Privacy Policy

01Basic Policy

KANOPY Inc. (the "Company") believes that handling users' personal information appropriately in providing the golf community service "ROUNDIE" (the "Service") is part of our social responsibility.

The Company complies with the Act on the Protection of Personal Information of Japan (the "APPI") and other applicable laws, regulations, and guidelines, and handles personal information in accordance with this Privacy Policy (this "Policy").

02Information We Collect

The Company collects the following information in order to provide the Service.

2.1 Information provided by users

2.2 Information collected automatically

• IP address (see below for how it is handled), device type, OS version, and app version
• Your device's time zone (so that new Editions, reminders, and similar features follow your local time)
• Access logs, dates and times of use, and feature usage
• In-app screen views and interaction events such as taps (for usage analysis; see Article 6). This includes information that our analytics tool (PostHog) adds automatically, such as device name, device model, screen size, language and region, and time zone
• Measurements of how smoothly the screen scrolls (numbers only; to improve display performance)
• Crash reports and error logs (to improve app quality)
• Identifiers obtained through cookies and similar technologies (see Article 6 for details)

How we handle IP addresses: In addition to the above, we use IP addresses for the following purposes.

• Preventing misuse — When an invite code is looked up, we count lookups using the IP address as is, to prevent a large number of lookups in a short time (the count restarts every minute). This count record is deleted within 24 hours of the last lookup. Other features also use IP addresses for the same purpose, but only count requests in server memory and do not store them
• Carrying over invitations — When an invite link is opened on the web, we record a hashed value of the IP address (we do not store the IP address itself) together with the invitation. Only if someone who newly signs up in the app within 48 hours of the link being opened has a matching IP address do we link that invitation to their account (to take them directly to what they were invited to). These records are deleted within 1 hour after 48 hours have passed since they were made

2.3 Location (approximate)

Only when you tap "Courses nearby" while recording a round or creating a tournament, ROUNDIE gets your device's location once per tap and uses it to find golf courses near you.

• We get it only if you allow location access in your device settings, and on both iOS and Android we ask only for your approximate location. We do not get your location when you have not tapped the button or when you are not using the app (in the background).
• What we send to our servers (Supabase; see Articles 5 and 7) is only an approximate location, with latitude and longitude rounded to two decimal places (about 1 km).
• The location we receive is used only to look up nearby golf courses and return the results. It is not stored afterward, it is not recorded with your account, and it is not sent to our usage analytics (PostHog) or crash reporting (Sentry) tools.
• You can turn off location access at any time in your device settings. You can still record rounds by searching for a course by name.
• This feature is not offered in South Korea. If your device's region is set to South Korea (including when the region is set to a country other than Japan or South Korea and the time zone is set to Korea), "Courses nearby" is not shown.

2.4 Information we do not collect

The Company does not collect the following information.

• Continuous or background location data (we get your location only when you tap "Courses nearby", as described in 2.3)
• Unauthorized access to your contacts, address book, calendar, or photo library (accessed only when necessary for posting and only with your explicit permission)
• Microphone access (the Service does not provide any audio recording features)

03Purposes of Use

The Company uses the personal information it collects for the following purposes.

1. Providing, operating, and maintaining the Service
2. Finding golf courses near you (location; see Article 2.3)
3. User authentication, account management, and identity verification
4. Providing subscriptions and managing billing
5. User support and responding to inquiries
6. Analysis for improving the Service, developing new features, and enhancing quality
7. Preventing fraudulent use and investigating and responding to violations of the Terms of Service
8. Notifying users of Service announcements, maintenance information, and important changes
9. Notifying those who signed up through the website form when the Android version is released
10. Informing users, with their consent, of new features, campaigns, and the like (Article 9.5)
11. Creating, using, publishing, and providing to third parties statistically processed information that cannot identify individuals
12. Other purposes incidental to the above

If the Company uses personal information beyond the purposes above, it will obtain the user's prior consent.

04Provision to Third Parties

The Company will not provide personal information to third parties without the user's consent, except in any of the following cases.

