Privacy Policy

Synthera ("we" or "us") sets out this Privacy Policy (this "Policy") for the personal information of users ("Users" or "you") that we handle in the app "ToSche" (the "App"). [Summary of this Policy] • What we collect: your account information, what you enter (events, tasks, goals, and so on), your AI conversations, how you use the App, and similar information (Section 2). We do not collect your device's location or contacts. Images you select for AI are processed only after confirmation for each send. • How we use it: only to provide and improve the App, provide the AI Features, give support, prevent misuse, and similar purposes (Section 3). We do not sell your personal information or track you for advertising (Section 9). • AI Features: with your consent, we send what you enter to the AI and related data to Anthropic (United States of America), and voice input audio to Google (United States of America). You can withdraw consent at any time (Sections 4-2, 4-3, and 4-5). • Usage analytics: we send how screens and buttons are used to PostHog (United States of America). We do not send text you type or the content of your events. You can turn this off with "Help improve the app" in Settings (Section 5). • Storage: the database is in Japan (Tokyo region). Some data is also stored temporarily on your device (Section 6). • Your rights: you can ask for disclosure, correction, deletion, suspension of use, and more (Section 7). You can delete your data and your account from "Settings" (Section 8). • Contact: please use the contact point in Section 14.

1. Our Information

The business that handles your personal information is: Name: Synthera (Sole proprietorship (Japan)) Representative: Kiichi Tsukui Address: We will disclose it without delay upon request. Please contact support@synthera.jp. Email: support@synthera.jp Contact form: https://www.synthera.jp/contact

2. Information We Collect

We collect the following information in connection with providing the App: (1) Information you provide directly • Account information (email address and password) and the display name shown to other members of shared calendars • If you set up two-step verification, the registration information for your authenticator app (managed by our authentication infrastructure, Supabase) and your recovery codes (stored in a form that cannot be reversed) • Information we receive from Apple or Google when you sign in with them (an account identifier and your email address; with Apple, your name if you allow it; if you choose Apple's "Hide My Email", the relay email address Apple creates) • Content you enter (todos, deadline tasks (including their category, deadline date and time, steps, and repeat settings), schedules, routines, workspace settings, goals, notes, AI chat history, AI memory, the AI shared memo, etc.) • Calendar events (title, date and time, all-day and repeat settings, location, notes, label, color, and notification settings) and how each event was created (such as entered in the App, by the AI Features, or through an integration with an external AI service, including the name of that external AI service in the last case) • Event checklists (the text of each item and whether it is done), undated notes (title, text, and whether it is done), and which events have a day counter, including the identifier of the account that created or updated each of them • Names and colors of calendars and labels, and calendar display settings (first day of the week, holiday region, time zone) • If event comments were posted in earlier versions, we retain their text, dates and author account identifiers after posting is disabled. Members of a shared calendar can still view them. Deleting the event or calendar deletes them too. Account deletion deletes those in personal calendars; those in shared calendars with other members remain with the author shown as "Former member". Comment excerpts in activity history are deleted 30 days after the history entry is created (Sections 4-7, 6-2 and 8). • Events imported from the iPhone Calendar (title, date and time, whether all-day, time zone, location, and the color of the source calendar; notes only if you turn them on in settings; only if you turn importing on in the App on iPhone or iPad; see Section 4-8) • Text submitted to the AI assistant (used to interpret task-operation intent) • Audio recorded via voice input (sent for transcription; we do not store it on our servers) • What you send us in inquiries and bug reports (your email address and the message; bug report emails created from the App automatically include the app version, OS, and your account ID) • Your ratings of AI replies and your reports of AI replies (the category you chose, what you wrote, and a copy of the reported reply; Section 4-2 and Section 15-3 of the Terms of Service) • Records of integrations with external AI services (the name of each connected service, when it was connected and last used, and the names of API keys; Section 4-4) (2) Information collected automatically • An identifier used to match subscriptions (RevenueCat ID) • Device type, OS version, language setting, region code, time zone • App usage information (usage analytics such as screen changes and button taps; see Section 5) • Records of access to our servers (date and time, IP address, error records, and so on; records used for rate limits store IP addresses and similar values in a form that cannot be reversed) • Your age group for the AI Features ("18 or over" or "13 to 17") and, for people aged 13 to 17, when they agreed to the AI Features Terms requiring guardian consent (Section 10) • The country of your App Store or Google Play store (or your device's region setting if it cannot be obtained), used to handle data in line with the laws of each region (Section 15) • AI usage and cost metrics (for AI credit balance management) • Records of your consent (your agreement to the Terms of Service and this Policy, and the version of your consent to the AI Features; when you consented and withdrew; a value for checking the text shown on the consent screen; app version; device type) • Records for importing the iPhone Calendar (hash values for matching events and the dates and times of events, an identification number the App creates for each device, device type, app version, import settings, and when the last import ran and how many events it handled) and records of your consent to importing (Section 4-8) • Records for each item of AI memory (its type, where it was learned, the conversation it was learned in, when it was saved and updated, and when you consented to saving sensitive personal information; for memory learned automatically, the words of yours it was based on and the reply it was learned with) and your "Use memory" and "Learn automatically from chats and app use" settings (Section 4-2) (3) Subscription and payment-related information • Plan tier purchased, contract period, auto-renewal status • Purchase date, expiration date, cancellation date • Purchase status notifications via RevenueCat (matched using your account ID) • Records of AI Credits granted, used, and expired (amounts and dates) • Note: We do NOT directly collect or store credit card numbers, bank account numbers, or other payment credentials. These are processed solely by Apple's and each OS's payment infrastructure. (4) Information we do NOT collect • Location information (the "location" of an event is text you type; we do not collect your device's location; for how the IP address that reaches our usage analytics service, and the approximate region that may be estimated from it, are handled, see Section 5) • Access to contacts, the entire photo library, or camera (except images you select to send to AI) • Information about other apps on your device (however, if you turn on importing the iPhone Calendar in the App on iPhone or iPad, we collect the events in the calendars you choose as described in Section 4-8) • Advertising ID (IDFA)

