Privacy Policy

Last updated: 2026-10-25

1. Our approach

The operator of tyyni ("we", "us") respects the privacy of users of the service "tyyni" (the "Service"), and keeps collection to the minimum necessary.

2. What we collect

The information we collect and hold is as follows.

  1. Account information: the display name, the ID, the profile, information for signing in, records of consent and the like.
  2. Content the user creates: pages, letters, theme names and the like. Pages may contain sensitive material, which is protected as set out in section 7.
  3. Relationships between users: follows, blocks, records of disclosure, records of reports and measures, and the like.
  4. Settings and records of use: settings, how features are used, records of notices and the like.
  5. Information generated automatically: the results of review and classification, text produced by the AI features, and the like.
  6. Device information: the device token used for push notifications, diagnostics about how the app runs, and the like.
  7. Purchase records: the item bought, the period, the amount and the like.
  8. The content of enquiries: where a user emails us, the email address and the body of the email.

3. What we do not store

We do not store the following.

4. What we use information for

We use the information we collect only for the following purposes.

  1. Providing and maintaining the Service (authenticating accounts, storing and displaying content, and making disclosure and the sending and receiving of letters possible).
  2. Reviewing (moderating) and translating content.
  3. Classifying pages by their content (only to the extent needed to work out the depth of a disclosure and to decide whether something may be shown).
  4. Handling reports and enquiries, and keeping the Service safe.
  5. Sending push notifications.
  6. Only where the user starts them, providing the features that help with writing.
  7. Improving the Service and fixing problems.
  8. Providing paid plans.

We do not use this information for advertising, and we do not sell it to any third party.

5. Providing information to external services

  1. To the extent needed to provide the Service, we entrust the handling of information to the following businesses. All of them are businesses in the United States, and we provide personal data to them on the basis of the user's consent set out in section 7.8.
    • Anthropic, PBC: review, classification and translation by AI, and the features that help with writing.
    • Cloudflare, Inc.: servers and storing data, and part of the AI processing.
    • Apple Inc.: delivering push notifications, and payment on the App Store.
    • Google LLC: checking that links written in quotations are safe.
  2. What we send is limited to what each process needs. We also choose contract terms under which the information we send is not used to train the business's AI.
  3. Data may be stored and processed outside Japan.
  4. Except where permitted by the Act on the Protection of Personal Information or other laws, we do not provide personal data to third parties without the person's consent.

6. Protection of private pages

  1. Among other users, a private page is shown only to the people the user who wrote it has chosen, page by page.
  2. We never include the text of private pages in logs or in records kept for analysis.

