Privacy Policy

1. Introduction

ZAWA SYSTEM, the operator of MoshiMono ("the App"), respects your privacy. The App helps households manage emergency supplies (food, water, daily necessities, etc.) for disaster preparedness, and offers features such as expiry reminders, readiness score calculation, family-wide sharing of stock data, and notes and to-do lists. This policy explains how the App handles personal information.

2. Account Information

The App uses Firebase Authentication and requires sign-in with a Google account or an Apple account. Through this sign-in, the following information is recorded on the operator's servers:

• User identifier (Firebase UID)
• Display name
• Email address (including private relay addresses provided by Sign in with Apple)
• Sign-in provider type (Google / Apple)

The Operator does not directly obtain or retain passwords or other authentication credentials.

3. Information Handled by the App

The App collects and uses the following information to provide and improve the service:

• Stock item data: Name, category, quantity, unit, expiry date, storage place, and image (if attached by you) of stock items you register
• Consumption and restocking records: Type (consume / restock / discard), quantity, timestamp, and updated expiry date
• Storage places (locations): Name and ordering of storage places you create
• Household composition: Number of adults and children in your household, and target stockpile days (used to calculate the readiness score)
• Family group information: Family group identifier (householdId), display names, email addresses, roles (Owner / Guest), and join dates of the group's members
• Invitation information: Invitation tokens issued by the Owner, expiration dates, and usage status
• Notes and to-do lists: Content of notes and to-do items you create, and the display name of the author and editor
• Premium plan purchase status: Whether you have purchased the Premium plan, and your customer ID at RevenueCat
• Push notification token: FCM token used to send expiry reminders and similar notifications, and your device's language and time-zone settings
• Usage analytics (Firebase Analytics): Service-improvement data such as launch count, screen navigation, and feature usage. Includes pseudonymous identifiers assigned by Firebase (e.g., App Instance ID).
• Crash reports (Firebase Crashlytics): Technical information needed to diagnose crashes (device model, OS version, stack trace, etc.)
• Abuse-prevention information: Information used by Firebase App Check to verify request authenticity (including device and app integrity attestations)
• Advertising data (Free plan only): Identifiers used by Google AdMob to deliver advertisements (e.g., IDFA / AAID)
• Device information: OS version, language setting, screen size, etc.

4. How We Use Information

We use collected information to:

• Provide core App features such as registration and management of stock items and expiry tracking
• Manage consumption and restocking records (rolling stock)
• Calculate readiness scores and recommended quantities based on household composition
• Share stock data, notes, and to-do lists among family members
• Send expiry reminder notifications and other push notifications
• Manage the Premium plan and control access to Premium features
• Improve App quality, detect issues, and consider new features by analyzing usage
• Detect abusive use and operate the App safely
• Deliver and optimize advertising on the Free plan
• Respond to user inquiries

5. Joint Use of Personal Data in the Family-Sharing Feature

When you use the App's family-sharing feature, we jointly use personal data among members of the same family group under Article 27, Paragraph 5, Item 3 of Japan's Act on the Protection of Personal Information (APPI) as follows:

• Items of personal data jointly used: Display name, email address, role within the family group, join date, stock item data, consumption and restocking records, storage places, household composition, content of notes and to-do items, and names of their authors
• Scope of joint users: Owner and Guest members of the same family group (household)
• Purpose of joint use: Household-wide stock management, expiry management, sharing of restocking needs, and sharing of notes and to-do lists
• Controller: The Operator of the App (ZAWA SYSTEM) is responsible for managing the jointly used personal data
• Method of acquisition: Each member enters data directly into the App, or provides data through sign-in with a Google / Apple account

You may stop joint use by not using the family-sharing feature, or by removing a Guest via the "Family members" screen in Settings. If the Owner removes a Guest from the family group, the Guest can no longer access the data that had been jointly used.

6. Push Notifications

The App may send push notifications via Firebase Cloud Messaging (FCM) to inform you of expiry reminders, invitations from family members, and updates to notes and to-do lists.

• Push notifications require the device's notification permission and an FCM token. The token is stored on the operator's servers and used only to send notifications.
• Local notifications for expiry reminders are handled on the device (via flutter_local_notifications) and are not transmitted externally by the App.
• To stop receiving notifications, disable notifications for the App in your device's OS settings.

7. Third-Party Services

The App uses the following third-party services:

• Firebase (Google LLC): Authentication, Cloud Firestore, Cloud Functions, Cloud Messaging (FCM), Hosting, Analytics, Crashlytics, App Check
  Firebase Privacy Information
• RevenueCat (RevenueCat, Inc.): Management of Premium plan purchase status. Linked to billing data via Firebase UID.
  RevenueCat Privacy Policy
• Google AdMob (Google LLC): Advertising on the Free plan
  Google Advertising Policies
• Google Sign-In / Sign in with Apple: Authentication providers
• Apple App Store / Google Play Store: App distribution and in-app purchase billing
• Rakuten Affiliate (Rakuten Group, Inc.): Performance-based advertising via external links from the App
  Rakuten Privacy Policy
• Amazon Associates (Amazon.com, Inc. / Amazon Japan G.K.): Performance-based advertising via external links from the App
  Amazon Privacy Notice

Please review each service's privacy policy.