3. Purposes of Use

We use collected information only for the following purposes: • Providing, operating, and improving the App • Switching features (rolling out new features gradually, and switching them back if a problem occurs) • User authentication and account management • Data sync, storage, and recovery • Providing calendar features (storing and showing events, showing repeating events, showing holidays, event notifications) • Importing and showing events from the iPhone Calendar (when you turn it on) • Delivering reminders via device notifications • Generating AI assistant and goal-coaching responses, and carrying out operations requested from the AI • Transcribing voice input • Providing integrations with external AI services (when you enable them) • Measuring AI usage and managing credit balances • Subscription management (purchase, renewal, cancellation, receipt verification) • Promotional code validation and benefit grant • Preventing fraud and maintaining security • Detecting, analyzing, and responding to incidents • Responding to user support inquiries • Sending important notices, such as revisions of the Terms of Service • Handling data in line with the law according to age and region (protecting minors, and handling health-related information of users in the United States) • Addressing violations of the Terms of Service • Responding to lawful requests from authorities • Continuing to provide the App when the business is taken over by another party

4. Disclosure to Third Parties

We do not disclose personal information to third parties without User consent, except in the following cases: • When required by law • When necessary to protect the life, body, or property of a person • When particularly necessary to improve public health or promote the sound development of children • When cooperation with national or local government bodies (or their delegates) is needed to perform statutory duties • When provided in connection with a business succession due to a merger, business transfer, or other reason (Section 20 of the Terms of Service) The transmissions described in Sections 4-2 to 4-4 are made based on your consent or your own actions. The basis for providing data to businesses in foreign countries is set out in Section 4-5.

