Privacy Policy

Last updated: 2026-08-30

Applicable privacy law depends on the user, processing activity, and operating location.

This Privacy Policy explains how Kotoba Labs Inc (the "Operator", "we") handles personal information in connection with the kotobase.net Service (the "Service"). Sales contact: Ryo Awai.

Our primary framework is the Japanese Act on the Protection of Personal Information (APPI, 個人情報保護法). Where applicable we also address the EU/EEA General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Data controller / business operator

• APPI personal information handling business operator (個人情報取扱事業者): Kotoba Labs Inc. Sales contact: Ryo Awai.
• GDPR controller (for data where we determine purposes and means): the same entity. No EU-UK GDPR Art. 27 representative is designated at this time.
• Data protection contact / DPO: No DPO is designated at this time; contact us at support@kotobase.net.

For much of the Customer Data you ingest, you act as the controller/business and we act as your processor/service provider; in that case your own privacy notice governs your end users, and we handle that data under our agreement with you.

2. Data we collect

• Account and identity data. Tenant DID, CACAO issuer DID, pin owner DID, account status, and — where you authenticate via the Operator's authentication service at https://auth.kotobase.net — the identifiers associated with your bearer token. Email address is collected when you sign in with email OTP (and would be collected from an identity provider if Google/GitHub OAuth were enabled; both are disabled in production). A display name is not required by the apex Worker. Accounts may also be keyed by a hash of email in the same-origin session path (kotobase_session).
• Stored content (Customer Data). Graph data, facts, relationships, pin metadata (pin_id, name, cid, target, status, timestamps, size, content type, archived object keys, error strings), and optional archive payloads (IPLD CARs or raw bytes) that you ingest or pin. This content may contain personal data that you choose to include; you are responsible for its lawful provision.
• Usage and telemetry / operator diagnostics. Request identifiers (x-kotobase-request-id), Cloudflare cf-ray, edge/version identifiers, storage-mode signals, sanitized error summaries, and smoke/health output.
• Security markers. Hashed CACAO replay-nonce markers (issuer, nonce hash, issue time, expiry, seen time). We store a hash of the nonce, not the raw nonce value.
• Payment data (via Stripe). When you subscribe to a paid tier, payment is processed by Stripe. Stripe collects your payment method and billing details; we receive limited billing metadata (e.g. subscription status, tier, tenant DID reference) but not full card numbers.

We do not intentionally collect special-category / sensitive data, and you must not submit secrets or sensitive personal data into fields, logs, or public metadata contrary to docs/DATA-HANDLING.md.

3. Purposes and legal basis

We process personal information to:

• authenticate tenants and enforce namespace isolation and quotas;
• provide, operate, and secure the graph, pinning, and archival functions;
• process subscriptions and billing;
• maintain security, prevent abuse and replay, and diagnose incidents; and
• comply with legal obligations.

APPI: we identify and use personal information within the scope of the utilization purposes above (APPI Arts. 17–18) and do not use it beyond them without consent, except as permitted by law.

GDPR legal bases (for EU/EEA users, where applicable): performance of a contract (Art. 6(1)(b)); legitimate interests in operating and securing the Service (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)); and consent (Art. 6(1)(a)) where relied upon (e.g. certain cookies).

CCPA/CPRA: we process personal information for the business purposes above. The kotobase.net marketing and API surfaces do not load advertising pixels or cross-context behavioural advertising scripts. Unauthenticated GET / and GET /signup set no cookies. We do not disclose personal information for monetary consideration.

4. Sharing and subprocessors

We share personal information only with service providers ("subprocessors") that process it on our behalf to deliver the Service, and as required by law. Current subprocessors:

A public machine-readable subprocessor register is not published. The table above is the current public list.

Content stored as CIDs may also be retrievable by third parties through the public IPFS network, gateways, and caches; this is inherent to content addressing and is not limited to our subprocessors.

5. International transfer

The Operator is organized in Delaware, United States, and uses subprocessors that may process data outside your country, including the United States. Cloudflare may process data in a distributed network including the United States; Stripe may process internationally including the United States; Resend processes in the United States. Backblaze processing region is the region configured on the operator account and is not published as a fixed public region.

