rootry日本語

Privacy Policy

Last updated: October 7, 2026

rootry (the “Operator”) handles personal information and other information about users in the applications and related services provided by the Operator (the “Services,” including any to be provided in the future) as set forth below.

1. Information Obtained

1.1 Authentication Information

The Services use Firebase Authentication and Google, Apple, or anonymous authentication features, and may handle the following information:

If “Hide My Email” is selected with Apple, a relay email address issued by Apple may be provided. These items of information are processed within Firebase Authentication but, as a general rule, are not stored in the Cloud Firestore database.

1.2 Information Registered or Sent by Users

The Services may handle the following information:

1.3 Device, Usage, and Technical Information

The Services may set the Firebase UID as a user identifier in Firebase Analytics and Firebase Crashlytics. As a result, usage information or crash information may be associated with the user’s account.

1.4 Advertising Information

Services that display ads show ads served by Google AdMob. In displaying ads, advertising identifiers and other information may be processed for ad delivery and measuring ad effectiveness. On iOS, ads may or may not be personalized, depending on the App Tracking Transparency permission status.

Where the laws of the country or region in which the user is located impose consent or other requirements on the handling of information for advertising purposes, the Operator will, when distributing the Services in that region, take measures in accordance with those laws, such as implementing a consent management mechanism. The distribution regions of each service are shown on its App Store or Google Play listing page.

1.5 Purchase Information

For services with paid features (in-app purchases and subscriptions), purchase information and entitlement (right of use) status are sent to Apple or Google. For some services with paid features, this information may also be sent to payment management providers such as RevenueCat, Inc. to manage purchases and entitlements. For details, please see Section 6.

1.6 Information Not Obtained

The Services do not obtain device location information (information obtained from positioning features such as GPS), contacts, SMS messages, or call history. For avatar images and the like, the Services process only the images the user selects and do not send any other photos to servers.

The IP addresses described in Section 1.3, and the country or region information estimated from them, differ from location information obtained through positioning features and do not identify an area more precise than a city.

If the Operator provides features that require such information in the future, the Operator will revise this Policy and will obtain the information after asking for the user’s choice through the permission mechanisms provided by the OS.

2. Methods of Obtaining Information

The Operator obtains information by the following methods:

  1. Through users’ entering, creating, sending, or configuring information in the Services
  2. Through Google, Apple, or anonymous authentication features
  3. Through automatic collection by the Services and by SDKs such as Firebase
  4. Through inquiries and other communications from users

Where OS permission is required for access to photos on the device or to notification features, the Services ask for the user’s choice or permission by the method provided by the OS.

3. Purposes of Use

The Operator uses the information obtained for the following purposes:

  1. Creating accounts, authenticating users, and managing sign-in status
  2. Providing the features of the Services (sending and receiving content, joining, reactions, notifications, etc.)
  3. Generating responses with AI (for services with such a feature)
  4. Delivering push notifications and announcements necessary for operating the Services
  5. Responding to inquiries and reports, reviewing content, and taking necessary measures
  6. Preventing, investigating, and responding to unauthorized access, misuse, and violations of the Terms of Service
  7. Analyzing usage, improving quality, fixing bugs, and improving features
  8. Delivering ads and measuring their effectiveness (for services that display ads)
  9. Providing paid features and managing purchases and entitlements (for services with paid features)
  10. Notifying users of changes to this Policy or the Terms of Service and of other important matters
  11. Fulfilling legal obligations and responding to disputes

The Operator will not use User Content as advertising material or as training data for generative AI without the user’s individual consent.

4. Sharing Within the Services

  1. Nicknames, avatar images, User Content, reactions, and other information sent by users may be displayed, depending on the type of feature, to a limited group of members or to all users of the Services.
  2. Users to whom information is displayed can save it to their devices or copy it by means such as screenshots. The Operator cannot technically fully control saving, copying, or sharing by other users outside the Services.
  3. Where there is a feature for sharing information only among a limited group of members, anyone who knows the means of joining (such as an invitation code or link) can view the shared information. Please do not give the invitation code or link to anyone you do not want to see the information, and do not make it public.

