, and we do not verify its ownership. This item is visible to anyone signed in to our travel apps (not limited to friends). Clearing the field in Settings and saving deletes it.
• Tabisapo does not access location, camera, microphone, or photo library.
• Tabisapo does not display advertisements. It does not use Google AdMob, and does not obtain the advertising identifier (IDFA) or request App Tracking Transparency (ATT) permission.
• Account deletion is available via in-app Settings → Delete Account.

(9) たべていい？ / Tabeteii (MamaScan) App (Specific)

• Signing up is optional. All features — product assessments, history, favorites, and the pregnancy-week display — work without signing in. We ask you to sign in only when you choose to create or join a family group (shown in the app as 「かぞく」).
• Account information: Authentication is Sign in with Apple only; we do not offer email-and-password authentication. We obtain only your user identifier (UID) and a display name you may optionally set. We neither obtain nor store your email address (the information we request from Apple is limited to your name).
• Family group (「かぞく」): If you create or join a family group, we store on Cloud Firestore (Google LLC / USA) the user identifiers (UIDs) of the group members (up to 6), the creation date, the invitation code and its expiry (24 hours from issuance), and, for each member, an optional role label (papa / mama / grandparent / other), an optional display name, and the date they joined. The role label and display name are used for display purposes only.
• Shared favorites: Only if you are in a family group, we store on Cloud Firestore (Google LLC / USA) the information of products you add to favorites (product name, barcode number, brand, ingredient-list text, nutrient values, product categories, the source of the information, the assessment result, the note you entered, whether it is filed under “Mama” or “Baby”, the UID of the member who added it, and the created/updated timestamps). Only members of the same family group (up to 6) can view them; they are never made public. If you are not linked, favorites are stored only on your device.
• By default, pregnancy week and due date are stored on your device only. The due date you enter is saved on the device (UserDefaults) and the week is recalculated on the device each time it is displayed. Unless you choose to share it, it is never sent to our servers, to Cloud Firestore, or to your family group.
• Sharing your due date (optional, off by default): Only if you are in a family group, turn on “Show my due date to my family” in the app, and agree on the confirmation screen, we store the due date (year, month, day) and the UID of the member who shared it on Cloud Firestore (Google LLC / USA) and show it as a pregnancy week on the devices of members of the same family group. It is used solely for that display. You can turn it off at any time, and the stored due date is deleted at that moment. It is also deleted when you leave the family group or delete your account. Because a due date reveals the fact of a pregnancy, we handle it only upon your own action and consent.
• By default, information about your child and the mother's status is stored on your device only. A child's nickname and date of birth (used to calculate age in months), and whether the mother is pregnant or breastfeeding, are saved on the device. The child's nickname, age in months, and the mother's status are never sent to our servers, to Cloud Firestore, or to your family group. A child's date of birth is handled only if you choose to share it, as described in the next item. The app is intended for use by parents and guardians; we do not collect information from children themselves.
• Sharing your child's date of birth (optional, off by default): Only if you (a parent or guardian) are in a family group, turn on “Show my child's birthday to my family” in the app, and agree on the confirmation screen, we store the child's date of birth (year, month, day; up to 3 children), an identifier the app generated on your device, and the UID of the member who shared it in Cloud Firestore (Google LLC / United States), and use it to show age-appropriate guidance on the devices of members of the same family group. The child's nickname is not shared. The only purpose is age-appropriate display on family members' devices. You can turn it off at any time, and the stored dates are deleted at that moment. They are also deleted when you leave the family group or delete your account.
• Premium (subscription) purchase information: Purchases and payments are processed by Apple's App Store, and we do not obtain credit card numbers or other payment details. Whether Premium is active is verified on the device using information the device receives from Apple, and is not sent to our servers.
• Scan history: The history of scanned products and their assessments is stored only on your device and is not sent to our servers. You can delete it at any time in the app.
• Product lookup (Open Food Facts): When you scan a barcode, we query Open Food Facts (France) to retrieve product information. We send only the barcode digits and the identifying User-Agent string required by their terms of use (app name, version, and our contact email address). No user information — user identifier, pregnancy week, favorites, or history — is transmitted.
• Camera and photo library: Used only to scan barcodes and to read ingredient and nutrition labels. Label text recognition (OCR) is performed entirely on the device using Apple's Vision framework; photos you take or select are never sent to our servers and are not stored.
• Tabeteii does not access location or the microphone.
• Advertising identifier (IDFA): We display Google AdMob banner ads only (no full-screen interstitial ads). The app does not request App Tracking Transparency (ATT) permission and does not access the advertising identifier (IDFA) (from 1.0.0 build 3). Only non-personalized ads are shown. For ad delivery, the Google AdMob SDK transmits device and advertising information to Google LLC (USA).
• Product recommendations (Amazon Associates): We may display links to products that are useful during pregnancy. Tapping a link opens the Amazon.co.jp page in your device's external browser or the Amazon app (we never render Amazon pages inside our app). The links contain our affiliate identifiers, but we do not send your personal information, assessment results, favorites, or pregnancy week to Amazon. Handling of browsing and purchase information on the destination site is governed by Amazon.co.jp's privacy notice. We display the following disclosure at the relevant places in the app: 「Amazonのアソシエイトとして、合同会社德は適格販売により収入を得ています。」 (As an Amazon Associate, TOKU, LLC. earns from qualifying purchases.)
• Account deletion is available via in-app My Page → Delete Account. On deletion we revoke the Apple sign-in token, delete your member record in the family group, delete any due date and child's date of birth you shared, delete the group and its shared favorites if you are its last member, and delete the authentication account.

