Privacy Policy

Established: September 23, 2026 / Last updated: September 27, 2026

This is an English translation of the Japanese original. If the two differ, the Japanese version prevails.

END (@aiandrox) (the “Operator”) sets out this Privacy Policy (the “Policy”) on how user information is handled in the smartphone app “写真に顔印 (FaceSeal)” (the “App”) and its website (together, the “Service”).

1. Photos and Face Data

Face detection, assigning icons, emoji, or mosaics to faces, and compositing images all take place on your device. We never send photos, images of faces in photos, or data describing facial features to the Operator or to any external server.

Face detection only obtains the position, size, and tilt of each face. We do not extract facial landmarks or identify whose face it is (face recognition). Detection results are held in your device's memory only while the App is running, for editing the photo; they are never saved to your device and are erased when the App closes. They are not provided to third parties.

2. Information We Collect and How We Use It

The Service collects and sends the following information.

• App usage data (Google Firebase Analytics): usage such as screens viewed and actions taken; device model, OS, language, and approximate region; App version; per-installation identifier; the ID number issued by the App; and advertising ID.
  Purpose: to understand how the Service is used and improve it.
• Error data (Google Firebase Crashlytics): the circumstances when the App crashes or an error occurs; device and App information; per-installation identifier; and the ID number issued by the App.
  Purpose: to investigate and fix bugs.
• Data for delivering settings (Google Firebase Remote Config): per-installation identifier, App version, and similar.
  Purpose: to deliver App settings and notices to users (such as update announcements).
• App and device verification data (Google Firebase App Check): information used to confirm that the App is genuine and is being used from a legitimate device.
  Purpose: to prevent abuse.
• Information entered in the “find icon by social media handle” feature: the handle you enter and the service you choose (X, Instagram, etc.). Only when you use this feature, it is sent to the icon lookup service unavatar.io through the Operator's relay server (Firebase Cloud Functions on Google Cloud, Tokyo region). The relay server temporarily stores communication logs that include your IP address, the time of access, and the handle and service name you entered.
  Purpose: to fetch the icon image published under that handle and show it to you.
• Ad delivery data (Google AdMob): advertising ID (on iOS, only if you allow tracking); device model, OS, and similar; IP address and approximate location inferred from it; interactions with ads such as views and taps; diagnostic information about App launches and behavior; ad consent status; and similar.
  Purpose: to deliver ads, measure their effectiveness, and prevent fraud, and, where you have consented or in similar cases, to show ads tailored to your interests. See Section 11 for details.
• In-app purchase data (RevenueCat): when you make or restore a purchase, the proof of purchase (receipt) issued by the App Store or Google Play and its contents, product ID, store country and currency, device model, OS, and App version, IP address, and an anonymous user ID generated automatically by RevenueCat.
  Purpose: to verify purchases, restore purchases after changing devices or reinstalling, and prevent fraudulent purchases.
  Payments are processed by Apple or Google; neither the Operator nor RevenueCat receives payment information such as credit card numbers.
• Information sent when you contact us: your email address, the content of your inquiry, and, included in the body of the email the App creates, the ID number issued by the App, App version, OS type and version, device model, your current plan, and the time sent.
  Purpose: to respond to your inquiry and investigate reported problems. The ID number is used to match your inquiry with error data.
  This email is sent from your own email app; the App never sends it automatically. You can review what will be included in the App before sending.

The Operator does not use information beyond the purposes above, and does not attempt to identify individual users from the information collected.

3. Information Stored on Your Device

Recently used handles, fetched icons, text icons you made, App settings, and similar are stored only on your device. They are not sent to the Operator and are erased when you delete the App.

The App also stores on your device an ID number used to match inquiries with error data. It is a random string generated by the App, not derived from any device identifier, and does not identify you personally. As described in Section 2, it is included in support emails and set in Firebase Analytics and Crashlytics. If you use your device's backup features (Android Auto Backup or iCloud Backup on iOS), this ID number may carry over when you restore or change devices.

4. Use of External Services and Provision to Third Parties

The Operator does not provide users' personal information to third parties without their consent, except in the following cases:

• When required by law
• When necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent
• When necessary to cooperate with a government agency carrying out duties prescribed by law
• When outsourcing the handling of information to the extent necessary to achieve the purposes of use (including the use of the external services in Section 2)

Information sent to Google for ad delivery is also handled under Google's own privacy policy (Section 11).

5. Transfers to Businesses in Other Countries

Some of the information in Section 2 may be sent to, stored, and processed by the following businesses in other countries.

