SkyPhone Social Privacy Policy

Last updated: October 14, 2026 (clarified the automatic translation providers and the push notification relay to match actual practice)

In providing SkyPhone Social (the "Service"), NOMUDE Inc. (the "Company") establishes this Privacy Policy regarding the handling of users' personal information as follows.

1. Information We Collect

The Company collects the following information in order to provide and improve the Service.

  • Account information: Email address, display name, and password (stored in hashed form)
  • Profile information: Bio, profile image, current country, countries of interest, display language, and time zone
  • Posted content: Post text, images, videos (including the audio contained in videos), and files; comments; likes; hashtags; and video titles, descriptions, tags, and thumbnail images
  • Messages: Direct messages between users
  • Notification tokens: Device tokens for delivering push notifications (FCM / APNs)
  • Usage logs: Access date and time, IP address, device information, OS, app version, and login country history
  • Translation data: Original text and translation results of posts and comments, and automatic detection results of the source language
  • Location information (optional): Only where you have granted permission on your device, your current location at that time (latitude and longitude) is sent to our servers as a search condition, for the purpose of displaying nearby spots (shops and places) in order of proximity. When place suggestions are shown, your current location is also sent, together with the text you enter, to Google Maps Platform as listed in Article 4. It is not used for delivering advertising or for behavioral analysis.
  • Phone number (optional): For identity verification when obtaining the Local Resident badge
  • Instagram connection information (optional): Only where the user has connected Instagram: the Instagram business account identifier and username, and a long-lived access token for posting to the user's own Instagram
  • TikTok connection information (optional): only where the user has connected TikTok: the TikTok user identifier, display name and avatar image, and an access token and refresh token for posting to the user's own TikTok
  • X account ownership verification records (optional): only where the user has verified ownership of an X account in the crosspost feature, that X account name and the time of verification, and the pass-phrase for the verification procedure (time-limited; invalidated after verification)
  • SkyPhone integration information (optional): Only where a user has linked SkyPhone (a calling app provided by QuadSystem Co., Ltd.) and made their call availability public, we read the call availability status and the creation time stored as a public record in that user's atproto account (repository) and display a call button on their profile. We may also receive the identifier (DID) of an account from SkyPhone in order to remove a record left behind after the link is disconnected or the account is deleted. Identifiers received in this way are used solely to remove the record in question (hiding the call button and deleting the record), to notify the person concerned (including by email to their registered address), and to record the removal.

2. Purposes of Use

  • User authentication and account management
  • Sending, receiving, and displaying posts and messages
  • Composing timelines according to the selected countries and displaying translations of posts in other languages
  • Determining the Local Resident badge (phone number verification and continuity of login country history)
  • Delivering push notifications
  • Stable operation of the Service, prevention of unauthorized use, and moderation
  • Responding to user inquiries
  • Improving the Service and developing new features
  • Displaying the call button provided through the SkyPhone integration, and removing call availability records left behind, together with keeping a record of the circumstances

3. Handling Related to the Translation Feature

The Service provides automatic translation when users view posts and comments in other languages. For this purpose, the original text is sent to one of the following language model providers (if one fails or reaches its usage limit, we switch to the next one in order).

  • OpenCode (United States. It does not store the text it receives and forwards it to the upstream providers it uses)
  • BAI Inc. (B.AI. Its terms are governed by the laws of Singapore. The text sent and the translation results may be recorded and stored by the company in anonymized form and used to improve its services)
  • DeepSeek (People's Republic of China)
  • Gemini API by Google LLC (United States. May be used as a fallback in case of failure)
  • Information sent: the original text of posts and comments, the source language, and the target language
  • Information not sent: the poster's personal information (such as email address and phone number)
  • Caching of translation results: stored in the Company's database and used for re-translation requests for the same post (deleted at the same time as the original post is deleted)
  • As a safeguard against prompt injection into the translation engine, the original text is clearly distinguished as "data to be translated" and is designed not to be interpreted as system instructions

Information is processed by each provider in accordance with its privacy policy (OpenCode・B.AI・DeepSeek・Google). We do not make any secondary use other than the translation results.

4. Provision to Third Parties

Except as required by law, the Company does not provide personal information to third parties without the user's consent. However, the Company uses the following external services to operate the Service, and information is processed in accordance with each of their privacy policies.

