Privacy Policy

1. Who we are

• Name: Apps Inc. (株式会社アップス)
• Address: Kyoei Bldg. 3F, 2-8-11 Shibata, Kita-ku, Osaka 530-0012, Japan
• Representative: Satoshi Nakai, Representative Director
• Contact: support@dontwork.co

2. What we hold, and where it comes from

• From signing in (GitHub or X): the account's identifier, display name, user name, the URL of your picture, and your email address; on X, your X user name as well. The sign-in system (Supabase Auth) also records the identifier, the email address and the time of sign-in. On GitHub we ask for one permission only — to read your email address (user:email); we never see code or repositories. On X we ask to read your profile and email address; we ask for no permission to post, follow or read DMs. X's own screen also lists reading your posts; we do not use that.
• From the connector on your computer: per day and per tool, the output tokens and the "AI hours" they convert to; how many times each of eight kinds of work (code, text, read, run, web, agent, service, talk) was used; a random mark that tells your computers apart (a string starting with m_); the connector's version. It never sends or stores your conversations, code, commands, file names, folder paths or the names of the models you used.
• From a usage CSV you exported by hand from Cursor's dashboard and added: per day, the output tokens and the number of requests, whether the day is at the edge of the file, the time zone the days are cut in, and when you added it. The CSV is parsed on your device and is never sent to or stored on our servers; model names, amounts and identifiers are not used in the totals, and are never sent or stored. When a kept day's number goes down (normally a smaller number from a later CSV you add, written after you say yes on the page; a correction by an operator as well), we keep — for fraud investigation, readable by operators only — that day, the time of the revision and the output tokens before and after.
• What you write: the day's line (up to 140 characters), the week's line (up to 120), your display name, country (optional, two letters), language, your companion's name, and your settings (visibility, mail, voice, whether the kinds of work may appear in your line, whether your AI may write takes on the news, and so on).
• What you write as “Things made” on your AI work history (optional, up to 10): a title, three sentences (what you made, what you left to the AI, what you did yourself), the month, the tools you chose, the item's place on your list, and when you wrote it and last changed it.
• What you do in the service: friendships and 👍; the companion, room, furniture, costumes, paints, accessories and BGM you have and where you placed them; meals, cleaning and eggs; the gacha and ticket history; coins earned and spent, and login stamps; home loans (the stage taken, its price, what is left, when it was taken and paid off, when Home said it was paid off, and how many coins each day of your logs repaid); which screens you opened and how many times a day; your answer to "why did you open it"; a log of mail sent to you (recipient, kind, sent or failed — never the body); your connected computers and keys (keys are stored hashed; the original value is not kept).
• Mail to us: mail sent to our support address (the sender's address, the body and the time) arrives in our mailbox on a mail server in Japan (Xserver Inc.); our staff read and answer it in that server's webmail. It is not forwarded to any other mail service. It is kept so that we can answer it.
• Cookies and browser storage: cookies for signing in (dw_session, 90 days; dw_refresh, 10 minutes), language (dw_lang), time zone (dw_tz), and short one-time marks for the stamp and the companion's moments (dw_stamp, dw_pet_fed, dw_new_token). The BGM volume (dw-bgm-volume) is kept in the browser's localStorage. During a sign-in, the sign-in system (Supabase) briefly uses the browser's storage. On this site there are no third-party cookies, no advertising or analytics tags and no external scripts.
• Access logs: to run the servers, our hosting provider (Vercel) keeps ordinary access logs (IP address, browser type, time, page opened) for the period the provider sets; where and how long they are kept follows the provider's terms. We do not use them to identify individuals.

3. What we use it for

• To run the service: keeping you signed in, counting, the profile and leaderboard, friends and the feed, the companion and play.
• To send the mail you chose: a weekly summary of your own records (on by default) and notices of friend requests (on by default). Both can be turned off in Settings. We may also send important notices about your account.
• To answer your questions, prevent abuse, and keep the service safe.
• To improve the service, by looking at aggregate counts such as how much each screen is used.
• To meet legal obligations.

4. Who can see what

• You choose your visibility: only you, your friends, or everyone. If you publish from /connect/ without having chosen, it is set to everyone.
• When set to everyone, your display name, user name, picture, country, AI hours (today, this week, all time), tools used, kinds of work (if you allowed it), your lines, and your companion and room can be seen by anyone, signed in or not, and may appear in search engines.
• When set to only-me or friends, you still count toward the leaderboard's totals and ranks, but your name, hours and picture are not shown.
• “Things made” are shown only on your AI work history page, at your visibility (everyone; your accepted friends and you; or only you) — never on your public page, the leaderboard, the timeline or any other public screen; your own editing sheet and the operator's review list are separate.
• Your email address is never shown to anyone. Replies to a friend-request mail go to our support address.
• Our operators may look at the information we hold in order to run the service, fix problems and investigate abuse.

5. Sharing and processors

We do not sell your personal information. We do not use it for advertising. We do not pass it to companies or recruiters for hiring or sales purposes. What anyone can see under the visibility you chose, and the processing we entrust to providers to run the service (next), are different things.

To run the service we use the following processors, bound by contract to handle the data only for the purpose we entrust to them.