4-2. Data Sent to a Third-Party AI Service

When you use the App's AI assistant and goal-coaching features (the "AI Features"), the following data is sent to a third-party AI model provider. [Recipient] Anthropic, PBC (a Delaware corporation, USA) Website: https://www.anthropic.com Privacy policy: https://www.anthropic.com/legal/privacy As this is a provision to a business in a foreign country (the United States), the country, its system, and the measures the company takes are set out in Section 4-5. Anthropic has stated publicly that AI processing (inference) may take place in facilities in the United States as well as in Europe, Asia, Australia, and elsewhere, and that data is stored in the United States. [Data sent] • Text you enter in the AI chat After confirmation for each send, 1 selected image is sent through Supabase to Anthropic (United States) to read schedules, tasks and other content. We do not access your entire photo library or camera. Images are resized and converted to JPEG on your device and use your AI allowance. ToSche does not save the image itself in chat history or storage, but saves extracted content and replies as part of the conversation. Temporary device copies are removed after processing. Anthropic retention, processing and international transfer terms are described in Privacy Policy Sections 4-2 and 4-5. Do not attach content you have no right to share, including other people’s personal information. • Information the AI reads in order to answer or carry out an operation, such as tasks, deadline tasks, schedules, calendar events, routines, and goals (titles, dates/times, contents, etc.; for deadline tasks, this includes their category (such as the class name), deadline date and time, steps, and repeat settings; for calendar events: title, date and time, all-day and repeat settings, location, notes, and label, for the period the AI judges necessary) • The names of calendars and labels (when the AI reads events or chooses the calendar to add an event to). In addition, for shared calendars whose event details you let the AI see, the members' display names and roles are also sent (shared calendars you created let the AI see event details by default; see Section 4-7, paragraph 6). For other shared calendars, only the number of members and their roles are sent. When you ask the AI about a shared calendar's members or invitations, the display names and roles of that calendar's members (including a number that tells members apart and when they joined) are sent. Members' email addresses are never sent • Events imported from the iPhone Calendar (Section 4-8). As with events in other calendars, the events the AI reads in order to answer or carry out an operation are sent. The names of your iPhone Calendar calendars are not sent • AI memory (facts the AI has saved to remember, grouped by type: "Notes for the AI", "Nicknames & shorthand", "School, work & hours", "Daily rhythm", "Preferences", "People", "Goals & why" and "Other"; items of sensitive personal information saved with your consent are marked as such; the words of yours that memory learned automatically was based on are not sent; not sent while "Use memory" is off) and the AI shared memo (assumptions and instructions you wrote in Settings) • In goal-setting chats (version 2.9.0 and later; held in AI assistant conversations and grouped under "Goal-setting chats" in the history), the following is also sent, whether or not the AI reads it: the goal being discussed (its level, title, period, description and whether it is achieved) and the titles of the goals above and below it; the goal's roadmap steps (up to 15: title, target date and whether each is done); the tasks linked to the goal (the numbers of open and completed tasks, and the titles and deadlines of the 5 open tasks with the nearest deadlines); and summaries of earlier chats about that goal and of the goal-coach conversation from versions earlier than 2.9.0 (the conversation title and date, an excerpt of the last reply and a record of the actions the AI took). When you start a goal-setting chat without choosing a goal, your active goals (up to 12: level, title, end of period and progress of steps) and summaries of your recent goal-setting chats are sent • To organize AI memory automatically (version 2.9.0 and later; see [AI memory]), when you use words such as "from now on" in a conversation, the following is sent after the reply: the sentences of your message that contain such a word and the sentences around them (up to 800 characters), up to the first 600 characters of the AI's previous reply, your current "Notes for the AI" and preferences, and the names of your other memory items. When you choose "Have the AI watch out for this next time" in a rating, the reasons you chose and what you wrote, up to the first 600 characters of the rated reply and up to the first 400 characters of your message just before it are sent. In AI assistant conversations, patterns counted from how you use the App (for frequently used event and time-block titles, how many times they were used and their usual color, and the names of labels and calendars) are also sent (this count is not stored; events in shared calendars, imported events and events created by Connected Services for external AI services are not counted) • If you are aged 13 to 17, the fact that you are aged 13 to 17 (sent together with safety instructions for minors; see Section 10) • Recent chat history to maintain conversation context • Your device's time zone and the App's language setting • Search terms, when the AI uses web search (the AI writes them from the conversation). Search terms are sent through Anthropic to the search service it uses, and the search results are used only to answer you. Search terms and results are also handled as described under [Handling by Anthropic] in this Section [Data NOT sent] • Passwords, auth tokens, payment information • Location, contacts, unselected photos, camera data • App data that the AI did not read in order to answer or carry out an operation (except what this Section says is sent with each conversation, such as AI memory, the AI shared memo, the information sent in goal-setting chats, and patterns of how you use the App) [Purpose] The data is used only to generate AI responses and to carry out the operations you request (such as creating, changing, or deleting tasks and events, adding steps and repeating deadline tasks, creating, changing, or deleting goals and steps, and saving AI memory), and to organize AI memory automatically (recording your requests from your messages and ratings). [Handling by Anthropic] Anthropic, PBC has stated publicly that it does not use data received via its API to train its AI models, and that it deletes the inputs and outputs it receives, as a rule, within 30 days. However, it has also stated that if a violation of its usage policies is detected automatically, inputs and outputs may be kept for up to 2 years and the results of its classification for up to 7 years. We use Anthropic's API under our contract with it (its commercial terms and the data processing addendum). The settings and terms of the Claude apps Anthropic offers to the public do not apply to the App's AI Features. Please see Anthropic's privacy policy and related documents for details. [Storage by us] We store the text of your AI conversations (your input and the AI's replies) and conversation titles on our servers until you delete the conversation or delete your account. So that a reopened conversation shows what happened, we also store, with each reply, a record of the actions the AI took (the action name, whether it succeeded, and a summary such as the title and date/time of an event or task it created or changed; for actions that only read data, just the count and a summary), the web search terms (depending on the app version), the title, URL and a short quote of the web pages used as sources or consulted for the answer, and a mark when a reply was stopped partway. We do not store the data the AI fetched only to read it (such as a list of events it looked at) or the body of the web pages in search results. If you rate a reply (good or bad), we store your rating, the reasons and any comment with that reply; we read ratings together with the rated reply and your message just before it to improve the quality of the AI's replies, and do not use them to train AI models. All of this is deleted together with the conversation or your account. You can delete conversations individually from the history in the AI screen, or all at once from "Delete chat history" in Settings. How AI memory is saved and deleted is described under [AI memory] below. If you choose "Have the AI watch out for this next time" when rating a reply, in addition to storing the rating as above, a "Notes for the AI" item is made from the reasons and comment and saved to AI memory as described under [AI memory] (in this case, the reasons, comment and related text are sent to Anthropic). For conversations used for goal setting, so that they can be sent to the AI in the next goal-setting chat as described above, we store a summary of the conversation (up to the first 300 