  • Supabase (database and authentication infrastructure): https://supabase.com/privacy
  • Cloudflare (storage (R2) and delivery of files such as images and videos. File retrieval during viewing goes through the delivery network vcdn.skyphone.social, and the address you connect from is recorded on Cloudflare's side): https://www.cloudflare.com/privacypolicy/
  • Google Firebase (push notifications via FCM): https://firebase.google.com/support/privacy
  • Apple Push Notification Service (push notifications on iOS): https://www.apple.com/legal/privacy/
  • Language model providers (automatic translation: OpenCode, B.AI, DeepSeek; Google's Gemini API as a fallback. See "3. Translation Feature" for details)
  • Google Maps Platform (place suggestions when you choose the location of a spot. The text you enter, and — where you have allowed location access on your device — your current location at that time, are sent to places.googleapis.com): https://policies.google.com/privacy
  • Bluesky Social(Sending and receiving direct messages with native Bluesky users. Message content is processed via api.bsky.chat.): https://bsky.social/about/support/privacy-policy
  • Meta Platforms（Instagram） (only where the user has connected Instagram and instructed a post, the card image and caption are posted to the user's own Instagram via Instagram's Content Publishing API): https://privacycenter.instagram.com/policy
  • TikTok (only where the user connects TikTok and instructs a post, the card image is posted to the user's own TikTok via the TikTok Content Posting API): https://www.tiktok.com/legal/privacy-policy
  • Expo (relay for push notifications to the app. The notification title and text (for direct messages, the sender's name and the beginning of the message; for other notifications, the sender's name) and your device's notification identifier pass through Expo's servers (exp.host)): https://expo.dev/privacy
  • Scrape Creators(when the crosspost feature retrieves a post from X, the address of the post specified by the user (which includes the X account name) is sent, and the post's text, display name and images are retrieved): https://scrapecreators.com/privacy-policy
  • SkyPhone(A calling app provided by QuadSystem Co., Ltd. When the call button on a profile is tapped, the user is taken to SkyPhone's calling page, and the identifier (DID) of the user being called is included in the destination address. When a user places a call via SkyPhone, that user's skyphone.social handle is shown on the other party's incoming call screen and in their call history.): https://www.skyphone.jp/privacy/

5. Retention Periods

As a rule, account information, posted content, and messages are retained for the following periods.

  • Account information, posts, and messages: deleted immediately upon the account deletion operation. There is no grace period, and logging back in after deletion does not restore them (except in the case of a shared account described below).
  • Exception for shared accounts: where you share the same login credentials (account) with another service provided by the Company, the shared portions (your authentication credentials including your email address, your handle, your profile information such as display name, profile picture, bio and user name, your country of residence and language settings, your atproto account together with the past posts and images stored in it, the follow and like records that remain on Bluesky, and the translation cache for those posts) are retained rather than deleted, so that the data of that other service is not lost along with them. In that case you can log in again with the same email address. The same treatment (retention) applies where we were unable to confirm whether the account is shared. Data specific to this Service, such as videos and direct messages, is deleted regardless of whether the account is shared. In addition, if you use this Service with an account on an atproto server operated by someone other than the Company (an external service), or if deletion of the account on the Company's server fails, deletion is limited to what the Company is able to delete, and past posts and images remaining on that account cannot be deleted by the Company.
  • Translation cache: for as long as the original post exists (deleted at the same time as the post or the account is deleted; there is no automatic deletion based on a time limit)
  • Login history: 1 year
  • Video posting records (the poster's identifier, the source IP address, and the date and time of posting): 365 days. In order to respond to reports of rights infringement and to requests for disclosure of sender information, these are retained until the retention period has elapsed, even after the account is deleted.
  • Records of video conversion processing (title, description, tags, and the poster's identifier): retained as records after conversion completes, but deleted when the account is deleted. They are not deleted automatically after a time limit.
  • Post view records (which posts you read; your account while signed in, or a hash of your connecting address plus the date when signed out): used only to prevent double-counting view counts. Records older than the previous day are deleted daily (effectively within 2 days). Raw connecting addresses are never stored.
  • Per-post view counts (post identifier and count only; who viewed is not retained): no automatic deletion by age. On account deletion, the counts for that person's posts are removed.
  • Moderation logs and report records: 5 years (to respond to legal requirements)
  • Information subject to a statutory retention obligation: until the obligation ceases

6. Compliance with Country-Specific Regulations

The Service is operated under Japanese law, but the Company takes the following measures depending on the country of use.

  • Japan: In accordance with the Act on the Protection of Personal Information, the Company specifies and notifies the purposes of use, implements security control measures, and responds to data subjects' rights.
  • United States (California): The Company responds to requests for disclosure, deletion, and correction under the CCPA / CPRA.The Company does not sell personal information to third parties for monetary consideration, nor does it share it for behavioral targeted advertising. Use by persons under 13 years of age is prohibited in accordance with COPPA.
  • South Korea: In accordance with the Personal Information Protection Act (PIPA), the Company obtains consent for collection and use and provides notice of its personal information processing policy.
  • Taiwan: In accordance with the Personal Data Protection Act, the Company provides notice of the purposes of use and responds to data subjects' rights.
  • Australia: The Company complies with the Privacy Act 1988 and the Australian Privacy Principles.
  • Thailand: In accordance with the Personal Data Protection Act (PDPA), the Company clarifies the legal basis for collection and responds to data subjects' rights.

