PRIVACY

Privacy Policy

Effective date: October 29, 2026

This Privacy Policy applies to users outside Japan who use RELA in English, including users in the United States. Users residing in Japan are governed by the Japanese Privacy Policy. Additional U.S. state disclosures appear in Sections 13 and 14 and apply only to the extent the relevant law applies.

GOONER CO., LTD. (株式会社Gooner) (“GOONER,” “we,” “us,” or “our”) operates RELA (the “Service”). This Policy explains the information we collect, how we use and disclose it, how long we retain it, and the choices and rights available to you. GOONER is located in Japan, and information may be processed in Japan, the United States, and other countries where our service providers operate.

1. Information We Collect

• Account information: email address, account identifier, registration, and authentication information.
• Profile information: gender, date of birth, blood type, personality-test responses, and other information you choose to enter.
• Information about other people: nickname, age, relationship notes, and similar details you choose to register.
• Conversations and uploads: your conversations with RELA (text and voice), the text the concierge reads aloud, chat screenshots, face and palm photographs, other images, and text you submit.
• Results and use: AI analyses, generated content, feature interactions, usage history, and support communications.
• Technical information: IP address, cookies and local-storage identifiers, device, operating system, browser, access logs, approximate location derived from IP, and error reports.
• Transaction information: billing name and email, purchase and subscription status, transaction identifiers, and Coins balance. Stripe and Google Play process payment-card information; we do not store full card numbers.

2. How We Use Information

• to create accounts, authenticate users, and provide and maintain the Service;
• to perform requested AI analysis and generate replies, concierge responses, readings, reports, images, and other results, and to provide speech synthesis and transcription (for which, with your permission as described in Section 3, we send information to an AI service provider);
• to administer subscriptions, trials, Coins, payments, and contracts;
• to send transactional and service notices;
• to respond to inquiries and rights requests;
• to detect, prevent, and investigate fraud, abuse, security threats, and violations of our Terms;
• to improve quality, analyze use, and produce aggregated or de-identified statistics; and
• to comply with law and establish, exercise, or defend legal claims.

3. Service Providers and AI Processing

We disclose information to service providers only as needed to operate the Service. Current principal providers include Supabase for authentication and data storage; OpenAI, L.L.C. for AI analysis, speech synthesis, and transcription; Stripe for web payments; Google for Android distribution and Google Play billing; and RevenueCat for subscription-status management.

Data sent to the AI service (OpenAI, L.L.C., United States). When you use RELA's AI features (the concierge, message analysis, analyses of you and the people you register, reply suggestions, palm and face readings, image generation, speech synthesis, and transcription), we send the following to the API of OpenAI, L.L.C. in the United States: (1) your conversations with RELA (text and voice) and the text the concierge reads aloud (sent to be turned into speech); (2) chat screenshots and the conversations in them; (3) profiles of you and the people you register (nickname, date of birth, time of birth (if you enter it), gender, blood type, 16 type, notes on relationship or situation, and similar details); and (4) in versions other than the iOS app, palm and face photographs and information for image generation. We send this information to provide analyses, reply suggestions, concierge responses, speech synthesis, and transcription.

How the AI service handles it. We use the OpenAI API. Data sent to the API is not used to train OpenAI's models. OpenAI may retain the data for up to 30 days to monitor for abuse. Analysis results are stored on our servers (Supabase).

Consent and withdrawal in the app. Before we send the information above to the AI service, the app shows a consent screen that explains what is sent, to whom, why, and how it is handled, and asks for your permission. If you do not agree, none of this information is sent and the AI features are unavailable. You can review the consent text or withdraw consent at any time in Settings under “Data sent to AI”; nothing is sent after you withdraw. We record the date and time of your consent or withdrawal and the version of the consent text on your device and in your account.

Because OpenAI, L.L.C. is located in the United States, this information is transferred to the United States. Other providers may also process information outside your country. We use contractual, access-control, and security measures appropriate to the information and applicable law.

4. How We Disclose Information

We do not sell personal information or share personal information for cross-context behavioral advertising. We may disclose information:

• to the service providers described above for services performed on our behalf;
• at your direction or with your consent;
• to comply with law, legal process, or government requests, or to protect rights, safety, and property; and
• in connection with a merger, financing, acquisition, reorganization, or sale of relevant assets, subject to appropriate notice and safeguards.

5. Information About Other People

Before entering or uploading information about another person, obtain that person's consent. Mask directly identifying details where possible and do not submit sensitive information listed in the Terms. We may remove information that may violate law or another person's rights. If a person asks us to delete information about them, we will verify and handle the request as required by law.