characters of the last reply and a record of up to the 5 most recent actions the AI took on goals, steps and tasks) and which goals the conversation is about (the links between the conversation and goals, and what made each link and when). These are deleted together with the conversation. When you delete a goal, its links are deleted too. We also store this summary for goal-coach conversations in versions earlier than 2.9.0. In version 2.9.0 and later, even if you close the App or switch to another app while the AI is writing a reply, our servers finish the reply and save it in the conversation. So that the rest can be shown when you come back, the partial reply is saved temporarily in the conversation every few seconds while it is being written and is replaced with the finished reply (it is erased if no reply is kept). If you tap the stop button during a reply, we store on our servers a mark that tells which reply to stop (the IDs of the conversation and of your message, and when you asked to stop), and stop the reply. The mark is erased when the reply ends, and any mark that could not be erased is deleted together with the conversation or your account. In versions earlier than 2.9.0, closing the App during a reply may stop the reply. [AI memory] From what you say in conversations and what the AI has checked with you (such as class period times or the last day of a term that the AI looked up on the web), the AI saves as AI memory on our servers the facts that help plan your future events and tasks (such as your school or work, class or shift times, what the nicknames you use mean, your daily rhythm, preferences, and the background of your goals). We instruct the AI to save, without asking, only the name and relationship of people close to you, to check with you before saving something it inferred, and not to save anything because a request written in web search results, event notes or the like asks it to. For each item of AI memory, we store its content, type, where it was learned (a conversation with the AI, learned automatically from a conversation or a rating, the goal coach in versions earlier than 2.9.0, a Connected Service for external AI services (Section 4-4), or written by you), the conversation it was learned in, and when it was saved and updated. Deleting the conversation it was learned in does not delete the memory. AI memory holds up to 60 items, each up to 300 characters ("Notes for the AI" can hold up to 20 more items separately). If the AI learns something new when memory is full, an item in the same group ("Notes for the AI" or the rest) is removed: first an item learned automatically, then an item the AI saved, with the oldest update (items you wrote yourself and sensitive personal information saved with your consent are never removed). In version 2.9.0 and later, only when you use words such as "from now on", "always" or "don't" in a conversation, your message and part of the previous reply (this Section, [Data sent]) are sent to Anthropic after the reply, and what you asked the AI to do or pointed out (such as the length of replies or whether to check with you before creating events), preferences and facts are extracted and saved to AI memory automatically. Only your own messages are used (anything written only in the AI's replies, event titles and the like is checked by our servers and not saved), and one-off requests are not saved. For each item learned automatically, we store the words of yours it was based on (up to 120 characters) and the reply it was learned with, and show them in "What AI remembers" (these words are not sent to the AI). When you choose "Have the AI watch out for this next time" in a rating, one "Notes for the AI" item is made from the reasons you chose and what you wrote and saved (if you wrote nothing and the only reason is "Too long" or "Too short", nothing is sent to Anthropic and a fixed sentence is saved). This is not training of AI models but saving to your own AI memory. There is a daily limit on how many times memory is learned automatically. When the AI learns automatically, the reply also shows "Memory updated" or a similar notice so that you can undo it. If you turn off "Learn automatically from chats and app use" in "What AI remembers", nothing is learned automatically (you can still ask the AI to remember things). This automatic learning is being rolled out gradually (until it is available to you, nothing is learned automatically and the data described in this paragraph is not sent). In AI assistant conversations in version 2.9.0 and later, how many times frequently used event and time-block titles were used and their usual colors are counted from how you use the App each time and sent to the AI (this Section, [Data sent]), and the usual color is used for events whose color you did not specify. This count is not stored and is not added to AI memory. In version 2.9.0 and later, when the AI saves, changes or deletes memory, the reply shows "Memory updated" or a similar notice so that you can undo it. To allow undoing, the changed memory (including what it was before; up to 5 items) is stored with that reply in the conversation. This record remains until you delete the conversation, even if you delete the memory. In version 2.9.0 and later, you can view the list of memory and correct, add or delete items in "Settings" → "What AI remembers" (you can also open it from the history in the AI screen and from "AI & Privacy"). If you turn "Use memory" off, memory is not sent to the AI Features and nothing new is saved while it is off (existing memory is kept, not deleted). You can delete all memory with "Reset AI memory" on the same screen. Versions earlier than 2.9.0 do not have the "What AI remembers" screen; you can delete all memory from "Reset AI memory" in Settings. While "Use memory" is turned off on a device with version 2.9.0 or later, the AI Features do not use memory or save anything new for the same account, even in versions earlier than 2.9.0. [Sensitive personal information] Sensitive personal information (such as medical history, hospital visits or medication, disability, religion, political views, criminal record or being a victim of crime, and race or ethnicity) and information that needs particular care, such as sexual orientation, gender identity or trade union membership, is saved to AI memory only if you clearly ask the AI to remember it and tap the consent button shown in the App (including when you write it yourself in "What AI remembers" and tap the consent button). When it is saved, we record when you consented. When the AI tries to save such information, our servers check the content, and if they judge that it is such information, they show the consent button instead of saving it, and save it only when the button is tapped. Because this check is based on words and phrases, such information may not be recognized. You can check and delete saved memory at any time as described under [AI memory]. Memory saved with your consent is sent to Anthropic each time you later use the AI Features, like other memory (for how the recipient handles it and for the provision to a business in a foreign country, see this Section and Section 4-5). It is not passed to Connected Services for external AI services (Section 4-4). Passwords, PINs, card or bank account numbers, My Number (Individual Number) and the like are not saved to AI memory even with consent (they are recognized in the same way as above). Versions earlier than 2.9.0, Connected Services for external AI services and automatic learning (see [AI memory]) have no consent button, so when something is saved from them, our servers do not save it if they judge it to be such information. For people aged 13 to 17 (Section 10) and people whose App Store or other store country is the United States (Section 15), this information is not saved to AI memory (the consent button is not shown either). How we judge whether something falls under this is the same as above. [Consent and withdrawal] Before the App first sends data to the AI Features (before you send an AI chat message or start recording voice input; for voice input in versions 2.3.2 and earlier, see Section 4-3), we show you the scope of the data to be sent (including calendar events) and the information in Section 4-5 on providing data to businesses in a foreign country (the United States), and obtain your explicit consent. If you consented in an earlier version, we will ask again, showing that calendar events have been added. We record when you consented and the consent version on your device and on our servers. You can withdraw consent at any time from "AI & Privacy" in Settings. Once withdrawn, you cannot use the AI Features or voice input until you consent again, and this data is not sent. We also record when you withdrew. Even if you do not consent or withdraw consent, all features other than the AI Features and voice input (calendar, workspace, schedules, routines, statistics, etc.) remain available. In versions earlier than 2.4.0, consent is recorded only on your device, and there is no screen for withdrawing it in the App. [Protection] Data is transmitted encrypted via TLS (HTTPS).

