Privacy Policy

Revised and effective October 29, 2026 (first published October 24, 2026)

The CrowOn operator [legal name to be added before public launch] ("we") handles information about users of CrowOn (the "Service") carefully and in accordance with Japan's Act on the Protection of Personal Information and other laws. This policy explains what we collect, why, who we share it with, how long we keep it and how you can control it.

1. Scope

This policy applies to everyone who uses the Service, including the websites, apps, shared link pages and related features.

When you use third-party services through the Service (maps, payments, etc.), their privacy policies also apply.

2. Information you give us

Account: email address, date of birth (and resulting age group), and password. Passwords are stored transformed with scrypt; we cannot see the original.

If you sign in with Google: we receive only your email address, whether it is verified, and the ID that identifies your Google account. We use them only to sign you in and recover your account, and we do not access your Google contacts, photos or any other data. We never use information from Google for ads or share it with third parties. You can unlink Google at any time in Settings → Password and login.

Name for identity checks: the real name you enter at the start of sign-up. It is not shown on your profile and is used only to match an ID document if an age check is needed.

Profile: name, username, photo, bio, links, interests.

Your Content: posts, short videos, NOW, Drops, comments, Letters, routes, community posts, answers to polls and questions, and photo, video and audio files.

Messages: DM text, photos, videos, audio, stickers, reactions and read times.

Connections: follows, friends, close friends, blocks, mutes, communities, and trip plan members and votes.

Settings: audience, notifications, location sharing, recommendations, appearance, etc.

Consent records: the version and time you agreed, whether you want email updates, and guardian consent for minors.

Two-step verification: the authenticator secret and backup codes (used codes are deleted).

Support and reports: feedback, report contents and appeals.

Age check requests: if use is restricted because an under-13 birthday was entered and you ask us to lift it, we receive a photo of an ID document (passport, residence certificate, the front of a My Number card, driver's license, student ID, etc.), your correct date of birth, a contact email and any note. Please do not send the side showing an Individual Number (My Number).

3. Information collected automatically

Usage: posts and videos viewed, watch time, completions and skips, likes, saves, shares, comments, features used and search terms.

Device and connection: device and browser type, OS, language, screen size, IP address, an identifier for signed-in devices, and error logs.

Notifications: if you allow push notifications, the delivery endpoint issued by your browser vendor.

Recommendation learning: for recommendations, we store on our servers which posts and videos you view, how long you watch, whether you finish or skip them, and your likes, saves, shares, comments and follows. We keep this for 90 days and use it only for recommendations (a model learned from everyone’s reactions, plus your own interests) and abuse prevention, and never give it to advertisers or other third parties. You can erase it anytime with “Reset recommendations”, and it is included in “Download your data”.

4. Location

Places on posts are shown to that post's audience.

Device location is used only with your permission, to show you on the map, find nearby places and posts, calculate meeting spots, check whether you can open a Letter, bump phones to add friends, and share your location with friends.

Sharing with friends happens only when you turn it on and choose who and for how long, and stops automatically. With Ghost mode on, nobody sees it.

Location used for bump matching is held only in server memory for a few seconds and is not stored.

Whether you can open a Letter is checked on your device; your location is not sent to our servers for this.

5. How we use information

To provide the Service (accounts, staying signed in, showing posts, delivering messages, syncing devices, data downloads).

To verify identity and protect accounts (two-step verification, suspicious login detection).

To show recommendations (Home, Shorts, Discover, GO). You can review and reset what was learned in Settings.

To detect and respond to violations, spam, fraud, impersonation and unauthorized access, and to keep people safe.

To apply age-appropriate protections.

To make sure children under 13 do not use the Service. ID documents from age check requests are used only to confirm that the name matches the one entered at the start of sign-up and that the person is 13 or older, and for no other purpose.

To process Membership sign-ups, payments and cancellations.

To respond to inquiries, reports and appeals.

To develop features, improve quality and investigate issues (analyzed in non-identifying form where possible).

To send important notices and, with your consent, updates about features and places.

To comply with the law.

6. What other users can see

Your name, username, profile photo, bio and verified badge are visible to others.

Your Content is shown to the audience you choose. Public posts and profiles may be visible outside the Service (link previews, search engines).

Online status, read receipts and typing indicators are shown only if turned on in Settings.

7. Where data is stored and when we access it

Accounts, profiles, settings, Your Content, messages and uploaded files are stored on servers we manage, with a copy on your device for fast display.

In the beta, until you choose "Save to server" in the Account Center, this information stays only in your browser and is not sent to our servers.

Messages are not currently end-to-end encrypted. We do not view message content except when required by law, necessary to protect life, body or property, or when reported to us (limited to the reported part and its context).

Call audio and video generally go directly between devices. Only connection setup information passes through our server; audio and video are not stored.

ID document images are stored on our servers and can be viewed only by our administrators. They are never shown to other users.

8. Sharing with others

We do not share your personal information without consent except as below, and we never sell it.

Service providers: we share what is necessary with providers for hosting, storage, payments, notifications and maps, under contract and supervision.

When required by law, when necessary to protect life, body or property and consent is hard to obtain, or to cooperate with lawful requests from authorities.

Business transfers such as mergers, with the same level of protection required.

9. Third-party services we use

Payments: Stripe, Inc. (USA). Card details go directly to Stripe and are not stored on our servers. We receive payment results, subscription status and email address.

Push notifications: your browser vendor's push service (Google, Apple, Mozilla, etc.). Content is encrypted.

Maps and places: OpenStreetMap, OpenFreeMap (maps), Esri (satellite imagery), Amazon Web Services (elevation), OSRM (routing), Nominatim (place search). The area you view, search terms and your IP address are sent to them.

