Privacy Policy

When you sign in to the Service via your Google account, we obtain the following information:

• Email address
• Display name
• Profile image URL

If you choose to connect Chatwork, we obtain your Chatwork API token. The token is encrypted with AES-256-GCM before storage and is used only for sending notifications and messages. This integration is optional and can be disconnected at any time from the Settings page.

We store your connected Google account identifier, email address, granted permissions, and encrypted authentication tokens. Files you select or create through the Service can be linked to tasks and projects, with names and other metadata retrieved using your own Google permissions. When you choose to save an ordinary attachment or deliverable, we copy it to a shared drive allowed by your organization. We do not collect all Drive contents, search across Drive, or use Drive data with AI. Google user data is not used to train general-purpose AI models.

We collect and store the following data as part of your use of the Service:

• Calendar events (title, date/time, location, description)
• Task information (title, description, priority, due date)
• Attached files (images, documents, videos attached to events, tasks, reports, etc.)

We may collect access logs (IP address, User-Agent, timestamp) for service quality improvement and incident response.

System administrators (admin / manager roles) record business events (login, file operations, plan changes, MCP integration, etc.) as audit_logs for operational auditing, anomaly detection, and support purposes.

• Items collected: actor information (uid / email / display name / role / team affiliations), action type (AuditAction), target resource (task / event / file / integration, etc.), IP address, User-Agent, timestamp
• Purpose: Detecting unauthorized access, supporting customer inquiries, and preserving compliance audit evidence
• Retention period: 90 days (auto-deleted by Firestore TTL policy)
• Third-party disclosure: None as a rule. Only in response to formal law-enforcement requests in accordance with applicable law

A "Private Space" in this Service is a personal area accessible only to you. It is handled as follows:

• Ordinary private data (not end-to-end encrypted) cannot be viewed by other users, including administrators, due to Firebase Security Rules. However, we may access it through server-side administrative privileges solely for system maintenance, incident response, or as required by law.
• Private documents you protect with end-to-end encryption (E2E) are encrypted with a passphrase you set. No one — not our servers, our company, nor administrators — can decrypt them except you. The passphrase is never stored on our servers.
• Files (images, PDFs, etc.) attached in a Private Space are, when E2E is enabled, likewise encrypted with your passphrase and cannot be decrypted by anyone but you (including our company and administrators). Encrypted files cannot be server-side preview-converted or thumbnailed; they are decrypted and displayed on your own device. File names are not encrypted, so do not include sensitive information in file names.
• If you lose the passphrase for E2E-encrypted data, no one, including us, can recover it (unrecoverable). Please keep separate backups of important information.
• If you choose to enter special-care-required personal information (e.g., medical history or disabilities, as defined by the Act on the Protection of Personal Information), we recommend storing it in an E2E-encrypted private document or file. We do not use such information for any purpose other than providing the Service and complying with the law.
• My Number (Specific Personal Information) cannot be handled by this Service due to restrictions under the My Number Act (see Prohibited Activities, Article 3 of the Terms of Service).

Screen sharing sends connection information to Cloudflare STUN / TURN services to establish or relay connections. When you use voice chat, your display name, audio, and connection information are sent to Daily, our real-time communications provider. By default, the Service does not record or store voice-chat audio or screen-sharing video. If a user separately uses a recording feature, they must obtain consent from every participant.

Business data is stored in Google Cloud Firestore in Tokyo; shared file contents, including confidential files, are stored in Google Cloud Storage in Tokyo; and profile images are stored in Cloud Storage for Firebase in Tokyo. Shared files are stored and retrieved through a Tokyo regional endpoint, but resource metadata such as object names and IAM policies is outside that regional guarantee. Firebase Authentication data, including email and IP addresses, is processed in the United States. Data used for integrations, application delivery, and incident response may also be processed outside Japan by the third-party services listed below.

When you disconnect Chatwork, any stored API tokens are immediately deleted. You can disconnect from the Settings page.

Disconnecting Google Drive deletes your stored connection tokens for the current tenant. You can revoke Google authorization in your Google Account connections settings. Because revocation also affects other grants to the same Google Cloud project, a tenant-level disconnect does not automatically revoke that authorization.

If you wish to delete your account, please contact us using the information below. We will delete all personal data within 30 days of receiving your request.