Privacy policy

1. Information we collect

This service (Yorimichi Closet) collects and uses the following information.

■ At sign-in (OAuth with Discord / Google / X (Twitter), or a sign-in link sent to your email address)

• Provider user ID, display name and avatar image URL: used for authentication, showing post authors and account management.
• Email address: used to identify your account, to link multiple sign-in methods that share the same address to one account, and to send you a sign-in link if you use email sign-in. It is not used for marketing or promotional email. (X (Twitter) does not provide an email address, so none is collected.)

■ While using the service

• Closet data: avatar and item information saved to your closet (public closets can be viewed without signing in).
• Favorites: the list of avatars and items you have favorited.
• Timeline posts: outfit images, captions and item information you post.
• Compatibility reports: the compatibility information you submit.
• Access logs: search queries and item click information (for statistics and improving the service), recorded together with an anonymous session identifier that does not identify you.
• Payment information: if you buy a paid plan or a promotion slot, we keep the customer ID issued by our payment processor (Stripe) and your subscription status. We never collect or store your credit card number.
• Cookies / sessions: used to keep you signed in, to remember your display preferences, and for access analytics (Google Analytics). See "7. Cookies" for details.

■ When you contact us or request a takedown

• Name, Discord ID and X (Twitter) ID (all optional): used as a contact address when a reply is needed. The contact form does not collect email addresses.
• Message content: used to respond to your questions and requests.
• An identifier derived from your IP address: used solely to block spam submissions. It is stored as an irreversible hash, and the IP address itself is not stored.
• Takedown verification code: generated and used temporarily to confirm shop ownership.

■ When you submit a takedown request

• Discord ID and email address (both optional): used only to tell you the outcome of your takedown request. Never used for marketing and never shared with third parties. If you provide neither, we do not contact you. These contact details are deleted one year after the request is handled (or after submission if it is never handled). The request itself — what was reported and what we did — is retained after that, so the basis for the removal can be verified later.

2. Purpose of use

The information collected is used for the following purposes.

• Providing, operating and improving this service
• Detecting and handling inappropriate posts and spam
• Responding to user support
• Statistical analysis of service usage (in a form that does not identify individuals)
• Verifying the identity of rights holders who request a takedown
• Providing paid plans and promotion slots, processing payments and managing subscription status
• Detecting and investigating errors and outages, maintaining security and preventing abuse

3. Disclosure to third parties

Except where required by law, we do not provide personal information to third parties without the user's consent. However, data may be processed through the following services.

• Discord / Google / X (Twitter): used for OAuth authentication. Each provider's privacy policy applies.
• Resend: used to send sign-in links to your email address (your email address is processed by this provider).
• Database and application servers: data is stored and processed on servers in Japan operated by the Operator (PostgreSQL).
• ImageKit: used to deliver and optimise timeline post images and profile images.
• Cloudflare: used for content delivery and protection against abuse. As it relays traffic, information such as your IP address and access times is processed.
• Stripe: used to process payments for paid plans and promotion slots. Card details are collected directly by Stripe and are never stored by this service.
• Google Analytics: used to analyse how the site is used. It uses cookies to collect information such as the pages you view, the referring site and your approximate region, but we do not send information that directly identifies you, such as your name or email address. While you are signed in, we also send your account ID within this service (a random string) so that visits from different devices can be counted as one user. Google's privacy policy applies.
• Sentry: used for error monitoring and incident investigation. Along with the error itself, the URL you accessed, browser information and your user ID may be sent.
• DeepL: used to translate search keywords and item names. Keywords you enter may be sent for translation.
• Notifications to the Operator's Discord server: inquiries, reports and new posts are sent to internal notification channels (including the content of posts and inquiry messages).

Among these providers, Discord, Google, X (Twitter), ImageKit, Cloudflare, Stripe, Resend, Sentry and DeepL may operate servers outside Japan, and personal data may be transferred abroad to that extent. Such data is handled in accordance with the security measures and privacy policies published by each provider.

4. Retention period

• Account data: kept until you leave or request deletion.
• Access logs (searches and clicks): kept for a period, then aggregated into statistics.
• Inquiry data: kept as a record even after the matter is resolved (to prevent spam).
• Takedown verification codes: expire 24 hours after being issued.
• Payment records: kept as transaction records for the period required by law (tax and electronic bookkeeping rules).

5. Deleting your data and exercising your rights

If you would like the data stored here (closets, favorites, posts and so on) deleted, please contact us from the contact page.

Under Japan's Act on the Protection of Personal Information you may also request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, or suspension of provision to third parties of your retained personal data. Please contact us from the contact page. Once we have confirmed your identity we will respond without undue delay as required by law, free of charge.

The same applies if you wish to delete your account itself. After deletion, data tied to the account — including public closets and timeline posts — will no longer be viewable. However, information we are legally required to retain, and information already reflected in other users' content (for example aggregated statistics), may not be deletable.

If you are a rights holder who wants their own work removed, please use the takedown request form for rights holders.

6. Security

This service uses security measures such as HTTPS (TLS) encryption, signature verification of session tokens, and role-based access restrictions on the admin screens. However, no communication over the internet can be guaranteed to be completely secure.

7. Cookies and similar technologies

This service uses cookies and similar technologies (browser local storage) for the purposes below. Essential and analytics cookies are used even when you are not signed in.

■ Essential cookies (required to provide the service)

• Sign-in session: keeps you signed in and protects against impersonation and forged requests.
• Display language (NEXT_LOCALE): remembers the language you selected.
• Display theme: your light/dark appearance setting is stored in your browser's local storage (it is not sent to our servers).
• View-count de-duplication: a short-lived identifier that stops a public closet view from being counted twice in quick succession.

■ Analytics cookies (Google Analytics)

Used to understand how the site is used (pages viewed, referring site, approximate region, browser and so on) and to improve the service. Information that directly identifies you, such as your name or email address, is not sent. Our measurement ID is G-76QHB7DLXB.

If you want to stop measurement by Google Analytics, use Google's opt-out browser add-on or block cookies in your browser settings.

■ About advertising cookies

This service does not use third-party ad network cookies for behavioural targeting. Promotion slots inside the service are placed directly by us.

You can delete or block cookies in your browser settings. If you block essential cookies, features that require signing in and the saving of display preferences will not work.

8. Changes to this policy

This policy may be updated as needed. Significant changes will be announced within the service.

9. Contact and operator information

Operator: Hidamari Digital Works (operator of Yorimichi Closet) / Personal information manager: Hidamari Digital Works administration office

For questions or requests about this policy and the handling of personal information, please contact us from the contact page or by email ([email protected]). As stated in the Notation based on the Act on Specified Commercial Transactions, our address and phone number will be disclosed without delay upon request.