5. Provision to Third Parties

The Operator does not provide personal data to third parties except with the user’s consent or in any of the following cases:

  1. Where based on laws and regulations
  2. Where necessary to protect the life, body, or property of a person and it is difficult to obtain the consent of the individual concerned
  3. Where especially necessary to improve public health or to promote the sound growth of children and it is difficult to obtain the consent of the individual concerned
  4. Where it is necessary to cooperate with a national government agency, a local government, or a party entrusted by either of them in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual concerned is likely to impede the performance of those affairs
  5. Where provided in connection with a merger, business transfer, or other succession of business

Even where a provision made in connection with entrustment does not constitute a provision to a third party under the Act on the Protection of Personal Information of Japan, the Operator exercises necessary and appropriate supervision over its entrusted parties.

6. Entrustment and Transmission to External Services

This Section also serves as the public disclosure under Article 27-12 of the Telecommunications Business Act of Japan (rules on external transmission). The Services may send information to the following external services and entrust them with processing necessary to provide the Services. The information sent, the Operator’s purposes of use, and the main purposes of use at the recipient are as follows.

6.1 Google LLC

In services with a feature that uses AI to generate responses, text entered by users, images, and other information necessary to use that feature may be sent to external AI providers. The Operator uses such providers after selecting contractual terms (a paid plan or equivalent terms) under which the content sent is not used for the provider’s product improvement or for training AI models. However, the content may be retained by the provider for a certain period for purposes such as preventing misuse, security, and legal compliance.

For information on how Google handles information, please see the following pages:

6.2 Apple Inc.

6.3 RevenueCat, Inc.

In services with paid features that use an external service to manage purchases and entitlements (rights of use), purchase information and entitlement status are sent to RevenueCat, Inc.

7. Handling Outside Japan

  1. Google LLC, Apple Inc., and RevenueCat, Inc. may handle user information on servers or at facilities outside Japan. The Operator reviews its contracts with its entrusted parties, the security control measures they publish, the legal systems of the countries in which they are located, and other matters, and exercises necessary and appropriate supervision. For specific processing locations and safeguards, please see each company’s pages listed in Section 6.
  2. The Operator is located in Japan and manages user information primarily within Japan. When users residing outside Japan use the Services, their information is transferred to Japan and to the countries in which the entrusted parties listed in Section 6 are located. The legal systems of the destination countries may not provide a level of protection equivalent to that of the user’s country of residence.
  3. Where the laws of the user’s country or region of residence require measures for cross-border transfers, such as obtaining consent or entering into standard contractual clauses, the Operator will take the necessary measures in accordance with those laws.

8. Retention Period and Deletion

  1. Information relating to accounts, profiles, and User Content is retained for as long as necessary to provide the Services.
  2. When a user deletes their account, the Operator deletes the Firebase Authentication account, the profile, and device information. However, User Content retained for use by other users, and information associated with it, may be retained for as long as necessary to provide the relevant feature.
  3. Depending on the service, content such as posts and chats is not automatically deleted after withdrawal. Such content may be retained for as long as necessary to provide that service, prevent the recurrence of misuse, and comply with laws.
  4. “Not deleting automatically” is different from “not responding to requests for erasure and the like.” The Operator will respond to requests from the individual concerned for disclosure, suspension of use, erasure, and the like in accordance with laws (see Section 11).
  5. Information relating to reports is retained for the period necessary for review, preventing recurrence, responding to violations of the Terms of Service, and handling disputes, and is deleted once it is no longer needed.
  6. Information processed by Firebase Analytics, Firebase Crashlytics, and other external services is retained in accordance with the Operator’s settings and the periods specified by each service.
  7. It may take a reasonable period of time for deleted information to be completely erased from backups, logs, or copies on other users’ devices.

