Privacy Policy

About this translation. This page is an English translation of maru's Japanese Privacy Policy, provided for reference. The Japanese Privacy Policy is the governing document; in the event of any discrepancy between the two, the Japanese version controls. The Japanese source is also still in draft form pending final legal review, so this translation may change without notice as that review concludes.

maru Privacy Policy v1 (Draft)

Effective Date: 2026-12-10

1. Business Operator Information

---

2. Personal Information We Collect

2.0 User Roles

The personal information we handle, and our purposes for handling it, differ by user role. As of this writing (Phase 0), only the "Individual User" and "Pre-registered User" roles are active. We describe our intended handling of roles planned for future phases below as well.

Important: The "Family Viewer" and "HCP" roles are not offered as of Phase 0, and no data is collected or processed for them. If and when these roles are introduced, we will revise this Policy in accordance with §13 and obtain advance consent from the affected users.

2.1 Information We Collect From Users

a. Always collected (necessary to provide the service)

• Email address
• Display name (nicknames permitted)
• Password (stored hashed)
• Date of birth (for age verification)
• Sex

b. Optionally collected (to enrich your profile)

• Height, weight, body fat percentage
• Health goals (free text)
• General area of residence (city/town level)

c. Sensitive personal information (only after explicit consent)

• Medical history (optional)
• Current medications
• Allergy information
• Glucose values and spike history from CGM integration
• Meal photos (analyzed for nutritional content)
• Heart rate, sleep, blood glucose, and other health data from Apple Health (when connected via HealthKit)
• Health-related consultation history within AI chat

2.2 Information Collected Automatically

• Device information (OS version, app version, device model, language, time zone)
• Login history and app usage logs
• Crash and error information
• IP address (anonymized)
• Cookies and similar technologies (to maintain sessions on our web properties)

2.3 OS Permissions and Their Purposes

Our app uses the following iOS/Android permissions. Each is requested only when you enable the related feature within the app, and you may withdraw any permission at any time from your OS settings.

Important: We request only the minimum OS permissions necessary to provide a given feature, and we do not request permissions unrelated to a feature you use. While you have connected Apple Health (HealthKit) on iPhone, we read Health data while the app is not open only to the extent described in §2.4. Our disclosures in Apple's App Privacy Label and Google Play's Data Safety section are kept consistent with this table.

2.4 Reading Data While the App Is Not Open (Only When Connected to Apple Health on iPhone)

Only while you have connected Apple Health (HealthKit) on iPhone, the app also reads Health data and sends it to our servers while the app is not open, within the scope below. iOS decides when to run the app, so it does not necessarily run at a fixed time or interval. We do not do this on Android.

The blood glucose read is switched on by us, one user at a time, in sequence. For that reason, it may not be running yet for some users. It also does not run if we cannot confirm your consent to the handling of health data, or if you have chosen a blood glucose source other than Apple Health (such as a Libre integration).

Read-attempt log: To check that the blood glucose read is working correctly, each time it makes an attempt, we send the following record to our servers. It does not contain the blood glucose values themselves. However, because it contains information close to "when you were measuring your blood glucose," we handle it as information about your health.

• A number for each attempt (generated at random)
• What triggered it (a notification from Apple Health / the periodic read / the app being opened / a retry)
• The start and end of the period that was read, and the number of items read
• The result (sent / no new values / could not read because the iPhone was locked / the read failed / could not confirm the sign-in state / timed out / initial setup not yet done)
• The time the attempt started and ended (by the iPhone's clock), and the time we received it

Each day, we automatically delete these records once more than 30 days have passed since we received them (§9).

What is stored on your iPhone: For the blood glucose read, we store the following on this iPhone. All of it can be read and written after the iPhone is first unlocked, and none of it is carried over to another device.

• Position information showing how far reading has progressed (issued by Apple Health; it does not contain blood glucose values), the identifier of the user for whom reading was started, and the date and time reading began
• A marker for when reading was not possible (user identifier, time, and reason). It is used to retry, for example the next time the app is opened
• Read-attempt logs that could not be sent, for example because there was no signal (up to 12; those older than 7 days are discarded)
• A marker showing that the read has been stopped (only the reason and time; it contains no information that identifies you). So that a stopped read does not start again by itself, it remains on the iPhone even after logout or account deletion

How to stop it:

We can also stop the blood glucose read for individual users. When we stop it, it stops the next time the app runs. If we cannot confirm our own setting, we also err on the side of stopping it.

