Contents
Article 1. Basic policy and scope
Yuki Lab (“we”), which operates yuki-lab.com and its subdomains (for example reversi.yuki-lab.com and shogi.yuki-lab.com) as well as native applications, establishes this privacy policy (the “Policy”) to handle your personal information appropriately.
The Policy applies to the following services provided by Yuki Lab:
- The websites above (including Reversi Web, Chess Web, Shogi Web, the character counter and others).
- The native applications we operate (the “app versions”).
Terms used in the Policy follow the definitions of the Act on the Protection of Personal Information of Japan.
Article 2. Information we collect
Information you provide
- On some services (including but not limited to Reversi Web), the email address, password and other details entered through the optional account registration feature.
- On some services (including but not limited to Reversi Web), information required for payments. Credit card details are stored by our payment processor, Stripe; we cannot view card numbers. We can view a summary of transaction history in the Stripe dashboard.
- If you use in-app purchases (Google Play) in the app versions, purchase information provided by Google (purchase token, order number, product ID, subscription status, expiry date, etc.). Payment method details are managed by Google and are not collected by us. We store these to verify purchases and to provide and restore premium features.
- Anything you enter into our contact forms.
- Any other information you provide to us.
Information collected automatically
- Behavioural data collected through Google Analytics, Microsoft Clarity and similar tools (pages viewed, clicks, etc.).
- Advertising-related information from Google AdSense (websites) and Google AdMob (app versions), such as ad impressions and measurement cookies.
- In the app versions, the advertising identifier (advertising ID) and device identifiers. These are used for ad delivery, measurement and fraud prevention and are sent to Google (AdMob).
- Records of online rated matches on Reversi Web (the move record, the time taken for each move, whether the player left the screen during the game, the device type, the ratings before and after the game, and player identifiers). These are retained for a limited period to investigate and prevent cheating, such as the use of external software during a game.
- On Shogi Web, the rating for online matches and a backup of your records (settings, progress, display name, record totals and the move records of your latest 100 games, including opponents' display names), together with a per-device identifier linked to them. The backup is kept so that the data can be restored if your browser deletes its saved data automatically, and is deleted once 180 days have passed since your last use.
- Records of online matches against random opponents on Shogi Web. These are kept for up to three months to investigate and prevent cheating, such as the use of external software during a game, and are not provided to third parties.
- Other data collected automatically.
Article 3. Purposes of use
Under the Act on the Protection of Personal Information, we may use the collected information for purposes such as the following.
- Creating and authenticating accounts, and providing features that use accounts.
- Managing payments and subscriptions, processing payments, sending important payment-related notices, and providing paid features.
- Responding to enquiries.
- Sending notices of various kinds.
- Preventing fraud and abuse.
- Analysis for usability and feature improvement through Google Analytics, Microsoft Clarity and similar tools.
- Ad delivery, measurement and fraud prevention through Google AdSense, Google AdMob and similar services (including the use of advertising identifiers).
- Saving records and settings, and restoring them if your browser deletes its saved data.
- System maintenance, security and troubleshooting.
- Compliance with laws and the exercise or defence of legal rights.
- Otherwise operating and improving the services appropriately.
When we receive a request based on the law regarding notification or disclosure of purposes of use, we will respond without delay, except where the law provides otherwise (a fee, described below, applies).
Article 4. External services and transmission of information to them
Our websites and app versions use the external services below, and information is sent from your browser or app to each company. This is our public notice under Article 27-12 of Japan's Telecommunications Business Act (the authoritative Japanese text is here). Not every site or app uses all of them.
Google Analytics
Recipient: Google LLC and its affiliates
Information sent: information about your browser, device and connection (including your IP address), approximate location, pages you view and your actions on them, and identifiers stored in cookies
Purpose: We use it to analyse usage and improve our services. Google uses it to analyse browsing trends and history.
Google AdSense
Recipient: Google LLC and its affiliates
Information sent: information about your browser, device and connection (including your IP address), pages you view, ad impressions and clicks, and identifiers stored in cookies
Purpose: We use it to show ads that cover the cost of running our services. Google uses it to deliver ads and other information.
Google Ads
Recipient: Google LLC and its affiliates
Information sent: information about your browser, device and connection (including your IP address), pages you view, and identifiers stored in cookies
Purpose: We use it to measure the effectiveness of our own ads and to show our ads to people who have visited our sites. Google uses it to deliver and measure ads.
Microsoft Clarity
Recipient: Microsoft Corporation
Information sent: information about your browser, device and connection (including your IP address), pages you view and what they display (with text typed into input fields hidden), records of your actions on them (clicks, scrolling and mouse movement), and identifiers stored in cookies
Purpose: We use it to find parts of our services that are hard to use and improve them. Microsoft uses it to provide and improve Clarity and for advertising (Microsoft Advertising).
Cloudflare Web Analytics
Recipient: Cloudflare, Inc.
Information sent: information about your browser, device and connection (including your IP address), the URL of the page you view and the referring URL, how long the page took to load and to respond to your actions, how much the layout shifted and which on-screen elements shifted, and browser memory usage (no cookies are used)
Purpose: We use it to understand traffic and page speed. Cloudflare uses it to provide this service.
Google Fonts
Recipient: Google LLC and its affiliates
Information sent: information about your browser, device and connection (including your IP address), and the domain name of the site you are viewing
Purpose: We use it to display text correctly. Google uses it to deliver fonts and improve that service.