4-3. Data Sent to a Speech Recognition Service

When you use the App's voice input (the microphone in the input fields of the AI assistant and the goal coach), the following data is sent to a third-party speech recognition service. [Recipient] Google LLC (USA) — Google Cloud Speech-to-Text Privacy policy: https://policies.google.com/privacy Audio is processed mainly at a processing location in the United States (if that location is unavailable, it may be processed using a method that does not specify a processing location). As this is a provision to a business in a foreign country (the United States), the country, its system, and the measures the company takes are set out in Section 4-5. [Data sent] • The audio you record (each recording is at most 55 seconds) • The recognition language setting (Japanese or English) [When it is sent] After you consent to the AI Features (Section 4-2), the audio is sent when you stop recording with the microphone button (or when the recording reaches the 55-second limit). Before you consent, the App neither asks for microphone permission nor records. If you leave the screen while recording, the recording is discarded without being sent. [Purpose] Used solely to convert speech to text. The App does not use AI to tidy up or summarize the resulting text. The resulting text is placed in the input field and is not sent to the AI until you send it (once sent, it is handled as described in Section 4-2). [Storage] We do not store the audio or the transcription on our servers (we may record the length of the recording to measure AI usage). The temporary recording file on your device is erased after the audio is sent and when you stop recording (version 2.9.0 and later; in earlier versions, a temporary file may remain in the temporary storage area on your device). Google has stated publicly that unless the customer turns on data logging (a setting that lets Google use audio to improve its services), it does not log audio or transcriptions. We have not turned on data logging. [Consent] Before you use voice input, in addition to the consent in Section 4-2, your device's OS (iOS / Android) asks for permission to access the microphone. Without both, voice input is not available. [Versions 2.3.2 and earlier] Versions 2.3.2 and earlier differ from the above as follows: • In the AI assistant (and, in some older versions, also in the goal coach), you can use voice input even before the consent in Section 4-2, as long as the OS has granted microphone permission. • When a recording reaches the 55-second limit, recording does not stop; the audio so far is discarded without being sent, and recording starts over. If you leave the screen while recording, recording does not stop and the microphone stays open. • In the AI assistant, when you return to the screen and stop recording with the microphone button, the recording at that point (at most 55 seconds) is sent. This recording may include audio from while you were away from the screen. In the goal coach, recordings made after you leave the screen are not sent.

4-4. Integrations with External AI Services

If you connect the App to an external AI service such as Claude (Anthropic) or ChatGPT (OpenAI) (a "Connected Service") from "AI Integration (Claude / ChatGPT)" in the "AI Integration" section of Settings, the Connected Service can read, write, and delete your App data within the scope you allow. [Data a Connected Service can handle] • Goals: view, create, delete; roadmap steps: view, add, update, delete • Deadline tasks (including their category and deadline date and time) and today's tasks (workspace tasks): view, create, update, complete, delete • Steps of deadline tasks: view, add, update, delete, reorder; repeating deadline tasks (the same task created for each occurrence over a period at a set frequency; up to 150 occurrences): create, change, end (a Connected Service connected, or an API key created, before this revision cannot handle these; to use them, connect it again or create a new API key) • The list of workspaces (grids) and the names you gave to each area: view (when reading the area names for a day that has no workspace yet, a workspace for that day is created, carrying over your most recent area names) • Schedules (entries on the pie chart): view, create, update, delete. "My Schedule" (time blocks) on the calendar screen is these schedules. Therefore, even a Connected Service that has not been allowed the calendar permissions in the next item can view, create, update, and delete entries in "My Schedule" • Calendar events: view, create, change, delete, and view calendar names and shared calendars' members' display names and roles (including when they joined; never members' email addresses; only if you allow calendar permissions when connecting; a Connected Service connected before this revision cannot handle calendar events until you connect it again or switch its permissions; for "My Schedule", see the previous item) • Routines: view, add, update, delete, and record completions • AI memory (including each item's type and where it was learned) and the AI shared memo: view, save, rewrite, delete. However, a Connected Service cannot save sensitive personal information (Section 4-2) to AI memory, and items of sensitive personal information you saved with your consent are not passed to Connected Services. While "Use memory" is off, Connected Services can neither read nor save AI memory • Your account's email address and language setting: view We instruct the Connected Service's AI to show you what it is about to do (for repeating deadline tasks, the dates and the number of occurrences) and get your approval before deleting goals, roadmap steps, deadline tasks, today's tasks, schedules, or routines, and before creating, changing or ending repeating deadline tasks. There is no such confirmation step for deleting or rewriting steps of deadline tasks, AI memory or the AI shared memo. [Handling by the Connected Service] Data passed to a Connected Service is handled under that service's terms and the settings you have made in that service (for example, whether conversations are used to train AI depends on your settings there). "Handling by Anthropic" in Section 4-2 describes the API we use for the AI Features and does not apply to an AI service you use as a Connected Service. • Anthropic (Claude): https://www.anthropic.com/legal/privacy • OpenAI (ChatGPT): https://openai.com/policies/privacy-policy [Disconnecting] To stop an integration, remove the connection in "Settings" → "Connected apps", or remove the App in the Connected Service's settings (versions earlier than 2.9.0 do not have "Connected apps"). Changing your password revokes the permissions of Connected Services you connected by signing in. Connections made with an API key are not revoked, so revoke the key in "Connected apps" or "AI Integration (Claude / ChatGPT)". An authorization that is no longer used expires within 30 days at most. Connected Services we have not verified are marked as such in "Connected apps".