• Google LLC (United States): information handled by Firebase Analytics, Crashlytics, Remote Config, App Check, and Cloud Functions. Google processes information in data centers located around the world where Google or its subprocessors have facilities, so information may be processed in countries other than the United States, and it is not possible to identify every country in advance. The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; instead, individual states have their own privacy laws. Under the data processing and security terms that apply to Firebase, Google processes information only on the Operator's instructions and maintains security measures, including certifications such as ISO/IEC 27001.
  Information handled by Google AdMob is also sent to Google LLC. Google handles this information not as the Operator's processor but under its own privacy policy.
• RevenueCat, Inc. (United States): handles information from in-app purchases and restores as the Operator's processor. The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; instead, individual states have their own privacy laws. Under a data processing agreement, RevenueCat processes information only on the Operator's instructions and maintains security measures, including SOC 2 Type II certification.
• Microlink (Spain): the operator of unavatar.io. It handles the handle and service name entered in the “find icon by social media handle” feature. The EU, including Spain, protects personal information under the General Data Protection Regulation (GDPR), and has been designated by Japan's Personal Information Protection Commission as having a personal information protection system equivalent to Japan's. Microlink outsources part of its processing to businesses in the United States and elsewhere (such as cloud infrastructure, content delivery, and monitoring services). We send only the handle and service name you entered; we do not send your device identifiers or IP address.

For information on other countries' personal information protection systems, see also the Personal Information Protection Commission website (in Japanese).

6. Retention Periods

• App usage data: deleted after the period set in Firebase Analytics's data retention settings (up to 14 months).
• Error data: under Firebase Crashlytics's specifications, generally kept for 90 days and then deleted.
• Per-installation identifiers (Firebase Installations): stored according to Firebase's specifications, and deleted within 180 days after the deletion process.
• Ad delivery data: stored and deleted according to Google's privacy policy and the retention periods Google sets.
• Relay server logs: under Google Cloud's default settings, generally kept for 30 days and then deleted.
• In-app purchase data: kept by RevenueCat for as long as needed to restore purchases.
• Support inquiries: deleted once the necessary period has passed after we finish responding.

7. Security

The Operator takes necessary and appropriate security measures, such as managing access permissions to external services and encrypting communications, to prevent leaks, loss, or damage of the information it handles.

8. If You Want to Stop Sending Information

• On Android, you can delete or reset your advertising ID in your device settings (under “Privacy” or “Google” in Settings, then “Ads”; menus vary by device). On iOS, the App asks for permission to track, and if you don't allow it, your advertising ID (IDFA) is not collected (Section 11).
• For how to change your ad consent or opt out, see Section 11.
• If you don't use the “find icon by social media handle” feature, no handles or service names are sent.
• There is currently no setting in the App to stop sending app usage or error data. If you want to stop it, please delete the App.

9. Requests for Disclosure and Other Actions

You may request that the Operator notify you of the purpose of use of, disclose, correct, add to, or delete, stop using or erase, or stop providing to third parties, the personal information about you that the Operator holds. Please send requests by email to the contact in Section 13. The steps for requesting data deletion, and which data is deleted or kept and for how long, are described on the Data Deletion Request page. After confirming your identity, we will respond without delay in accordance with the law. There is no fee.

App usage and error data in Section 2 is handled without being linked to your name or email address, so depending on your request, we may be unable to identify your information and respond.

10. Children

The Service is not primarily directed at children. Minors should use it with the consent of a parent or guardian. The Operator does not knowingly collect personal information from children.

11. Advertising

The App uses Google AdMob, an ad service from Google LLC, to show ads (a banner ad at the bottom of the screen, and a full-screen ad when saving or sharing an image).

• Information sent: when ads are shown, the Google Mobile Ads SDK sends the “Ad delivery data” described in Section 2 to Google. No information about your photos or faces is sent for advertising.
• Purpose: used to deliver ads, measure their effectiveness, and prevent invalid ad activity, and, where you have consented or in similar cases, to show ads tailored to your interests (personalized ads).
• How Google handles it: see How Google uses information from sites or apps that use our services.

You can choose or change how your information is used for ads as follows:

• Users in the European Economic Area (EEA), the UK, and Switzerland: you can make your choice about the use of your information for ads on the consent screen shown, for example, when you first launch the App. You can change it later from “Ad privacy settings” in the App's menu.
• Users in certain US states: where state law requires an opt-out of the sale or sharing of personal information, you can opt out from “Ad privacy settings” in the App's menu.
• Android: you can delete or reset your advertising ID in your device settings (Section 8).
• iOS: the App asks for permission to track you for advertising. If you don't allow it, your advertising ID (IDFA) is not collected and you see ads not based on your interests. You can change this later under Settings > Privacy & Security > Tracking on iOS.

“Ad privacy settings” appears in the menu only in regions where you need to be able to change your consent. Even if you don't allow your information to be used for ads, all of the App's features remain available, and you will see ads not based on your interests.

12. Changes to This Policy

The Operator may change this Policy in response to changes in laws or in the Service. The revised Policy takes effect when posted on this page. For changes that significantly affect your rights, we will give advance notice in the App or on this website.

13. Operator and Contact

Operator: END (@aiandrox)
Contact: face-seal@aiandrox.com

We will disclose the Operator's name and address without delay upon request.