1. When required by law (formal requests from courts, police, or other public authorities)
2. When necessary to protect a person's life, body, or property and it is difficult to obtain the user's consent
3. When particularly necessary to improve public health or promote the sound development of children
4. When it is necessary to cooperate with a national government agency or the like in executing affairs prescribed by law
5. When personal information is transferred in connection with a business succession (merger, corporate split, business transfer, etc.) (in which case users will be notified in advance)

05Outsourcing

In providing the Service, the Company may outsource part of its operations to trusted third parties (service providers). Service providers are contractually required to handle personal information appropriately and are supervised by the Company.

The principal service providers are as follows.

Service providers handle personal information in accordance with their contracts with the Company and with their own privacy policies.

06Cookies and Tracking Technologies

The Service uses cookies and similar technologies (local storage, device identifiers, etc.) to analyze usage, improve the user experience, and maintain authentication state, among other purposes.

6.1 Purposes of use

• Keeping you logged in
• Saving user preferences (language, display mode, etc.)
• Statistical analysis and improvement of Service usage
• In-app usage analytics for UX improvement
• Crash reporting and error analysis

6.2 Use of third-party tools

The Service uses industry-standard analytics tools such as the following to analyze usage and improve quality. We do not send your name or email address to these tools. Website measurement (our own website measurement and Cloudflare Web Analytics) does not use cookies or device identifiers. For in-app analytics (PostHog) and defect investigation (Sentry), we send your user UUID and ROUNDIE ID (handle) to distinguish users (the items we send are listed in Article 5).

• Our own website measurement (roundie.app top pages) — we count page views, taps on the App Store and Android buttons, and form sign-ups as totals per day, language, referrer domain, and country of access. We do not use cookies, device identifiers, or IP addresses, and we do not create records for individual people
• Cloudflare Web Analytics — statistical analysis of website page views, referrers, etc. (measured without using cookies or device identifiers)
• PostHog (EU region) — analysis of in-app screen transitions and interaction events (we do not use session replay, i.e., recording of interactions)
• Sentry (United States) — crash reporting and error analysis
• The standard analytics features of each OS (iOS / Android)

Of these, our own website measurement, Cloudflare Web Analytics, and cookies and similar technologies are used only on the Company's websites (such as roundie.app). Data collection within the iOS / Android apps is limited to crash analysis (Sentry) and usage analytics (PostHog); we never collect the advertising identifier (IDFA) or perform cross-app tracking.

For details on how these third-party tools are handled, please also see the Cookie Policy.

6.3 Opting out

You can restrict cookies and tracking features through your browser settings or your OS privacy settings. Note, however, that doing so may make some features of the Service unavailable.

6.4 Affiliate links (links to external e-commerce sites)

The Service may display links to products on external e-commerce sites (such as Rakuten Ichiba), for example as tournament prize suggestions. These links may use affiliate programs under which the Company receives a referral fee; where that is the case, we will clearly indicate that the link is sponsored (e.g., with a "PR" label). The Company does not collect any information about your browsing or purchases on the linked sites (such as your name, payment details, or purchase history). The handling of personal information on linked sites is governed by the privacy policy of the respective operator.

07Cross-Border Transfers of Personal Information

The Service transfers personal information to businesses outside Japan as described below (including entrusting storage and processing). In each case, the information is sent over the network, using encrypted communication (TLS), as you use the Service. The Service's core database, authentication infrastructure, and storage (Supabase) operate in the Singapore (ap-southeast-1) region, and core data such as sign-ups, round records, and tournaments is processed and stored on servers in Singapore.