4-5. Provision of Personal Data to Third Parties in a Foreign Country

For the purposes set out in this Policy, we provide personal data (including entrusting its handling) to businesses in foreign countries. The basis for each recipient is as follows. [Provided with your consent] • Anthropic, PBC (United States of America): information sent to the AI Features (Section 4-2). Provided after you consent to the AI Features (Section 4-2) • Google LLC (United States of America): voice input audio (Section 4-3). Provided after you consent to the AI Features (Section 4-2) • PostHog, Inc. (United States of America): usage analytics information (Section 5). Provided after you agree to the Terms of Service and this Policy when you first use the App (in versions 2.3.2 and earlier, sending starts before that agreement; see Section 5) • Cloudflare, Inc. (United States of America): relaying traffic for integrations with external AI services (Section 4-4). Provided after you agree to the Terms of Service and this Policy when you first use the App When we ask for your consent, we show the following information (Article 28, paragraph 2 of the Act on the Protection of Personal Information). (1) Name of the country of the recipients • United States of America (Anthropic, PBC; Google LLC; PostHog, Inc.; Cloudflare, Inc.) (2) The system for protecting personal information in the United States of America According to the "Survey on Systems for the Protection of Personal Information in Foreign Countries" by Japan's Personal Information Protection Commission (the "Commission"): • At the federal level, the United States has no comprehensive law on the protection of personal information; instead, there are laws for specific sectors (such as electronic communications, finance, and health care). • State laws include the California Consumer Privacy Act (CCPA), which applies to businesses that meet conditions such as annual revenue. According to the Commission's survey, the CCPA has no provision corresponding to the "Accountability Principle" among the 8 principles of the OECD Privacy Guidelines, and has provisions corresponding to the other 7 principles. • The United States has not received an adequacy decision from the EU. It has participated in the APEC Cross-Border Privacy Rules (CBPR) System since July 25, 2012. • The Commission's survey does not list any system that may significantly affect the rights and interests of individuals (such as a system requiring businesses to store personal information within the country, or obliging businesses to cooperate with government information gathering). • The Commission treats participation in the APEC CBPR System as one indicator that protection of personal information broadly equivalent to Japan's can be expected (the CBPR System covers private-sector businesses). • This information is based on the survey the Commission conducted as of October 2021. The Commission notes that the survey covered only selected laws and is not exhaustive. The system may also have been revised since then. • Personal Information Protection Commission of Japan, "Survey on Systems for the Protection of Personal Information in Foreign Countries" (in Japanese): https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku • United States (federal): https://www.ppc.go.jp/files/pdf/USA_report.pdf • United States (California): https://www.ppc.go.jp/files/pdf/california_report.pdf (3) Measures taken by the recipients to protect personal information • Anthropic, PBC: our contract terms (its Commercial Terms of Service and the Data Processing Addendum (DPA) incorporated into them) provide that it processes data in line with our instructions, does not use the data it receives to train AI models, takes security measures, imposes equivalent obligations on its subprocessors, assists with requests from individuals, and deletes the data within 30 days after the contract ends (https://www.anthropic.com/legal/data-processing-addendum). • Google LLC: our contract terms (the Cloud Data Processing Addendum incorporated into the Google Cloud agreement) provide that it processes data in line with our instructions, takes security measures, assists with requests from individuals, and deletes the data within 180 days at most after the contract ends (https://cloud.google.com/terms/data-processing-addendum). • PostHog, Inc.: it publishes, as the terms of the Data Processing Addendum (DPA) it concludes with customers, that it processes data in line with the customer's instructions, takes security measures, assists with requests from individuals, and deletes or returns the data when the contract ends (https://posthog.com/dpa). • Cloudflare, Inc.: it publishes, as the terms of its Data Processing Addendum (DPA) with customers, that it processes data in line with the customer's instructions, takes security measures, imposes equivalent obligations on its subprocessors, assists with requests from individuals, and deletes or returns the data after the contract ends (https://www.cloudflare.com/cloudflare-customer-dpa/). The above is what we confirmed from the contract terms and documents each company publishes. We have not audited the measures each company takes. [Provided to businesses that have a system meeting the required standard] • Supabase Pte. Ltd. (Republic of Singapore): database, authentication, and server-side processing. The database is located in Japan (Tokyo region) (Section 6). Our contract: the Data Processing Addendum (DPA) incorporated into its Terms of Service • RevenueCat, Inc. (United States of America): your account ID and purchase status, to match subscriptions. Our contract: the Data Processing Addendum (DPA) incorporated into its Terms of Service • Plus Five Five, Inc. (Resend) (United States of America): authentication email recipients, message content including a code or recovery link, and delivery records (Section 5). Our contract: the Data Processing Addendum incorporated into its Terms of Service (https://resend.com/legal/dpa) Under these contracts, each business undertakes to process data in line with our instructions, take security measures, impose equivalent obligations on its subprocessors, assist with requests from individuals, and delete or return the data after the contract ends. On this basis, we have judged that each of them has a system for continuously taking measures equivalent to those that businesses are required to take under Japan's Act on the Protection of Personal Information, and we provide data to them accordingly (Article 28, paragraph 1 of the Act; Article 16 of the Enforcement Rules of the Act). We periodically check that each business continues those measures and whether the country where it is located has any system that may affect them. If a problem arises with those measures, we take the necessary steps, and if it becomes difficult for the measures to continue, we stop providing data. You can ask us for information about the measures we take for this purpose (Article 28, paragraph 3 of the Act). Please contact us at the contact point in Section 14. [Integrations with external AI services] Most Connected Services in Section 4-4 are also U.S. businesses. Data is passed to a Connected Service only when you connect it yourself and give it instructions. How a Connected Service handles data is governed by its terms, as described in Section 4-4.