(10) tabitabi Web Service (Specific)

• Itineraries created in Tabitabi are not stored on our servers by default. Itineraries you create in the Tabitabi planner (title, dates, destinations, notes, budget, etc.) are saved only in your browser (localStorage). Clearing your browser data also deletes your itineraries. Data is stored on our servers only in the following three cases, each of which you choose yourself: (i) when you use “Account (cloud sync)” described below; (ii) when you select “Publish to Tabitabi” in one of our apps (Tabippi or Tabisapo) for a record you created there (see “Publication of records shared from our apps” below); and (iii) when you sign in with the same account as Tabippi to view or edit your Tabippi trips, or send a tabitabi itinerary to Tabippi (see “Viewing and editing Tabippi trips in the browser” below). Unless you choose one of these, our servers neither receive nor retain itinerary content.
• No account is required. Creating, editing, sharing, and printing itineraries are all available without signing up.
• Share URLs: When you share an itinerary, the data is compressed and embedded in the fragment portion of the URL (after #). Because browsers do not transmit the fragment to servers, we do not receive itinerary content even when it is shared. Anyone who knows the share URL can view the itinerary, so please handle it with care.
• Publication of records shared from our apps: Trip records (Tabippi) and match-attendance records (Tabisapo) that users have themselves chosen to publish are made publicly available as article pages on Tabitabi. The items published, the items withheld, and how to withdraw publication are as described under “Publishing to Tabitabi (optional)” in sections (4) Tabippi and (8) Tabisapo of this policy. Information that could identify the author (user identifier, name, photos, companions) is never published. If you find a problem with published content, please use the reporting link on the page or contact us at the address at the end of this policy; we will review it and take action such as removing the content from public view.
• Settlement link display: When a settlement link created by a Tabippi user is opened, the tabitabi settlement page (/settle) displays, within the browser, the content contained in the URL fragment (trip title, dates, member names, and amounts). This content is not sent to or stored on our servers. For usage measurement (Google Analytics 4), we send only the page URL without the fragment and the number of views and button taps.
• Usage data (Google Analytics 4): We send counts of page views and feature usage (creating, sharing, and printing itineraries, calendar export, affiliate link clicks, etc.) to Google LLC (USA). Only the event type and mechanical metadata (regional guide identifiers, partner names, placement types) are sent; itinerary content such as titles, place names, and spot names entered by users is never transmitted.
• Affiliate links: We display links to external booking pages for accommodation and local experiences/activities, including Rakuten Travel, Jalan, Booking.com, and KLOOK. These links contain our affiliate identifiers, but no personal information or itinerary content is sent to these partners. Handling of browsing and booking information on the destination site is governed by each partner’s privacy policy.
• Links to our apps: In contexts such as post-trip records, budgeting, and packing, we display links to our travel apps on the App Store. Only click counts are measured; no personal information is transmitted.
• Account (cloud sync): As an optional feature, and only if you sign in, we obtain your email address and user identifier (UID) via Firebase Authentication (Google LLC / USA) and sync itineraries to Cloud Firestore (Google LLC / USA). No such transmission occurs unless you sign in. Even when sync is enabled, on-device storage remains the primary copy.
• Viewing and editing Tabippi trips in the browser (optional, only when signed in): Only when you sign in to tabitabi with the same account you use in Tabippi, you can view and edit that account’s Tabippi trips on the Tabippi trips screen of tabitabi (shown as 「旅費の旅行」). The items handled are trip information (title, destination, dates, number of travellers, budget, cover emoji, and companions’ display names), the day-by-day plan (day, time, category, heading, notes), and expense information (item title, amount, category, payment date, notes, and who paid). In addition, if you choose to send an itinerary created in tabitabi to Tabippi (shown as 「旅費アプリに送る」), a Tabippi trip is created from that itinerary (title, destination, dates, number of travellers, and each plan item’s time, category, heading, and notes, with the sum of per-item costs set as the budget). This is used solely so that you and the members you share a trip with can view and edit Tabippi trips from a browser. The data is stored in the same Cloud Firestore (Google LLC / USA; Firebase project “toku-shared”) as the Tabippi app, and tabitabi keeps no copy of its own. Changes made in the browser are reflected directly in the Tabippi app. As in the Tabippi app, a shared trip can be viewed by its shared members, who can add and edit expenses (only the owner can edit the day-by-day plan and trip information). If you choose to turn a trip into a travel booklet (shown as 「しおりにする」), the trip information and day-by-day plan of the Tabippi trip (excluding expenses and companions) are copied into a tabitabi itinerary stored in your browser (localStorage). For usage data (Google Analytics 4), we send only the number of screen views, trips created, plans saved, expenses added, and conversions to a booklet, together with where a trip was created from (the tabitabi planner or this screen); trip titles, place names, amounts, and companion names are never sent.
• tabitabi does not display advertisements. It does not use Google AdSense or AdMob, and does not obtain advertising identifiers.
• tabitabi does not access location, camera, or microphone.