---

3. Purposes of Use

On the "basis under the APPI" column: Unlike the GDPR, Japan's Act on the Protection of Personal Information (APPI) does not enumerate a list of "legal bases" such as legitimate interest. Instead, the general principle is that we specify and publish our purposes of use in advance (Arts. 17, 21) and handle data within that scope; separate consent is required for collecting sensitive personal information, providing it to third parties, or transferring it abroad. This table shows where each purpose sits within that framework.

We use sensitive personal information only for "providing the service," "customer support," and "report quality assurance" among the purposes above; if we use it for research and development, we obtain separate consent.

On "report quality assurance": because the report itself is our core deliverable, checking it and delivering it are inseparable. Quality assurance includes both (1) pre-delivery review (confirming, before a report reaches you, that the figures match the underlying aggregates and that the wording does not touch on anything prohibited), and (2) post-delivery quality improvement (rereading delivered reports to improve how they are generated). For quality assurance including (2), our default practice is that staff do not review content in a form linked to your name or nickname (our default operating practice is to review only figures and structure, with identifying names withheld). Review linked to your name occurs only with your explicit consent, or where a safety concern arises, and in either case we keep a record of the review.

Behavioral analytics for "service improvement" (data sent to PostHog) is carried out on the basis of the publication of this Policy. If you use a version of our mobile app that includes optional settings (to share "product usage" or "AI operational information"), your choice in those settings governs. Versions without those optional settings, and our web properties (nagaiki.ai), do not show this settings screen (see §6.1).

---

4. Provision to Third Parties

As a general rule, we do not provide your information to third parties without your consent.

Exceptions:

• Where required by law (e.g., a request from an investigative authority)
• Where necessary to protect a person's life, body, or property (for example, where you wish us to share information with your physician or an emergency medical provider in an emergency)
• Where necessary for public health or child welfare
• Cooperation with a national or local government agency carrying out a function prescribed by law

---

5. Outsourcing

To the extent necessary to provide the service, we outsource part of our operations to overseas providers. We provide the necessary and appropriate supervision of these providers required under Article 25 of the APPI.

Our principal outsourcing providers (category and location):

For PostHog, we have selected the EU region, and data is stored in a data center in Germany (Frankfurt). However, because the contracting entity is the US company PostHog, Inc. (San Francisco), the transfer-destination country under Article 28 of the APPI is the United States (see §6.1).

Our full list of subprocessors is disclosed separately from this Policy, on a page kept continuously up to date. If this list changes, we will notify you within 30 days after the change, through an in-app display and a posting on the public page above. We do not promise to send individual messages to your registered email address.

Public page: https://nagaiki.ai/subprocessors (currently available in Japanese)

Privacy policies of our principal providers:

• Anthropic: https://www.anthropic.com/legal/privacy
• OpenAI: https://openai.com/policies/privacy-policy
• Google (Vertex AI): https://cloud.google.com/terms/cloud-privacy-notice
• TypeSafe: https://typesafe.ai/legal/privacy-policy
• Supabase: https://supabase.com/privacy
• Stripe: https://stripe.com/privacy
• PostHog: https://posthog.com/privacy
• Sentry: https://sentry.io/privacy/
• Vercel: https://vercel.com/legal/privacy-policy
• Resend: https://resend.com/legal/privacy-policy

---

6. Provision to Third Parties Located Abroad

We transfer personal information to the outsourcing providers listed in §5. In every case, the transfer-destination country is the United States.

How we determine the transfer-destination country: whether a recipient qualifies as a "third party located abroad" under Article 28 of the APPI is determined not by where data is physically stored, but by the country where the recipient provider is located. Accordingly, even where we have selected a provider's EU region for data storage, the transfer-destination country remains the United States if that provider is a US legal entity.

The US personal-data-protection framework: the United States has no single comprehensive federal law governing personal information; instead, protection is governed by a patchwork of sector-specific and state laws (e.g., HIPAA, GLBA, CCPA, CPRA). The United States has not been recognized by Japan's Personal Information Protection Commission (PPC) as affording a standard of protection equivalent to Japan's.

Measures we take (our basis under Article 28 of the APPI):

• As a general rule: in accordance with §7, we obtain your consent to providing information to third parties located abroad (Art. 28(1)). When obtaining that consent, we provide you, through this Policy, with information about the destination country's name, that country's personal-data-protection system, and the measures taken by the recipient (APPI Enforcement Rules, Art. 17).
• PostHog (behavioral analytics): the transfer-destination country is the United States (even where we have selected that provider's EU region, the country is determined by the provider's location, so it remains the United States). We cannot rely on any exemption based on the EU's adequacy determination. As described under "As a general rule" above, this transfer is likewise based on your consent under §7 and the information disclosure required by Enforcement Rules Art. 17. We do not currently rely on the "compliant-system" basis defined in Article 16(1) of the APPI Enforcement Rules for this transfer. If we come to rely on that basis in the future, we will revise this Policy to say so explicitly.
• Data including sensitive personal information: for every outsourcing provider, we additionally obtain your explicit consent under §7.

