Privacy Policy

1. Controller

appful Inc., 2F Nishishinjuku Mizuma Building, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan. Representative: Ryusei Okamoto. Privacy contact: info@appful.tokyo.

2. Information we collect

• Apple sign-in identifier, Firebase user ID, display name, and account details
• For Deep Scan, the selected image, extracted visual facts, safety result, and generated name, description, and attributes
• For local-only Friend Scan, no image bytes; only an image hash and card information needed to prevent duplicates and validate issuance. If you expressly enable online use after obtaining permission, the image needed for safety review and online storage
• Cards, decks, battles, trades, reports, blocks, balances, and purchase-processing records
• Device, OS, app version, language, crash, diagnostic, and security events
• When you optionally enable usage analytics, product-operation events in these categories: consent and onboarding, AI outcomes, scans, decks, Solo and Online battles, rewarded ads, packs, Credits purchases, exchanges, missions, and account-deletion actions and outcomes. Parameters may include controlled category values, master-data IDs, counts, Credits and costs, rarity, durations, and AI token counts
• When Analytics is enabled, pseudonymous app-instance and other app or device identifiers used by the Firebase SDK, together with app, session, device, OS, app-version, language, and approximate-region information
• Advertising choices
• Location only when you grant the optional permission. The device converts it to a municipality-level place name for card naming; precise coordinates are discarded immediately after conversion and are not stored

3. Why we use it

• Provide image analysis, card issuance, battles, syncing, trades, and purchases
• Authenticate users, prevent abuse, secure the service, and moderate reports
• Provide support, resolve failures, and send important notices
• Measure use or serve advertising only where separately permitted
• Meet legal, accounting, and dispute-resolution obligations

4. AI and service providers

For Deep Scan, we send the selected image and necessary instructions to Google's Gemini 2.5 Flash-Lite once for combined factual analysis and safety review. Friend Scan does not use AI image analysis to determine performance. For local-only use, no image is sent to Gemini. Only after you expressly enable online use and confirm the photographed person's permission do we send the image to Gemini once for safety review.

We use Firebase for authentication, database, Functions, App Check, Remote Config, and, after optional consent, Firebase Analytics and its linked Google Analytics 4 (GA4) property. We use Cloudflare R2 for Deep card images and Friend card images expressly approved for online use. Apple supports authentication, purchases, and device security; Google Mobile Ads and UMP are used when advertising is enabled.

Analytics events are limited to a central allow-list. The current app does not send images, image hashes, card names, free text, municipalities, coordinates, Firebase Auth UIDs, friend codes, request IDs, or StoreKit transaction IDs to Analytics. It does not call Analytics.setUserID or link the Firebase Auth UID to the Analytics app-instance identifier.

If GA4 BigQuery export is enabled, GA4 events, parameters, and related SDK metadata collected after opt-in are exported to an access-restricted Google Cloud dataset. No such export occurs while the BigQuery link is not enabled.

Providers may process data outside Japan or your country. We use contracts, access controls, encryption, and other reasonable safeguards. See External Data Transmission for the recipients, data, purposes, and controls.

5. Legal grounds and consent

Depending on location, we process data to perform our contract, pursue legitimate interests in security and service operation, comply with law, or with consent.

Usage analytics is off by default. Accepting the Terms and Privacy Policy does not enable it. Only events occurring after you explicitly enable Share Usage Analytics in Torica Settings are sent to Firebase Analytics and its linked GA4 property. Turning it off stops new collection, and activity while collection was off is not sent later. Information processed before withdrawal remains subject to the applicable retention and deletion settings.

6. Retention

• Transient scan-transfer copies controlled by appful: held only for the active request and deleted when processing completes or fails, except a card image you issue and enable for cloud use
• Google Vertex AI: inputs, outputs, and related data may remain in a project-isolated in-memory cache for up to 24 hours. Only when suspected abuse is detected, Google may retain prompts for abuse investigation for up to 90 days. Google does not use this data to train models without our permission. Current scans do not use Google Search Grounding
• Local-only Friend Scan images: never sent to the server and stored only on device
• Precise coordinates: discarded on device immediately after conversion to a municipality-level place name and never persisted
• Account, card, and in-account consent data: while the account is active and until deletion completes
• Report and moderation records: generally 365 days for safety, investigation, and appeals
• Scan-issuance and deletion-completion anti-abuse records: generally 180 days
• Paid Credits after deletion: the minimum pseudonymous record needed for one-time restoration to the same Apple account, duplicate-grant prevention, and refund adjustments, until unused balance and related debt are resolved
• Optional usage analytics: under the retention setting configured for the production Firebase and GA4 property. If BigQuery export is enabled, the separately configured dataset lifecycle and access controls apply
• Deleted data in protected backups: until each provider's backup rotation completes
• Purchase and accounting records: as required for law, payment verification, and dispute handling

7. Disclosure

We disclose the minimum necessary data to providers that operate cloud, AI, payment, advertising, and support functions. We do not sell personal information for money. We may disclose information when law requires it, to protect life or property, or in a business succession.

8. Your rights

Subject to local law, you may request access, correction, deletion, restriction, objection, portability, or details of disclosures. Use Settings or contact us; identity verification may be required. We do not discriminate against users for exercising applicable U.S. state privacy rights.

9. Children

Minors need permission from a parent or guardian. Torica is not directed to children under 13 in the United States. If we learn that such a child has provided data, we will delete the account and related data. A parent may contact us to request deletion.

10. Security and updates

We use encryption in transit, access controls, authentication, logging, and provider oversight. We will give advance notice of material changes and request renewed consent where required.