The short version
- We collect the minimum needed to run an account and keep your saved spots in sync.
- We do not sell or share your personal information, and we do not use advertising SDKs or third-party behavioural trackers.
- Location is used on your device to sort the map by what is near you. We do not keep a history of where you have been.
- You can have your account and all associated data deleted. Email us and we will do it within 30 days.
The rest of this page is the detailed version. It applies to the Secret Spots Japan mobile apps and to https://secretspots.jp.
1. Who we are
Secret Spots Japan is an independent project by Nekologic, a software studio in Kyoto, Japan ("we", "us"). For the purposes of the EU and UK General Data Protection Regulation we are the data controller for the personal data described here.
Questions, requests and complaints: liam@neko-logic.com.
2. What we collect
Information you give us
- Account details. Your email address, and an authentication credential (a password hash, or a token from Apple or Google if you use their sign-in). We never see your password in readable form.
- Taste preferences. The categories you pick during onboarding, for example onsen, craft workshops or viewpoints.
- Saved spots and lists. The places you bookmark, so they follow you between devices.
- Correspondence. Anything you send us by email or through in-app support.
Information collected automatically
- Entitlement status. Whether your account may see the full collection, together with the anonymous identifier our entitlements provider uses to track it. The app is currently free and no billing is configured, so there is no payment data of any kind. If paid plans are introduced, Apple and Google would handle payment entirely, and we would never receive your card number.
- Device and diagnostic data. App version, operating system version, device model, language, and crash or error reports. Used to fix bugs, not to profile you.
- Approximate location derived from your IP address. An unavoidable by-product of making any network request; not stored beyond short-lived server logs.
Information we deliberately do not collect
- Contacts, photos, calendar or health data.
- Advertising identifiers (IDFA / GAID). The app contains no ad SDK.
- A stored history of your movements.
3. Why we collect it, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and secure your account | Email, credential | Performance of a contract |
| Give your account access to the collection | Entitlement status | Performance of a contract |
| Sync saved spots across devices | Saved spots | Performance of a contract |
| Order the map by what you'd travel for | Taste preferences | Performance of a contract |
| Show what's near you | Device location | Consent (the OS permission prompt) |
| Fix crashes and keep the service running | Diagnostics | Legitimate interests |
| Prevent fraud and abuse | Account, entitlement, logs | Legitimate interests |
| Meet tax and accounting obligations | Transaction records | Legal obligation |
Where we rely on consent, you can withdraw it at any time. For location, turn the permission off in your device settings. The app keeps working; it just stops sorting by proximity.
4. Location data, specifically
The app asks for location permission only when you use a feature that needs it, such as "spots near me". When granted, your coordinates are used on your device to sort and filter the map.
We do not transmit your position to our servers for storage, we do not build a movement history, and we do not run background location tracking. Denying the permission leaves every other part of the app fully usable.
5. What we never do
- We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under the California Consumer Privacy Act. We have never done so.
- We do not embed advertising or data-broker SDKs.
- We do not use your data to train third-party advertising models.
- We do not accept payment from venues in exchange for placement in the app, so there is no commercial incentive to profile what you look at.
6. Service providers
We use a small number of processors, each bound by contract to handle data only on our instructions:
| Provider | Role | Data reaching them |
|---|---|---|
| Supabase | Database, authentication, file storage | Account, preferences, saved spots |
| RevenueCat | Entitlement state (which accounts may see the collection) | Anonymous subscriber ID. No payment data, as billing is not set up |
| Apple / Google | App distribution, and payment processing if paid plans are added | Download and device data. No billing data today |
| MapTiler | Map tiles | Tile requests and the IP address making them |
We may also disclose data where we are legally required to, or to establish or defend legal claims. If the business is ever sold or merged, personal data may transfer with it. You will be told before that happens and before any new policy applies to you.
7. International transfers
We are based in Japan and our providers operate infrastructure in several regions, so your data may be processed outside the country you live in, including in the United States and the European Union. Where data leaves the UK or the EEA we rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision (Japan holds one), to keep the protection travelling with it.
8. How long we keep it
- Account, preferences and saved spots. Kept for as long as your account exists, then deleted within 30 days of your deletion request.
- Diagnostic and crash data. Up to 90 days.
- Server access logs. Up to 30 days.
- Transaction and tax records. As long as tax law in Japan requires, typically seven years. These are retained even after account deletion because we are legally obliged to keep them.
9. Your rights
Depending on where you live, you can ask us to:
- Access the personal data we hold about you.
- Correct anything inaccurate.
- Delete your data ("right to erasure").
- Export it in a portable, machine-readable format.
- Restrict or object to certain processing.
- Withdraw consent where consent is the basis we rely on.
Email liam@neko-logic.com and we'll respond within 30 days. We will not charge you, and we will not degrade the service because you exercised a right.
If you're in the EEA or UK you also have the right to complain to your local data protection authority. In Japan, to the Personal Information Protection Commission.
10. Deleting your account
To delete your account, email liam@neko-logic.com from the address the account uses. We will remove your account record, preferences and saved spots within 30 days, apart from the transaction records tax law requires us to keep, and confirm when it is done.
There is nothing to cancel alongside it. The app is free and no billing is set up, so deleting your account does not leave a payment running. If paid plans are introduced later, billing would be controlled by Apple or Google and you would need to cancel it there separately.
11. Children
Secret Spots Japan is not directed at children. We do not knowingly collect personal data from anyone under 16 (or the minimum age of digital consent where you live, if that is higher). If you believe a child has given us their data, contact us and we will delete it.
12. Security
Traffic is encrypted in transit with TLS and data is encrypted at rest. Database access is constrained by row-level security policies, so the app can only ever read the rows belonging to the signed-in account. Internal access is limited to the people who need it.
No system is perfect. If we ever suffer a breach affecting your personal data, we will notify you and the relevant regulator as the law requires.
13. Changes to this policy
We'll update this page when our practices change and revise the "last updated" date. If a change materially affects your rights, we'll tell you in the app or by email before it takes effect.
14. Contact
Nekologic
Kyoto, Japan
liam@neko-logic.com