Each outsourcing provider works to protect personal information through its own privacy policy and through appropriate technical and organizational measures (encryption, access controls, audits).

Full details of our subprocessor list, and links to each provider's privacy policy, are disclosed on the public page referenced above.

6.1 About Behavioral Analytics (PostHog)

For accuracy of disclosure, we separately set out the following details regarding PostHog, which we use for behavioral analytics.

About the identifiers we send (they are not "anonymous"):

• Mobile app: we send a persistent pseudonymous analytics ID that we issue (not directly tied to your name or contact information, and consistent across your use of the app) together with a session ID. We maintain an internal mapping between this pseudonymous ID and the user it belongs to. Accordingly, this pseudonymous ID qualifies as "personal information" under the APPI, and is neither anonymized information nor a third-party provision of pseudonymously processed information. We delete this mapping once the basis for behavioral analytics ends (for example, if you turn off the relevant optional setting in a version that offers one, if measurement under this Policy ends, or if your account is deleted).
• Web properties (nagaiki.ai): for behavioral analytics after login, we send our own account ID (your Supabase user ID) directly as the identifier. Because this corresponds directly to your account in our database, it is likewise personal information.
• In neither channel do we send your name, email address, photos, meal content, health figures, or chat text.

About training use of data sent to AI providers (Anthropic / OpenAI / Google / TypeSafe, etc.): we have opted out, through each provider's API settings, of allowing personal information we send for AI response generation and meal-photo analysis (such as chat history and meal photos) to be used to train that provider's own models. The APIs we use are configured, by default, not to use submitted data to train the provider's own models, and we maintain that setting explicitly. For Google (the Gemini API via Vertex AI), we rely on Google Cloud's service-specific terms, which provide that customer data is not used to train Google's foundation models. For TypeSafe (intent classification of free-text meal entries), we rely on TypeSafe's publicly stated privacy policy, which provides that prompts and other inputs are not used to train or fine-tune AI/ML models. If a provider's settings change in a way that alters this protection, we will revise this Policy and notify you in advance in accordance with §13.

By using the service, you are deemed to have consented to these transfers to third parties located abroad, in accordance with §7 ("Obtaining Consent") below.

---

7. Obtaining Consent

7.1 General Personal Information

We obtain your consent to this Policy when you register your account.

7.2 Sensitive Personal Information

We collect health data (CGM readings, heart rate, sleep, medical history, medications, etc.) only after obtaining your voluntary consent through an explicit in-app consent UI (a checkbox plus a "I agree" button). We record consent logs on our server.

7.3 Cross-Border Transfers

We treat your consent to this Policy as covering the transfers to third parties located abroad described in §6, and we additionally obtain explicit consent through the app's interface.

7.4 Withdrawing Consent

You may withdraw your consent at any time, through any of the following: (a) the "Settings → Privacy & Consent" screen in the app, (b) your OS settings (e.g., withdrawing HealthKit permissions), or (c) written notice to hello@zanmaido.com.

Withdrawing consent may make some features of the service unavailable. The effect of withdrawing each type of consent is as follows:

Important: withdrawing consent may affect part or all of the service we can provide to you. Before withdrawing, we recommend reviewing the "Settings → Privacy & Consent → Simulate effect of withdrawal" screen (planned for Phase 1) to see the effect in advance.

---

8. Security Measures

8.1 Organizational Measures

• Appointment of a Personal Information Protection Manager
• Established internal handling rules
• Supervision of outsourcing providers

8.2 Personnel Measures

• Training for staff (including contracted personnel)
• Confidentiality agreements

8.3 Physical Measures

• Restricted access to data centers and servers (per our providers' standards)

8.4 Technical Measures

• Encryption in transit (TLS 1.2 or higher)
• Encryption at rest (AES-256 equivalent)
• Row-level access control via Row Level Security (RLS)
• Log auditing
• Minimization of unnecessary permissions

---

9. Retention Period

---

10. Requests for Disclosure, Correction, Suspension of Use, and Deletion

You may make any of the following requests:

• Disclosure of the personal data we hold about you
• Correction, addition, or deletion
• Suspension of use or erasure
• Suspension of provision to third parties
• Notice of the procedure for making these requests

How to request: by email to hello@zanmaido.com, or via a dedicated form (planned). We may ask you to provide identifying information to verify your identity.