Tailwind CSS
Recipient: Tailwind Labs Inc.
Information sent: information about your browser, device and connection (including your IP address), and the domain name of the site you are viewing
Purpose: We use it to display page designs correctly. Tailwind Labs uses it to deliver this program.
cdnjs
Recipient: Cloudflare, Inc.
Information sent: information about your browser, device and connection (including your IP address), and the domain name of the site you are viewing
Purpose: We use it to load the program that displays QR codes. Cloudflare uses it to deliver this program.
Stripe (checkout page)
Recipient: Stripe, Inc. and its affiliates (including Stripe Japan K.K.)
Information sent: information about your browser, device and connection (including your IP address), language settings, pages you view, and records of your actions on them (including mouse movement)
Purpose: We use it to process payments and prevent fraud. Stripe uses it to provide its payment services, detect fraud, and analyse and improve its services.
Google AdMob (app versions)
Recipient: Google LLC and its affiliates
Information sent: information about your device and connection (including your IP address), the app you are using, ad impressions and clicks, and device identifiers including the advertising ID
Purpose: We use it to show ads that cover the cost of running our apps. Google uses it to deliver ads and other information.
For details of how each company uses the information, see the pages of Google, Microsoft, Cloudflare and Stripe. You can control ad personalisation from Google's Ad Settings and stop sending data to Google Analytics with the opt-out add-on.
In addition, during matches against random opponents on Shogi Web, the number of times and the length of time you switched to another screen or app during your own turn are sent to our server together with your moves, to investigate and prevent cheating.
External services used to provide our services
- Stripe: payment processing on our websites. Credit card information is sent directly to and stored by Stripe; we do not collect or view card numbers.
- Google Play: in-app purchases in the app versions, and verification that a purchase is valid.
- Cloud databases and servers, and form services: storage of account information and the content of enquiries.
- Notification (chat) services: notifying us of feedback and bug reports sent from our game screens (including the technical details attached automatically).
We update this article when we add or change external services. In every case they are used within the purposes set out in Article 3.
Article 5. Disclosure to third parties
- Usage data for each service and information necessary for payment processing may be sent to providers such as Google (Analytics, AdSense, AdMob, Tag Manager, etc.), Microsoft (Clarity) and Stripe.
- In the app versions, advertising identifiers (advertising IDs) and similar data are sent to Google (AdMob) for ad delivery, measurement and fraud prevention.
- For payments, credit card information is sent directly to and stored by Stripe; we do not collect or view card numbers.
- For in-app purchases in the app versions, purchase tokens and similar data are sent to Google (Google Play) to verify that a purchase is valid.
- We may disclose information to third parties where required by law, or where necessary to protect a person's life, body or property, in accordance with the law.
- Records of third-party disclosure will be disclosed upon a request based on the law (a fee, described below, applies).
Article 6. Security measures
- We select established providers such as Google, Microsoft and Stripe and take care to configure them appropriately.
- We implement multiple security measures, including access control and the use of HTTPS. For security reasons we do not publish the details, except where disclosure is required by law.
- We use cloud services provided by companies located in the United States (databases, forms, payments, advertising and analytics), and personal data may be stored on servers located in the United States. We take security measures on the basis of our understanding of the personal data protection regime of the United States.
Article 7. Requests for disclosure and similar matters
We respond without delay to requests under the Act on the Protection of Personal Information for “disclosure and similar matters” (notification of purposes of use; disclosure of retained personal data or records of third-party disclosure; correction, addition or deletion; suspension of use or of third-party disclosure), and to other requests based on the law, subject to the exceptions set out in the Policy.
- How to request: please contact us through this form. We may ask you to submit documents to verify your identity.
- Fees: for requests for notification of purposes of use and for disclosure of retained personal data or records of third-party disclosure only, we charge 2,000 yen (tax included) per request. The same amount is charged as an administrative fee even when we cannot comply with the request. No fee applies to requests for correction, addition, deletion, suspension of use or suspension of third-party disclosure.
- Deleting a Reversi Web account: no form is required. While logged in, you can do this free of charge from the menu inside the service.
- Retention: we keep account information for as long as the account exists, and delete or anonymise it within a reasonable period after the account is deleted. Information we are required by law to retain is kept for the period required by law.
- Exceptions: where a statutory exception applies, we may be unable to disclose or suspend use of all or part of the information.
- Response: we will respond promptly within a reasonable scope.
- The above does not apply where the law provides otherwise.
Article 8. Disclosure of the operator's name and address
We disclose these without delay upon request from the person whose personal information we handle, or from someone who uses or is considering using our services.
Article 10. For residents of the EU/EEA and the UK
- We respect the additional rights provided under the EU General Data Protection Regulation (GDPR) and UK data protection law.
- Residents of the EU/EEA and the UK have rights under applicable law including withdrawing consent to the processing of personal data, requesting data portability, requesting restriction of processing, and lodging a complaint.
- To exercise your rights under the law, please contact us through this form.
- Personal data of residents of the EU/EEA and the UK may be transferred outside the EU/EEA and the UK where necessary; we take appropriate safeguards when doing so.
- The above does not apply where the law provides otherwise.
Article 11. Revisions
The Policy may be revised in line with changes in the law or in our services. Important changes will be announced on this page or within the services.
Article 12. Enquiries and complaints
For enquiries or complaints about the handling of personal information, please contact us through this form, selecting “Enquiry or complaint about the handling of personal information” as the type of enquiry.