• Vercel Inc. (US): serving the website and app. Servers are in Tokyo (hnd1). Access logs are kept as the provider's terms set out.
• Supabase Pte. Ltd. (Singapore): the database and the sign-in system. Data is stored in the Tokyo region.
• Plus Five Five, Inc. (US; the service is called Resend): sending mail (the weekly summary, friend-request notices, notices). The recipient address and the body are handed over for sending.
• Cloudflare, Inc. (US): the domain, and forwarding of mail sent to our support address.
• Xserver Inc. (Japan): the mail server of our support mailbox.

For the four processors outside Japan — Vercel, Supabase, Plus Five Five (Resend) and Cloudflare — on October 25, 2026 we reviewed the data-processing agreement built into each one's standard contract (the protective measures it describes: encryption, access control, third-party audits; its transfer mechanism; its notice of sub-processors; its deletion at termination) and the data-protection regime of its country. Mail sent to our support address is read and answered in our mailbox on a mail server in Japan (Xserver Inc.). Before October 29, 2026, a copy of the mail arriving there was forwarded to, and read in, the consumer mail service of Google LLC (US), Gmail; on that day we gave the support address its own mailbox, and nothing has been forwarded since (this sentence was rewritten the same day). We review each processor's contract terms and protections at least once a year, and again whenever we learn of a change in its terms or set-up or of a problem in its handling. If the needed protection cannot be assured, we stop providing data to that processor. On request, we provide information about the country's regime and the processor's protections.

GitHub (GitHub, Inc., US) and X (X Corp., US), which you sign in with, learn that you signed in to the service. Your picture is loaded by your browser directly from GitHub's or X's servers, so they receive your IP address and similar data.

"AI takes" (your AI writing about the day's news) is currently switched off, and nothing is sent for it. Before it is switched on again, we will explain what would be sent (display name, AI hours, rank, streak, voice setting, the news headline and so on), where (Anthropic, PBC, in the United States), that country's regime and the protections at the recipient, and ask for your consent. The lines you wrote by hand (the day's line, the week's line) and your conversations would never be sent.

We may disclose information where the law requires it, to the extent the law requires.

6. Retention and deletion

• We keep the information while your account exists.
• You can delete your account and all your records at any time with "Delete everything" in Settings. You can cancel for 24 hours after asking; after that, a scheduled run (normally within an hour) erases them, and keeps trying until it succeeds. What is erased: every row about you in the app's database (including friendships, 👍 and the mail log) and your record in the sign-in system (identifier, email address).
• Copies may remain in our providers' backups for a limited period. Providers' access logs are deleted on the provider's schedule. The sign-in system's audit records (such as the time of a sign-in — both those inside the database and those the provider keeps) are not removed by deleting your account; they remain as the provider's terms and our settings provide. Mail you sent to our support address stays in our inbox so that we can answer it (ask the same address if you want it erased).
• Signing out removes the sign-in cookies. The other cookies and localStorage can be cleared in your browser's settings. The files the connector keeps on your computer (its settings and key, and its memory of what it has read) are on your computer, and you can delete them.

7. What you can do

• See, correct, delete: in Settings you can change your name, country, visibility and mail settings, read the list of what we hold, disconnect computers and revoke keys, and delete your account.
• Requests about your retained personal data — disclosure, correction, addition, deletion, suspension of use, erasure, stopping third-party provision, notice of the purpose of use, or disclosure of third-party provision records — go to support@dontwork.co. We confirm it is you through the email address you registered or through the signed-in screen. A request through an agent needs a document showing the authority (such as a power of attorney). We answer by email as a rule and charge no fee, and we respond as the law requires.
• Complaints and questions go to the same address.

8. Security

• Connections are encrypted (HTTPS). Of your connector key, the server stores only a hash; the key itself sits in a settings file on your computer that only you can read.
• Only our server reads and writes the database; what a screen shows is decided by your visibility and your friendships. Server-side secrets (keys) are kept in the hosting provider's environment variables and in our secrets store.
• We keep operators and their permissions to a minimum. Our tests check the list of what we keep against the database migration files, so a mismatch fails the tests. Our processors' handling is set by the terms of their contracts.

9. Children

The service is not for anyone under 13. If we learn that we hold information about a child under 13, we delete it. If you are 13 or older but cannot decide on your own about the handling of your personal information, use the service together with a parent or other legal guardian.

10. Using the service from outside Japan

The service is operated under the laws of Japan (the Act on the Protection of Personal Information), and data is stored mainly in Japan (Tokyo). Most of the processors in section 5 are companies outside Japan. If the law where you live gives you other rights, the same contact address handles them.

11. Changes

When this policy changes, we post the change on this page with its date. For major changes we also say so inside the service.

October 30, 2026: in section 2, the item on the Cursor usage CSV now explains the log we keep when a kept day's number goes down (the day, the time, the output tokens before and after — readable by operators only). The publication date at the top and the version used for consent are unchanged.

November 2, 2026: sections 2 and 4 now describe “Things made” on the AI work history (an optional entry). The publication date at the top and the version used for consent are unchanged.

12. Contact

support@dontwork.co (Apps Inc. (株式会社アップス), Don't Work! team)