• Providing, operating, and improving our Services
• Providing friend features and user-to-user content sharing (limited to the scope each user selects and approves)
• Responding to inquiries and related communications
• Identifying accounts, responding to inquiries, and managing accounts across the Tabi series apps and Tabitabi (Tabitabi ID)
• Analyzing usage (Google Analytics)
• Delivering and optimizing advertisements (Google AdMob)
• Preventing unauthorized use and ensuring security
• Responding to Terms of Use violations and legal proceedings

We will not provide collected personal information to third parties except in the following cases.

• With the prior consent of the individual
• When required by law
• When necessary to protect the life, body, or property of a person

We may share information with the following service providers for operational purposes:

Transfer of Personal Data to Third Parties Outside Japan (Article 28)

Among the service providers listed above, Google LLC (Firebase, GA4, AdSense, AdMob), Apple Inc., and Vercel Inc. are located in the United States. The United States is not designated as a country with an equivalent level of personal data protection under Article 28 of Japan's Act on the Protection of Personal Information (APPI). However, we have entered into the Google Cloud Data Processing Addendum (Google Cloud DPA), the Apple Developer Program License Agreement, and the Vercel DPA, establishing a system that meets the standards for appropriate and reasonable data handling under Article 28, Paragraph 3 and Article 16 of the Enforcement Rules.

Note: Open Food Facts (France), which Tabeteii (MamaScan) queries for product information, and Amazon.co.jp, the destination of the product recommendation links, are not listed in the table above because we do not provide them with any personal data. What we send to Open Food Facts is limited to the barcode digits and the identifying User-Agent string. For Amazon.co.jp, only the link navigation occurs; we transmit no user information.

Our web services use cookies. You may disable cookies through your browser settings, though some features may not function properly as a result. Our iOS apps (tabiin, Tabippi, Tabiato, Tabiniwa, Tabigo, Tabibako) display Google AdMob banner and interstitial ads, and use the advertising identifier (IDFA) only when the user selects “Allow” in the ATT dialog (otherwise only non-personalized ads are shown). Tabeteii (MamaScan) displays Google AdMob banner ads only (no interstitial ads), does not show the ATT dialog, and does not access the advertising identifier (IDFA).

Access Analytics (Google Analytics 4)

Our web services (FanPath Japan, Anime Spots, tabitabi, toku.llc, etc.) use Google Analytics 4 (provided by Google LLC, USA) to analyze traffic. GA4 collects behavioral data via cookies and transmits it to Google's servers in the United States. This information is used solely for improving our services. To opt out of GA4 data collection, please use the Google Analytics Opt-out Browser Add-on.

Advertising (Google AdSense)

Our web services (FanPath Japan, Anime Spots, etc.) use Google AdSense (provided by Google LLC, USA) to serve advertisements based on user interests via cookies. Note that tabitabi does not serve advertisements. For Google's privacy policy, see Google Privacy Policy. You can manage ad preferences at Google Ad Settings.

For the transfer of GA4 and AdSense data to the United States, please refer to Article 4 “Transfer of Personal Data to Third Parties Outside Japan.”

Tabiato

The Tabiato app uses your device's GPS location only during a check-in action to verify whether you are within 500m of the pilgrimage spot. Location data is collected only with your explicit permission and is not stored persistently on our servers. Only the work ID, spot ID, and visited date/time are saved as check-in history — raw latitude/longitude is not retained. You may stop location access at any time by uninstalling the app or revoking location permissions in your device's OS settings.

Tabiniwa

The Tabiniwa app does not request GPS device access permission (NSLocationWhenInUseUsageDescription) at all. Only when a photo attached to a diary entry contains location data in its EXIF metadata, we read those coordinates via ImageIO and transmit them to Apple Inc.'s geocoding service (CLGeocoder, USA) to convert them into a place name string (e.g., prefecture, municipality, country). Only the converted place name string is stored as the diary's “visit location” on Cloud Firestore; raw latitude/longitude is never stored on our servers. For photos without EXIF location data, the visit location is not auto-populated, and the user can enter it manually instead.

We manage collected personal information appropriately and take measures to prevent unauthorized access, loss, and leakage. Personal information that is no longer needed after an inquiry is resolved will be promptly deleted, except where retention is required for Terms of Use violations or legal proceedings.

You may request access to, correction of, or deletion of your personal information held by us. Please contact us at the address below to submit such requests.

Our Services are not directed to children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will promptly delete it.

We may update this Policy as necessary. Changes take effect when posted on this page. When significant changes are made, we will update the “Last updated” date at the top of this page.

For inquiries regarding this Policy, please contact us through the following.