Sharing your profile by QR code

RELA lets you share profile items you choose with a specific person through a QR code or link.

• You choose the items each time you create a QR code. By default only your nickname is included. For birthdays, "Hide birth year" is on by default, so only the month and day are shared and the year never leaves your device.
• Before a QR code is shown, you see exactly what will be shared and the code is created only if you agree.
• A link is valid for 24 hours and can be used once. When it is used, revoked or expires, the shared content is promptly deleted from our servers. You can disable it at any time with "Revoke this QR".
• Our servers store only the shared content (for the period above), a hashed value used to match the link, and whether each use succeeded and when. The link itself is not stored.
• The recipient sees a confirmation screen first. When the recipient taps "Add contact", the registration fields are filled in and saved by the app's automatic saving.

Camera

The camera is used to scan QR codes. Images are processed only on your device to detect the QR code and are never sent or stored.

6. Cookies and Local Storage

We use cookies, browser local storage, and similar technologies for authentication, security, troubleshooting, preferences such as language, and service analytics. We do not use third-party advertising cookies. Browser settings may restrict these technologies, but some Service functions may then be unavailable.

7. Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including legal, accounting, security, and dispute-resolution requirements. After account deletion, account content is deleted or de-identified within 30 days unless retention is legally required. Backup copies are deleted on the applicable backup cycle, generally within 90 days. Transaction records are retained for legally required periods. Service providers retain information under their contracts and applicable settings.

8. Security and Incidents

We use reasonable administrative, technical, and organizational safeguards, including access restrictions, encrypted transmission, credential management, logging, provider oversight, and staff controls. No system is completely secure. If an incident occurs, we will investigate, contain, remediate, and provide notifications required by applicable law.

9. International Processing

Information may be stored and processed in Japan, the United States, and other countries whose laws may differ from those where you live. We use contracts and other safeguards appropriate to applicable law. If you are located in a jurisdiction that requires a specific international-transfer mechanism not described here, contact us before using the Service.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that a child under 13 submitted personal information, we will delete it. Users aged 13 through 17 may use the Service only with a parent or legal guardian's consent and supervision. Contact us if you believe a child has provided information contrary to this Section.

11. Your Choices and Rights

You may review and edit profile information and registered-person information within the Service and may request account deletion in Settings. Subject to applicable law, you may request access, correction, deletion, restriction, objection, or a portable copy of your personal information by emailing info@gooner-info.co.jp. We may verify identity by confirming control of the account email or using another proportionate method. We will respond within the time required by applicable law and explain any denial.

We do not currently send promotional email. If that changes, we will provide any notice and opt-out mechanism required by law. Necessary account, security, billing, and service communications are not promotional messages.

12. Browser Privacy Signals

Because we do not sell personal information or use it for targeted advertising, Global Privacy Control and Do Not Track signals do not currently change our processing. If our practices change, we will update this Policy and honor legally required signals.

13. California Privacy Notice

This Section supplements the Policy for California residents and applies to the extent GOONER is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). The categories below describe personal information collected during the preceding 12 months.

We collect and use these categories for the purposes in Section 2 and disclose them for business purposes to the providers in Section 3. We have not sold personal information or shared it for cross-context behavioral advertising during the preceding 12 months. We have no actual knowledge that we sell or share personal information of consumers under 16. We do not use face or palm images to uniquely identify or authenticate a person.

Subject to the CCPA and applicable exceptions, California residents may request to know, access, delete, or correct personal information; receive information about categories, sources, purposes, and recipients; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service and pricing when exercising rights. Because we do not sell or share personal information, an opt-out mechanism is not currently required for those activities. We use sensitive personal information only for permitted operational purposes and the features requested by the user.

To exercise a right, email info@gooner-info.co.jp with the subject “California Privacy Request,” or use account controls where available. We will verify the request and respond within the period required by law. An authorized agent may submit a request with proof of authority; we may also verify the resident's identity directly.

14. Residents of Other U.S. States

If you reside in a U.S. state with an applicable comprehensive privacy law, you may have rights to access, correct, delete, or obtain a copy of personal data and to opt out of certain sales, targeted advertising, or profiling that produces legal or similarly significant effects. We do not currently sell personal data, use it for targeted advertising, or conduct such significant-effect profiling. Submit a request to info@gooner-info.co.jp. If applicable law provides an appeal right and we deny your request, you may appeal by replying to our decision. We will respond within the period required by that law.

15. Changes

We may update this Policy when our practices, the Service, or applicable law changes. We will provide appropriate advance notice of material changes and identify the effective date.

16. Contact

Effective date: October 29, 2026