Use subject to the GDPR / UK GDPR / nFADP in the European Economic Area (EEA), the United Kingdom, and Switzerland is outside the scope of the Service, and access or registration from these regions may not be accepted. With respect to the processing of personal information where the Service is used from such regions, the Company does not assume the obligations of a data controller under those laws.

7. Security

To prevent leakage, loss, or damage of the information it collects, the Company implements reasonable security measures such as encrypted communication (HTTPS / TLS 1.3), hashed storage of passwords, access controls, database-level encryption, and regular backups.

8. Users' Rights

Users may request disclosure, correction, deletion, or suspension of use of their personal information. In addition to items that can be handled directly from the account screen (editing your profile, deleting posts, changing your current country, countries of interest, or display language, and deleting your account), please submit requests to the contact below. Note that changing your countries of interest is subject to a 30-day cooldown from the last change.

9. Users Under 13 Years of Age

The Service is intended for users aged 13 or older. Persons under 13 years of age must not use the Service. The Company will promptly delete the account and related information of any user found to be under 13. Users under 18 years of age may be restricted from using certain features, such as obtaining the Local Resident badge.

10. Cookies and Similar Technologies

The web version of the Service uses cookies and local storage to manage sessions and maintain login state. You can disable these in your browser settings, but some features may become unavailable.

11. Changes to This Policy

This Policy may be revised in line with changes to laws or to the Service. In the event of material changes, the Company will provide prior notice on the Service approximately 30 days in advance.

12. About Instagram Connection

In the Service, a user may optionally connect their own Instagram professional account and post to their own Instagram: analysis result cards from the post analysis (xbunseki) feature, and, from the crosspost feature, cards reproducing posts of an X account whose ownership the user has verified. This connection takes place only where the user explicitly initiates it, and is handled as follows.

  • Information obtained: at the time of connection, the Company obtains the Instagram business account identifier and username, and a long-lived access token for posting to the user's own Instagram.
  • Purpose of use: based on the user's own instructions, it is used solely to post card images and captions to the user's own Instagram account.
  • When posting as a video, it is the same card image whose characters appear in time with typing sounds, as a short video; it contains no other footage. The only audio is a typing sound we synthesise ourselves, and no existing recordings are used.
  • Storage and security: access tokens are stored under access control in a database schema that is not exposed externally, and are used only on the server side that carries out the posting. They are not provided to any third party.
  • Disconnection: a user may disconnect at any time, and upon disconnection the Company deletes the access token and connection information it stores. They are also deleted at the same time when the account is deleted.
  • The Company does not use information obtained from Instagram for advertising, profiling, provision to third parties, or any other purpose whatsoever.

13. About TikTok Connection

In the crosspost feature of the Service, a user may optionally connect their own TikTok account and post, to their own TikTok, cards reproducing posts of an X account whose ownership the user has verified. This connection takes place only where the user explicitly initiates it, and is handled as follows.

  • Information obtained: at the time of connection, the Company obtains the TikTok user identifier, display name and avatar image, and an access token and refresh token for posting to the user's own TikTok.
  • Purpose of use: based on the user's own instructions, it is used solely to post card images to the user's own TikTok account. Immediately before posting, the Company queries TikTok for the selectable privacy levels and posting eligibility, and posts only at the privacy level chosen by the user.
  • Choosing not to publish immediately: users can also choose "Save as draft". In that case the card image is only sent to the user's TikTok inbox as a draft and the Company does not publish it. The final publishing step, including the privacy level, is performed by the user inside the TikTok app.
  • Limits on what may be posted: only cards created from the user's own posts may be posted. A card displaying another person's account name cannot be posted unless ownership of that name has been verified.
  • Storage and security: tokens are stored with access control in a database schema that is not publicly exposed, and are used only on the server side that performs the posting. They are never provided to third parties.
  • Disconnecting: the user may disconnect at any time, and on disconnection the Company deletes the tokens and connection information it holds. They are also deleted when the account is deleted.
  • The Company does not use information obtained from TikTok for advertising, profiling, provision to third parties or any other purpose.

14. Contact

For inquiries regarding this Policy and the handling of personal information, please contact us at the address below.

NOMUDE Inc.
Email: x@x.gold