4-6. Siri and Shortcuts (iPhone)

1. From Siri, the Shortcuts app, Spotlight, and the Action button on iPhone, you can add events to your calendar and hear your events, time blocks, and today's tasks read out (iOS 17 or later). These are available when you turn on "Siri" in Settings. 2. What you say to Siri (such as event titles and dates and times) and what Siri reads out or shows (the titles and times of events and time blocks, the names of today's tasks and how many are done, and the number of assignments with deadlines) are processed by Apple Inc. (United States of America) as part of Siri, and Apple's privacy policy applies to that handling. We do not receive the audio of what you say to Siri. 3. To read these out, the App stores sentences made from the titles and times of your events and time blocks from today until 7 days later, the names of today's tasks and how many are done, and the number of assignments with deadlines, on your device (in an area that only the App and its Siri extension can read). They are not sent to our servers. When you turn "Siri" off or sign out, they are replaced with sentences that contain no titles or similar content. 4. So that events can be added without opening the App, when you turn on "Siri" the App creates a Siri-only key that can only add and view calendar events, and stores it in your device's keychain (it is not included in iCloud Keychain or backups). On our servers, as with the API keys in Section 4-4, we store only a hash of the key. The key is used only to authenticate communication with our servers when you add an event from Siri. When you turn "Siri" off or sign out, it is erased from your device and turned off on our servers. You can also create a new key or turn off the key from "Siri" in Settings. 5. Events added from Siri are stored on our servers in the same way as events added in the App, together with a record that they were created with the Siri-only key. 6. When there is no key, when there is no connection, and in similar cases, the App opens and shows the event entry screen filled in with what you said to Siri. No event is added until you save it.

4-7. Sharing calendars

1. In the App, you can create a shared calendar and let other users you invite (members) join it. The events in a shared calendar (title, date and time, location, notes, labels, etc.), their checklists, the calendar's undated notes, the calendar's name and color, and the members' display names and roles can be seen by all members of that calendar. Events in calendars you have not shared (such as My Calendar) are not shown to other users. 2. Invitations use an invitation code (or a link containing it). Anyone who learns the code can join, so give it only to the people you want to join. An invitation code expires after 7 days, and up to 10 people can join with the same code. The user who created the calendar can turn off invitations at any time. We do not store the invitation code itself on our servers, only a value used to check it. 3. Other members see only the display name you set yourself. We do not show the name or email address you use to sign in. 4. A member's role is either "Can edit" or "View only". The user who created the calendar can change roles and remove members. When a member is removed, all active invitation codes for that calendar are turned off. Members can leave a shared calendar at any time. After leaving, the calendar's events are no longer shown to them, but events they created before leaving remain in the shared calendar. Only the member who created an event, and the user who created the calendar, can move that event out of the shared calendar into a calendar that is not shared. 5. If the user who created a shared calendar deletes it, the calendar and its events are deleted for all members. If the user who created the calendar deletes their account and other members remain, the calendar passes to the earliest member who joined with "Can edit" (or, if there is none, the earliest member who joined), and its events remain. If no other members remain, the calendar and its events are deleted. 6. When the AI features (4-2) are used with a shared calendar, the following information about that calendar is sent (email addresses are never sent). For the user who created the calendar, by default the AI features receive the titles and other details of the calendar's events (including events other members created) and the members' display names and roles. The creator can change this in the shared calendar's settings under "What your AI can see". For a member who joined, we initially send only the times of events other members created (that there is an event), not their titles or other details (events the member created themselves are sent with their details). If a member lets the AI see the event details, then within the limit the creator allows under "What members' AI can see", the events' titles and other details and the other members' display names and roles are also sent. 7. In a shared calendar, we store on our servers a record of members adding, changing or deleting events, and joining or leaving (including who did it, when, and a copy of the event's title and date), so that the calendar's members can see it under "Activity". We delete this record after 30 days. Members cannot see records from before they joined. For each event, we also show the display names of the member who created it and the member who last changed it. 8. By default, reminders that other members set on events in a shared calendar also go off on your device. You can turn this off for each calendar in the shared calendar's settings.