8. Cross-Border Data Transfers

Through the third-party services listed in Section 7, user data may be provided to the following third parties located outside Japan:

• Google LLC (United States): Firebase services, Google AdMob, Google Sign-In
• RevenueCat, Inc. (United States): Premium plan purchase status
• Apple Inc. (United States): Sign in with Apple, App Store billing

For information on the United States personal data protection regime, please refer to the materials published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/). Each recipient handles personal data at a level equivalent to the requirements of Japan's Act on the Protection of Personal Information (APPI), based on its respective privacy policy and applicable contractual safeguards such as standard contractual clauses (SCC).

9. Security Measures

The Operator takes the following measures to prevent leakage, loss, or damage of personal information and to maintain appropriate security:

• Basic policy: This Privacy Policy publicly discloses the Operator's approach to handling personal information
• Organizational measures: A responsible person for personal information handling is designated, and a dedicated inquiry channel is provided
• Personnel measures: Personnel who handle personal information are required to comply with this Policy
• Technical measures: Access control scoped to the user's family group via Firestore Security Rules, identity verification via Firebase Authentication, Owner-role verification in Cloud Functions, request authenticity verification via Firebase App Check, one-time invitation tokens with a 24-hour validity period, TLS encryption for data in transit, and least-privilege access controls on Firebase
• Physical measures: User data is stored in data centers managed by Firebase (Google Cloud)
• Awareness of foreign environments: As stated in Section 8, where personal data is entrusted to a foreign third party (in the United States), the Operator confirms the personal data protection regime of the relevant country and the contractual safeguards in place

10. Data Storage and Deletion

• Account information, stock item data, consumption and restocking records, storage places, household composition, family group information, and notes and to-do lists are retained on the operator's servers (Firebase) for as long as your account exists.
• A local cache of stock data is also stored on the device (using sqflite). When you uninstall the App, on-device data is deleted.
• When the Owner uses the "Delete all data" feature in the Settings screen, the Cloud Function (deleteUserData) promptly deletes all data of the family group (stock items, consumption and restocking records, storage places, notes and to-do lists, invitations, member information, etc.) and the account information on the operator's servers, and you are automatically signed out.
• A Guest may leave the family group (by resigning as Guest) at any time. After leaving, the Guest loses access to data that had been jointly used.
• Records related to transactions may be retained for the period required by applicable laws (e.g., the Japanese Electronic Books Maintenance Act).

11. Advertising and App Tracking Transparency (iOS)

The App displays advertisements provided by Google AdMob to Free plan users. On iOS, if the App accesses the advertising identifier (IDFA), an App Tracking Transparency (ATT) prompt is shown the first time you launch the App. You may decline; all features remain fully usable, but ads may be less personalized. No advertisements are shown when you purchase the Premium plan.

On Android, you can reset your advertising ID or opt out from the device's settings screen.

12. Affiliate Links

The App may display links from performance-based advertising programs, such as Rakuten Affiliate and Amazon Associates, to help you restock supplies.

• Tapping an affiliate link takes you to an external partner website (such as Rakuten Ichiba or Amazon.co.jp) outside the App. On that site, the partner's own privacy policy and terms of service apply.
• On the partner's site, browsing and purchase information may be collected by the partner via cookies. Please review each partner's privacy policy for details.
• The Operator does not receive individual purchase information resulting from clicks on affiliate links. Only aggregate data such as click counts is visible, within the range provided by the partner.
• If you purchase a product through such a link, the Operator may receive a referral fee from the partner.

13. Children's Privacy

The App is not primarily intended for children under 13, and we do not knowingly collect personal information from anyone under 13. Minors aged 13 or older but under 18 should use the App only with the consent of their parent or legal guardian. If we learn that a user is under 13, we will promptly delete that user's personal information.

Note that while the App allows you to enter the number of children as part of your household composition, this is a numeric value used solely to calculate household-wide supply quantities and does not involve collection of any identifying information about a child.

14. Cookies

The App (the mobile application) does not use cookies. Web sites associated with the App (including this page and the invitation page) likewise do not use cookies in principle and do not set any cookies for analytics or advertising tracking. Cookies that are operationally required by infrastructure services such as Firebase Hosting may occasionally be issued. Partner cookies are used on external sites reached through affiliate links.

15. Your Rights (Disclosure, Correction, Suspension of Use)

Under Japan's Act on the Protection of Personal Information (APPI), you may request notification of the purpose of use, disclosure, correction, addition or deletion of content, suspension of use or erasure, and suspension of third-party provision of retained personal data held by the Operator.

Please submit your request to the contact email below. The Operator will verify that the requester is the data subject or their authorized representative by reasonable means, and will respond promptly in accordance with the APPI and other applicable laws.

Major data such as stock items, consumption and restocking records, notes and to-do lists, and family members can be reviewed at any time within the App. As the Owner, you can also delete data on the operator's servers yourself using the "Delete all data" feature in the Settings screen. For information collected by Firebase Analytics, AdMob, and similar services, you may need to use the opt-out mechanisms provided by the respective service providers (e.g., Google account ad settings, iOS App Tracking Transparency, Android advertising ID reset).

16. Changes to This Policy

This policy may be updated. Material changes will be announced through in-app notification or by updating this page. Changes take effect upon posting on this page.

17. Contact and Complaints

For privacy inquiries, requests for disclosure or the like, and complaints, please contact us at:

Operator: ZAWA SYSTEM
Email: info@zawasystem.com

If you are not satisfied with the Operator's response regarding the handling of your personal information, you may also consult Japan's Personal Information Protection Commission (https://www.ppc.go.jp/en/).