Response timeline: we aim to respond without undue delay after receiving your request (generally within 14 days, and no later than 30 days, in line with the "without delay" requirement of APPI Art. 33 and its guidelines). We send an initial "request received" reply within 7 days of receipt.

---

11. Cookies and Similar Technologies

Our web properties (nagaiki.ai) use cookies and similar technologies to maintain your login session and for site analytics. You may disable these through your browser settings.

On the pre-registration landing page (nagaiki.ai/ja/lp/prereg), we use a cookie named maru_lpv. Its purposes are to show the same visitor the same version of the page (so that the version shown stays consistent), and, when we record page views, to count repeat views by the same visitor on the same day as a single view. The cookie contains only a marker for the viewing session, a marker for the page version, and a marker for the date; it does not contain IP addresses, email addresses, or device identifiers. It is retained for 30 days from the time it was last updated. It is used only by us and is not shared with any third party.

11.1 Advertising measurement on the pre-registration page (Meta Pixel)

Added: 2026-11-07. This section applies only to the pre-registration page (nagaiki.ai/ja/lp/prereg).

On this page, we use the Meta Pixel (Meta Platforms, Inc., United States) to measure the effectiveness of our ads on Meta.

• Recipient: Meta Platforms, Inc. (United States)
• Information sent: that the page was opened, that pre-registration was completed, a marker for the page version shown, the page URL (which may include an identifier showing that the visit came from an ad), the URL of the previous page (only when you came from a Facebook or Instagram page), the browser and device type (including the screen size), the IP address, and the values of cookies set by Meta (_fbp and _fbc). Before the Meta Pixel loads, we reduce the page URL to the referral markers we set (v, ch, and lpv) and, only when you came from a Facebook or Instagram page, the ad click identifier (fbclid). We remove all other values, including items starting with utm. This page loads the Meta Pixel only if your browser does not tell us the previous page (for example, if you opened the page by typing its address, or if your browser or the previous site does not share it), or if the previous page it tells us is a Facebook or Instagram page (it does not load the Meta Pixel if the browser tells us that you came from another site or from another page on this site). We send the URL of the previous page only when you came from a Facebook or Instagram page.
• Information not sent: the values you enter in the form on this page (such as your email address). We do not send email addresses in hashed form either. The only values we keep in the page URL are markers we set (an ad code, a page version marker, and a referral source marker) and, when you came from a Facebook or Instagram page, the ad click identifier. For the markers we set, we remove values that are not on our list or replace them with "other". For the ad click identifier, we remove values that do not fit a fixed format (letters, digits, and a few symbols only) and values that contain seven or more consecutive digits or health-related words (from a list we maintain).
• Purpose: to measure how many pre-registrations came from Meta ads, and to use this for ad delivery and measurement.
• How Meta handles it: Meta handles the information it receives under its own privacy policy (https://www.facebook.com/privacy/policy) and may combine it with information it holds and use it for advertising.
• Cookies: on this page, the Meta Pixel sets a cookie named _fbp (a value used to recognize the browser), and, when you arrive from an ad, also sets a cookie named _fbc (an identifier of the ad click).
• How to stop it: if Global Privacy Control (GPC) is turned on in your browser, this page does not load the Meta Pixel. You can change how ads are shown to you on Meta in Meta's ad settings (https://www.facebook.com/adpreferences/ad_settings).

---

12. Age Restriction

12.1 Minimum Age

This service is intended for users 18 years of age or older. Users under 18 may not use the service. We confirm age based on the date of birth you self-report at registration.

12.2 If Use by a Minor Is Discovered

If we discover that a user under 18 is using the service, we will suspend that account and delete the associated data in accordance with §9. Requests to delete an account or data, made by the user or a guardian, may be sent to hello@zanmaido.com and will be handled under the procedure in §10.

---

13. Revisions

If we revise this Policy, we will give notice at least 30 days before the revision takes effect, through an in-app display and a posting on our website. We do not promise to send individual messages to your registered email address, but we may do so when we consider it necessary. For material changes (such as adding a new purpose of use, expanding the scope of third-party provision, or collecting a new type of data), in addition to giving notice, we will present the content of the revision within the app and obtain your renewed consent. Except for material changes, your continued use of the service after the effective date is deemed acceptance.

---

14. Contact