• APPI: where we provide personal data to third parties in foreign countries, we do so under the conditions of APPI Art. 28 (consent with prescribed information, equivalent-standard countries, or contractual/other equivalent safeguards). The applicable basis and actual contracting account must be recorded for each active subprocessor before customer data is transferred.
• GDPR: transfers out of the EEA rely on an adequacy decision (Japan holds an EU adequacy decision) or on appropriate safeguards such as Standard Contractual Clauses. The applicable mechanism must be recorded for each active transfer before customer data is transferred.

6. Retention

• Edge-request audit receipts expire after the configured AUDIT_RETENTION_DAYS; the deployed default is 365 days. Existing records keep the TTL assigned when written, so changing the setting is not legal hold.
• Credential-custody audit events expire after 400 days.
• Tenant identity/control-plane records remain until verified tenant decommission. That operation does not remove account identities, browser sessions, graph/pin/archive data, billing records or edge audit receipts.
• Pin metadata deleted via DELETE /pins/:id is marked as deleted; this does not guarantee cryptographic erasure of previously archived content-addressed bytes.
• CACAO replay-nonce markers are retained to prevent replay and are not routinely deleted.
• Content-addressed bytes may remain retrievable from IPFS peers, gateways, caches, or off-site archives after local metadata deletion.
• The authoritative operational baseline is legal/retention-schedule.json. Customer-specific pin/archive periods and the effective account, billing, transactional-email, diagnostics and tombstone periods remain unqualified until the applicable contract, provider settings and counsel-approved schedule record them.

7. Security

• Data is transmitted over TLS with HSTS; edge responses enforce nosniff and frame denial.
• Authentication uses cryptographically verified CACAO capabilities (did:key EdDSA verified at the edge in archive mode; other CACAO types verified in the backend) and/or issued bearer tokens.
• Tenant isolation is enforced by namespace binding and a Durable Object tenant lock; an internal secret makes kotobase.net the sole external write surface.
• Secrets, credentials, tokens, and private tenant data are excluded from public metadata (/_app/meta), logs, and error responses by design.
• Cloudflare Workers, KV and Durable Objects are encrypted at rest by Cloudflare as the platform default. Backblaze B2 encrypts objects at rest under the provider's default. This Operator does not currently run customer-managed KMS/HSM or cryptographic shredding; those remain roadmap items, not shipped defaults. Analytics facts persisted by the Worker are stored in plaintext.

8. Your rights

Subject to applicable law and to verification of your identity, you may request:

• Access / disclosure of the personal information we hold;
• Correction of inaccurate personal information;
• Deletion / erasure (subject to the content-addressing limits in Sections 6 and to legal retention obligations);
• Portability of data you provided in a structured, machine-readable form;
• Restriction / objection to certain processing.
• APPI: rights of disclosure, correction, addition/deletion, and suspension of use under Arts. 33–35, and the utilization-purpose notice under Art. 32.
• GDPR: rights under Arts. 15–21, and the right to lodge a complaint with a supervisory authority.
• CCPA/CPRA: rights to know, delete, correct, and to opt out of sale/sharing; and the right not to receive discriminatory treatment for exercising rights.

To exercise rights, contact us at support@kotobase.net. Because deletion of content-addressed data cannot be fully guaranteed, we will explain the limits of any erasure request.

9. Cookies

Unauthenticated GET https://kotobase.net/ and GET /signup set no cookies (measured 2026-08-14). After sign-in, session cookies may be set:

• gftd_session — issued by auth.kotobase.net, used to authenticate browser navigations to kotobase.net (HttpOnly / Secure / SameSite as configured by the authentication service);
• kotobase_session — same-origin Worker session (HttpOnly; Secure; SameSite=Lax; Max-Age=2592000).

Both are strictly necessary for an authenticated session. The marketing pages do not load analytics or advertising scripts. Visit telemetry (kaiyu) is recorded server-side from the request Referer and does not set a cookie. The API surface is token/CACAO-authenticated and does not rely on cookies.

10. Children

The Service is not directed to children. You must be at least 18 years of age and capable of forming a binding contract. If we learn we have collected account records of a person under 16, we will delete the identity/control-plane records we control, stop processing those records except where retention is required by law, and provide notice of any content-addressed Customer Data that cannot be guaranteed erased.

11. Changes to this Policy

We may update this Policy; material changes are indicated by updating the "Last updated" date and, where appropriate, by additional notice.

12. Contact

Email: support@kotobase.net. Sales contact: Ryo Awai. Operator: Kotoba Labs Inc. No DPO or EU-UK GDPR Art. 27 representative is designated at this time.