9. Security Control Measures

The Operator takes necessary and appropriate security control measures, including the following, to prevent unauthorized access to, and leakage, loss, or damage of, personal data:

  1. Identifying the information handled and its purposes of use, restricting access rights, and deleting unnecessary information
  2. Authentication and access control through Firebase Authentication, Firebase Security Rules, App Check, and the like
  3. Encryption of communications, selection and supervision of entrusted parties, software updates, and monitoring for failures and unauthorized access
  4. In the event of a leak or similar incident, investigation, prevention of further harm, prevention of recurrence, reporting to the relevant authorities as required by law, and notification to the individuals concerned

Within the Services, access to the URLs where User Content is stored is restricted so that only the users to whom the content is displayed can obtain them. However, the Operator cannot prevent users who have obtained such URLs or displayed content from sharing them outside the Services, so please also refrain from sharing them with third parties. For details of the security control measures, please contact the point of contact in Section 13.

10. Minors and Children

  1. Minors who use the Services should obtain the consent of a parent or other legal guardian. Where the laws of the user’s country or region of residence specify an age below which the consent of a legal guardian is required for the handling of personal information, that age shall apply.
  2. The target age for each service is as indicated by the age rating shown on its App Store or Google Play listing page and by the guidance provided within that service.
  3. When the Operator provides a service directed primarily at children, the Operator will configure that service so that it does not personalize ads or use identifiers for advertising purposes.
  4. If the Operator learns that a particular user is a child under applicable law, the Operator will, in accordance with applicable law, take necessary measures such as ceasing the use of information about that user for advertising purposes and deleting that information. Where the matter can be addressed by the method described in the following paragraph, the Operator will first guide the user to that method, and once the information has been deleted by that method, the measures under this paragraph will be deemed completed.
  5. In services with an account deletion feature, the user, or the parent or guardian who manages the device, can delete the child’s account and the information associated with it at any time by deleting the account from the settings screen (Section 11(1)). If a parent or guardian believes that a child’s information has been obtained without the consent of a legal guardian, please first use this method. However, certain information may remain even after using this method (please see Section 8). For services without such a feature, where this method cannot be used, or to request erasure of any remaining information, please contact the point of contact in Section 13. The Operator will respond in accordance with the procedure in Section 11.

11. User Rights and Request Procedures

  1. Through the designated operations in the Services, users may be able to change their nickname, avatar image, and notification settings, delete User Content they have sent (the extent to which content can be deleted is as described in the guidance for each service), and delete their account.
  2. For the handling of data after account deletion or after leaving a service, please see Section 8.
  3. In accordance with the Act on the Protection of Personal Information of Japan, users may request notification of the purposes of use of retained personal data; its disclosure; its correction, addition, or deletion; suspension of its use or its erasure; cessation of its provision to third parties; or disclosure of records of its provision to third parties.
  4. Where the laws of the user’s country or region of residence grant other rights (such as access to information, restriction of processing, data portability, objection to processing, withdrawal of consent, and lodging a complaint with a supervisory authority), the Operator will respond in accordance with those laws.
  5. Please submit requests under the preceding two paragraphs to the point of contact in Section 13. The Operator will verify the requester’s identity and respond in accordance with laws. Where the request involves information about other users, or where otherwise permitted by law, the Operator may decline to disclose all or part of the requested information.
  6. Where a request can be fulfilled through features of the Services (such as account deletion, deletion of User Content, or changing notification settings), the Operator may guide the user to use those features. If the user finds it difficult to do so themselves, please let the Operator know.

12. Changes to this Policy; Language

  1. The Operator may change this Policy in response to changes in laws or in the content of the Services, among other reasons.
  2. When making material changes, the Operator will make them known by posting them on this page (including by updating the last updated date) or by other appropriate means. The Operator will not give individual notice. However, for changes that require users’ consent under law, such as adding purposes of use, the Operator will obtain consent again.
  3. The Japanese version of this Policy is the authoritative version. Where the Operator provides a translation and there is any discrepancy between the Japanese version and the translation, the Japanese version shall prevail.

13. Business Operator Handling Personal Information; Contact

For inquiries regarding this Policy, the handling of personal information, requests for disclosure and the like, or complaints, please contact the Operator through the Contact page or at the following. The name and address of the business operator handling personal information will be provided without delay upon request by the individual concerned.