• Supabase Inc. (Singapore)
  Items transferred: Information handled by the Service (account information, posted content, etc. under Article 2)
  Purpose: Providing the Service (data storage and authentication)
  Retention period: Until you delete your account (Article 8)
  Contact: privacy@supabase.com
• PostHog, Inc. (Germany, EU region)
  Items transferred: User UUID, ROUNDIE ID, sign-in method, sign-up date, display language, device language and region, device / OS / app version and similar information, and interaction events
  Purpose: Usage analytics
  Retention period: 1 year from collection (the retention period of PostHog's current plan; data older than this is subject to deletion). When you delete your account, your usage analytics data recorded in PostHog is also deleted (PostHog may take some time to complete the deletion)
  Contact: privacy@posthog.com
• Functional Software, Inc. (Sentry, United States)
  Items transferred: Crash and error information, device / OS / app version and similar information, user UUID, and ROUNDIE ID
  Purpose: Investigating defects
  Retention period: Up to 90 days from collection
  Contact: compliance@sentry.io
• RevenueCat, Inc. (United States)
  Items transferred: User UUID and purchase / subscription status
  Purpose: Managing in-app purchase status
  Retention period: Until the Company stops using RevenueCat (after which it is deleted in accordance with RevenueCat's terms. Not linked to account deletion, but we will delete it upon request)
  Contact: compliance@revenuecat.com
• 650 Industries, Inc. (Expo, United States)
  Items transferred: Push notification tokens, notification content, and information needed to check for app updates (such as the app version)
  Purpose: Delivering push notifications and app updates
  Retention period: Push notification delivery records are deleted after 24 hours. Information associated with checking for app updates is retained in accordance with Expo's privacy policy (only as long as necessary for its purposes)
  Contact: Contact form on expo.dev
• Plus Five Five, Inc. (Resend, United States; emails are sent from Tokyo)
  Items transferred: Email addresses and email content
  Purpose: Delivering authentication emails, notices, and report notifications, and notifying the operator when someone signs up through the website form
  Retention period: Sending records are kept for 30 days (Resend's retention period)
  Contact: support@resend.com
• Apple Inc. / Google LLC (United States)
  Items transferred: Push notification tokens and notification content
  Purpose: Delivering push notifications (via Expo)
  Retention period: According to each company's privacy policy
• Cloudflare, Inc. (United States)
  Items transferred: Website browsing information (pages viewed, IP address, etc.), and email addresses and related information submitted through the website form
  Purpose: Website delivery and usage analytics, and storage of website form submissions
  Retention period: According to Cloudflare's privacy policy (for website form submissions, as set out in Article 8)

Regarding the personal information protection regimes of the destination countries and regions: in Singapore, the Personal Data Protection Act (PDPA) applies; in Germany (EU), the General Data Protection Regulation (GDPR) applies; the United States has no comprehensive federal law, and sector-specific federal laws and state laws (such as California's CCPA) apply. In accordance with the APPI and other applicable laws, the Company verifies the personal information protection regimes of destination countries and the security measures taken by recipients, and maintains an appropriate level of protection.

Because these transfers are necessary to provide the Service, if you do not wish your information to be transferred, please delete your account (in which case you will no longer be able to use the Service).

08Retention Periods

The Company retains personal information only for the period necessary to achieve the purposes of use. Specific retention periods are as follows.

Accounts that have not used the Service for an extended period (24 months or more since the last login) may be deleted after prior notice to the user.

09Users' Rights

Users have the following rights with respect to their own personal information held by the Company.

9.1 Requests for disclosure, correction, suspension of use, and deletion

• Disclosure request: the right to request disclosure of the user's own personal information held by the Company
• Correction, addition, and deletion request: the right to request correction and the like where the content of personal information is inaccurate
• Suspension of use and erasure request: the right to request suspension of use or erasure of personal information
• Request to stop third-party provision: the right to request that provision to third parties be stopped

9.2 Account deletion

Users can delete their own account at any time from the account settings screen in the Service. Upon deletion, posted content, reactions, tournament participation history, and other data tied to the account will be deleted from the Company's database. Please note that deleted accounts cannot be restored. For payment-related records, we remove information that identifies you and keep only the product, amount, currency, country, and date and time as accounting records (Article 8). Records sent to PostHog for usage analytics are also deleted. Records sent to external businesses for defect investigation and billing management (Sentry and RevenueCat; Article 7), on the other hand, are not automatically deleted together with your account; they are deleted when each business's retention period (Article 7) ends. If you would like them deleted sooner, please contact us at the address at the end of this Policy, and we will ask each business to delete them. For the steps, including how to request deletion if you no longer have the app, see Deleting Your Account.

9.3 Data export

A feature for exporting the data you have registered and posted in JSON or CSV format is currently under development. We will announce its availability in this Policy when it launches. Until then, if you send a request to the contact listed at the end of this Policy, we will verify your identity and disclose the data we hold within a reasonable period.

9.4 How to make a request

To exercise any of the rights above, or for inquiries about the handling of personal information, please contact us at the address listed at the end of this Policy. We will respond within a reasonable period after verifying your identity.