7. Special care-required personal information, provision to businesses in the United States, and the helpline notice

  1. A page may contain material about physical or mental health, about difficulties, or otherwise sensitive material. We handle such material only to the extent needed to provide the Service, and put it to no use beyond this Policy.
  2. What is written in a page may amount to special care-required personal information (要配慮個人情報) under Japan's Act on the Protection of Personal Information — physical or mental health, beliefs, social standing, the fact of having been the victim of a crime, and the like. In addition, through the classification described in Article 4(3), we record which kinds of material a page touches on, and how strongly. Those kinds include mental health, who a person is (sexual orientation, faith, origin), experiences of harm, and self-harm. We obtain and record this only with the user's consent, given when the user registers an account. If the user does not consent, no account is registered.
  3. The kinds and strengths in the preceding paragraph are used only to work out the depth of a disclosure and to decide whether something may be shown. The kinds themselves are never displayed to other users. They are stored against the page and are deleted with the page, or with the account (section 11).
  4. A user is free at any time to write nothing that falls into these categories, or to write it and keep it closed.
  5. On the basis of the content of a page, or of a report expressing concern for the person who wrote something, we may show the user alone a notice pointing to an external public helpline. We do not let other users know about the notice, or that it was shown.
  6. The notice does not provide professional or medical advice or support.
  7. So that the notice is not repeated too often, we keep a record of when it was shown. We use this record only to show the notice and to handle reports, and delete it when the account is deleted.
  8. Provision to businesses in the United States: to provide the Service, we provide personal data, including the text of pages and letters, to the businesses in the United States set out in section 5. What is provided, and for what purpose, is as set out in section 5. We obtain the user's consent to this provision when the user registers an account, together with the consent in paragraph 2. If the user does not consent, no account is registered. The information we would like the user to know about this provision is as follows.
    1. The country of the recipients: the United States. The servers that store data are in the Asia-Pacific region, and we cannot identify the country.
    2. The system for protecting personal information in the United States: the United States has no comprehensive federal law on the protection of personal information. Instead there are laws for particular sectors (the Electronic Communications Privacy Act, the Gramm-Leach-Bliley Act for financial institutions, HIPAA for health information and others) and state laws (such as the California Consumer Privacy Act). The United States takes part in the APEC Cross-Border Privacy Rules (CBPR) System. The survey by Japan's Personal Information Protection Commission (as of October 2021) does not list any system requiring personal information to be stored within the country, or requiring businesses to cooperate with government information-gathering, that may seriously affect the rights and interests of individuals. However, the United States does have systems under which the government may require businesses to provide information for national security or criminal investigation (such as Section 702 of the Foreign Intelligence Surveillance Act).
    3. The measures each business takes:
      • Anthropic, PBC (review, classification and translation by AI, and the features that help with writing): handles the information only within our instructions, and does not use it to train models. Information sent is deleted within 30 days. However, inputs and outputs that the company's safety systems flag as possibly breaching its usage policy are kept for up to 2 years, and the results of safety classification for up to 7 years. It notifies us within 48 hours of becoming aware of a leak or similar incident.
      • Cloudflare, Inc. (servers and storing data, and part of the AI processing): handles the information only within our instructions. It notifies us without undue delay of becoming aware of a leak or similar incident.
      • Apple Inc. (delivering push notifications, and payment for paid plans on the App Store): we give it only the information needed to deliver notifications and to take payment. We do not give it the text of any page or letter.
      • Google LLC (checking that links in quotations are safe): we give it only the URL of the link, and no information showing who wrote it.

8. Reading in the course of handling a report

  1. To deal with a report from a user, we may read the private page or letter that is the subject of the report, only to the extent needed to review it.
  2. Each such reading is recorded.

9. Disclosure required by Japanese law

Where there is a legitimate request based on Japanese law (including a warrant or other legal process), we may disclose information to the extent necessary.

10. Security measures

  1. We take the measures necessary and appropriate to keep personal data secure, including preventing leaks, loss and damage.
  2. If you ask at the contact details in section 15, we will tell you without delay what those measures are, to the extent that doing so does not compromise security.

11. Deleting data, and how long it is kept

  1. A user can delete their own account and data at any time through the Service.
  2. When an account is deleted, the related data is deleted from the production systems immediately. However, information the law requires us to keep, records needed to prevent abuse and to deal with reports, and emails sent as enquiries, may remain (if you would like those emails erased, please tell us).
  3. Data remaining in backups kept for disaster recovery is erased within 30 days of deletion.
  4. For each kind of information, we set a retention period needed for its purpose, and erase information once that period has passed.

12. Exporting data

A user can export, all together, the pages they have written and the like, through the Service.

13. Children's privacy

The Service is for people aged 18 or over — or older, where the age of majority in their region is above 18 — and we do not knowingly collect information from minors.

14. Changes to this Policy

We may change this Policy as necessary. Where a change is significant, we will give notice within the Service or by another appropriate means, and where the law requires the person's consent to a change, we will ask for it again.

15. Contact, and requests for disclosure and the like

  1. For enquiries or complaints about this Policy or about how personal information is handled, please use the contact details on the contact page.
  2. A user may ask us, in respect of the personal data about them that we hold, to notify them of the purposes of use, to disclose it (including the records of provision to third parties), to correct, add to or delete it, to stop using or erase it, and to stop providing it to third parties. Please tell us what you are asking for at the contact details in paragraph 1. Once we have confirmed that the request comes from the person themselves, we will deal with it without delay, in accordance with the law. We charge no fee.
  3. Much of the data a user has created can be checked, corrected, deleted and exported through the Service itself, without making the request in paragraph 2 (sections 11 and 12).
  4. Our name and address are disclosed without delay upon request. Please write to the contact details in paragraph 1 and say that you would like them disclosed.

16. Language

This Policy is provided in Japanese, English and Traditional Chinese. The English and Traditional Chinese texts are translations provided for convenience. Where they differ, the Japanese text prevails.

In force from: November 1, 2026