Sample media: beta sample photos and videos load from Wikimedia Commons.

Analytics (only if configured): Google Analytics (Google LLC, USA) or Plausible Analytics (Plausible Insights OÜ, Estonia). We never send dates of birth, message text or precise location. Turn off "Help measure usage" in Settings to stop sending.

10. Transfers outside Japan

Some providers are in the USA, Estonia (EU) and other countries whose privacy laws may differ from Japan's.

We transfer data only after confirming appropriate measures as required by Japanese law. Information about each country's regime is available from Japan's Personal Information Protection Commission.

11. Retention

Account information and Your Content are kept until you delete them or your account.

Deleted posts disappear immediately and are removed from our servers.

ID document images are deleted from our servers as soon as the check is finished (whether the restriction is lifted or the age could not be confirmed). The request record (name, date of birth, email and result) is kept as long as necessary to prevent fraudulent requests using the same document.

When you delete your account, your profile, content, messages, uploaded files and device sign-ins are deleted from our servers immediately. Backup copies are usually erased within 90 days.

Expiring content such as NOW and Drops is kept briefly after it expires for aggregation and then deleted.

To prevent unauthorized access, we keep a record of failed sign-ins and suspicious requests (IP address, time, browser type and the address requested) for 30 days, then delete it automatically. These records never include email addresses or passwords.

Records of access to the Service (IP address, time, address requested, response, browser type and the signed-in account ID) are kept in tamper-evident form for 90 days, to investigate unauthorized access and to report to or answer requests from the police and other public authorities, then deleted automatically. A copy is also kept on a device managed by the operator. They never include the content of messages or posts, search terms, email addresses or passwords.

Records needed for enforcement or required by law (reports and actions taken, payment records) are kept as long as necessary.

12. Your choices and rights

You can change audience, private account, who can message you, location sharing, Ghost mode, read receipts, online status, recommendations, notifications and analytics in Settings at any time.

You can download all your data from the Account Center.

You may request disclosure, correction, addition, deletion, suspension of use, suspension of third-party provision, and records of third-party provision. We will respond after verifying your identity, generally within two weeks.

You can delete your account at any time from the Account Center.

You can revoke location, camera, microphone and notification permissions in your device or browser settings.

13. Users under 18

We do not knowingly collect information from children under 13 and will delete such accounts and data.

Accounts of users under 18 start with protective settings, and we do not use their profiles for advertising. See "Information for Minors and Guardians".

14. Security

We use HTTPS, password transformation, two-step verification, login attempt limits, per-device sign-in management and internal access controls.

If a data breach occurs, we will promptly report it to the Personal Information Protection Commission and affected users as required by law and take steps to prevent harm.

15. Statistics

We may create statistics that cannot identify individuals (e.g. rankings of popular places) and use or publish them.

16. Users in the EEA, UK and Switzerland

If you are in the European Economic Area, the United Kingdom or Switzerland, we are the controller of your personal data, and the GDPR (or UK GDPR) also applies.

Legal bases: we process your data to perform our contract with you (providing the Service, accounts, messages, sync, Membership); for our legitimate interests (security, preventing abuse and fraud, recommendations, improving the Service), balanced against your rights; with your consent (location, notifications, analytics, marketing email), which you can withdraw at any time; and to meet legal obligations.

Your rights: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests (including recommendations), and withdrawal of consent. You can exercise most of them directly in Settings and the Account Center, or by contacting us.

You may complain to the data protection authority where you live or work. We would appreciate the chance to address your concern first.

Transfers: we rely on adequacy decisions (Japan has an adequacy decision from the European Commission) and, where needed, Standard Contractual Clauses with our providers.

Recommendations are automated, but they do not produce legal or similarly significant effects on you.

EU/UK representative: [to be added before public launch if required].

17. Users in the United States

If you live in a U.S. state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia, Utah or Texas), you have the rights below. This section is our notice at collection.

Categories collected in the last 12 months: identifiers (email, username, IP address, device identifier); personal records (name, date of birth); commercial information (Membership status); internet activity (views, watch time, interactions, searches); approximate and, with permission, precise geolocation; audio, photo and video content you upload; and inferences used for recommendations. Sources, purposes and retention are described in Sections 2 to 11.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We have not done so in the last 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information (precise geolocation, ID documents for age checks, message contents) is used only to provide the features you ask for, for security and as the law allows, and never to infer characteristics about you.

Your rights: to know and access what we collect, to delete it, to correct it, to obtain a portable copy, and to opt out of sale, sharing and targeted advertising (which we do not do). We will not discriminate against you for using these rights.

How to make a request: use Settings and the Account Center, or contact us. We will verify your identity by confirming control of your account or email. An authorized agent may make a request on your behalf with your signed permission. If we deny your request, you may appeal by replying to our decision, and if the appeal is denied you may contact your state attorney general.

Global Privacy Control: we treat a GPC signal from your browser as a valid opt-out request. Because we do not sell or share data or use advertising cookies, it does not change how the Service works.

Children: the Service is not directed to children under 13, and we comply with the Children's Online Privacy Protection Act (COPPA). If we learn that we collected personal information from a child under 13, we delete it. If you believe a child under 13 has an account, tell us via Feedback or our contact point.

18. Changes

We may update this policy. For important changes we will notify you in the Service beforehand and may ask for consent again.

19. Contact and requests

Send questions and requests via "Report a bug / Suggest" in Settings, or to the contact below.

Person responsible for personal information: [to be added before public launch]. Contact: [to be added before public launch].