9.5 Stopping notices about new features and campaigns (push notifications)

We send push notifications about new features, campaigns, and the like only to users who have agreed to receive them in the app's settings (the default is not to receive them). You can withdraw your consent at any time from the notification options in the app's Settings. After you withdraw it, you will no longer receive these notices. Other notifications, such as comments and tournament updates, follow their own notification settings.

We do not send these notices at night in your local time (from 9 p.m. to 8 a.m.).

10Security Measures

The Company takes appropriate measures, including the following, to prevent the leakage, loss, or damage of personal information and to otherwise manage personal information securely.

• Organizational measures: appointment of a personal information protection manager, establishment of internal rules, and regular training
• Technical measures: encrypted storage of passwords, TLS encryption of communications, minimization of access privileges, and detection of unauthorized access
• Physical measures: physical security of server facilities (via the facilities of our service providers)
• Personnel measures: confidentiality obligations for employees and information management including after separation from employment

11Use by Children

The Service may not be used by anyone under the age of 14. The Company does not knowingly collect personal information from anyone under 14.

If you reside in the EU, under Article 8 of the GDPR the consent of a parent or legal guardian is required for children under 16 (member states may lower this age to 13). The Company responds without delay to deletion requests from parents or guardians.

If we discover that we have collected personal information from anyone under 14, we will delete it promptly. If you believe a child's personal information has been registered, or if you wish, as a parent or guardian, to request its deletion, please contact our inquiry desk.

12Additional Information for Overseas Users

The Service also supports the EN and KO languages and may be used by users residing overseas, including in the EU, the United States, and South Korea. The following describes the Company's compliance with the principal data protection laws of each region.

12.1 EU users (GDPR)

• Legal bases: GDPR Art. 6(1)(a) consent / Art. 6(1)(b) performance of a contract / Art. 6(1)(f) legitimate interests
• Data subject rights: right of access (Art. 15), right to rectification (Art. 16), right to erasure / right to be forgotten (Art. 17), right to restriction of processing (Art. 18), right to data portability (Art. 20), and right to object (Art. 21)
• Deadline for responding to erasure requests: within 30 days of receipt (GDPR Art. 12(3))
• Data Protection Officer (DPO) contact: roundie@kanopy-inc.com
• Transfers outside the EU: the Supabase Singapore (ap-southeast-1) region is the primary processing location (for transfers outside the EU, adequacy decisions and Standard Contractual Clauses (SCC) are applied as necessary)
• Complaints to supervisory authorities: you may lodge a complaint with the data protection supervisory authority of your country of residence (e.g., the Irish DPC, the German BfDI)

12.2 California (US) users (CCPA / CPRA)

• Data subject rights: the right to request disclosure of information collected and used, the right to request deletion, the right to request correction, and the right to opt out of the sale or sharing of data
• Sale and sharing of data: the Company does not sell or share personal information with third parties for monetary or other valuable consideration
• Do Not Track: the Company does not currently respond to browser Do Not Track (DNT) signals
• Contact: roundie@kanopy-inc.com
• Supervisory authority: California Privacy Protection Agency (CPPA)

12.3 South Korean users (개인정보 보호법 / Personal Information Protection Act)

• Personal information processing policy: governed by the provisions of this Policy
• 개인정보 보호책임자 (Personal Information Protection Officer): Kazushige Shiba, Representative Director, KANOPY Inc.
• Contact: roundie@kanopy-inc.com
• Supervisory authority: 개인정보보호위원회 (Personal Information Protection Commission, PIPC) — https://www.pipc.go.kr/
• Additional disclosures for residents of South Korea: the items required under the PIPA (procedures and methods for destroying personal information, the right to refuse processing, remedies for infringement, security measures, etc.) are set out in the Korean version

13Where to File Complaints

Complaints, opinions, and inquiries regarding this Policy or the handling of personal information are accepted at the following contact point (the contact point under Article 40 of the APPI).

If the Company is unable to resolve your complaint, or if you are dissatisfied with our response, you may consult the Personal Information Protection Commission of Japan.

14Revisions to This Policy and Contact

14.1 Revisions to this Policy

The Company may revise this Policy in response to changes in laws and regulations, changes to the Service, or as otherwise necessary. In the case of material revisions, we will notify users before the effective date via the Service's app, the website, email, or other means.

14.2 Contact and personal information protection manager