4-8. Importing the iPhone Calendar (iPhone and iPad)

1. In the App on iPhone and iPad (version 2.7.0 and later), only if you turn importing on in "Settings" → "Import from iPhone Calendar" and allow access to your calendars in iOS (Full Access on iOS 17 and later), the App reads the events in the calendars you choose from your device's calendars (the "iPhone Calendar") and imports them into the App. At first, only the calendar iOS adds new events to (the calendar Siri adds events to) is selected. Birthday calendars cannot be selected and are not imported. iOS requires Full Access for an app to read events, but the App never creates, changes or deletes events in the iPhone Calendar (the iPhone Calendar screen the App opens is view-only, too). 2. The App imports events from 14 days before today to 365 days after today (for repeating events, occurrences up to 60 days after today), up to 2,000 events at a time, nearest to today first. It imports each event's title, date and time (including whether it is all-day and its time zone), location, and the color of its calendar. Notes are imported only if you turn on "Also import notes". Repeating events are imported as a separate event for each occurrence, not as repeat settings. URLs, attendees and organizers, alert (alarm) settings, location coordinates, and the names of your iPhone Calendar calendars are not imported. Cancelled events and invitations you declined are not imported either. While "Skip events that are already in ToSche" is on (it is on by default), events that already exist in the App with the same title and the same start and end times are not imported. 3. Imported events are stored on our servers as events in your own private calendar "iPhone" ("iPad" if you started on an iPad) in the App. This calendar cannot be shared and is not shown to other users. Events are never imported into shared calendars. Imported events are also shown on your other devices signed in to the same account (including Android). Events with a time are shown as pale overlays on the schedule pie chart (they are not saved as time blocks in "My Schedule"). Whether an event is shown in the month calendar follows the rule you choose (by default: all-day events, events that span midnight, and events of 2 hours or longer). 4. Imported events are view-only in the App and cannot be changed or deleted there. Change or delete them in the iPhone Calendar; the change is reflected in the App the next time events are imported. However, changes to and deletions of events from about 14 days before today or earlier may not be reflected, and such events remain in the App until you turn importing off. If an imported event is changed in a version of the App earlier than 2.7.0 (including moving it to another calendar), that event is no longer synced with the iPhone Calendar and remains as an event in the App. If it is deleted in a version earlier than 2.7.0, it is not imported again while it remains in the iPhone Calendar (it is imported again if you turn importing off and then on). The App does not send notifications for imported events (notifications from the iPhone Calendar still arrive). 5. Events are imported when you open the App, when you return to it, when the iPhone Calendar changes while the App is on screen, and when you refresh. Nothing is imported while the App is closed. 6. To match imported events with events in the iPhone Calendar, we store on our servers hash values made from the identifiers of iPhone Calendar events and calendars and from event titles and dates and times, mixed with a value that differs for each account, together with the date and time of each event. The identifiers themselves are not sent to our servers. For events deleted in the App and events not imported because they already exist in the App, we also keep these values until you turn importing off, so that they are not imported again. The names of your iPhone Calendar calendars are stored only on the device that imports them and are not sent to our servers (other devices show just "iPhone"). To tell importing devices apart, we also store an identification number the App creates for each device, the type of device (iPhone or iPad), and the App version. The device name is not sent. Importing is done on one device per account. 7. Like events in your other calendars, imported events may be read by the AI Features (Section 4-2) to answer or carry out an operation, and sent to Anthropic. By default, the AI can read the details of the events (title, date and time, location, and notes if imported). A Connected Service you allowed calendar permissions (Section 4-4) can also read imported events. Neither the AI Features nor Connected Services can change or delete imported events (if you ask them to delete the "iPhone" calendar itself, the imported events are deleted too and importing stops). If you choose "Nothing" for "What your AI can see" in "Import from iPhone Calendar", the AI Features and Connected Services do not read the details of imported events, and use only the times that are busy when looking for free time. 8. You can turn importing off at any time from "Settings" → "Import from iPhone Calendar". When you turn it off, we delete from our servers the events being imported (the imported events in the "iPhone" calendar; as described in paragraph 4, events changed in a version of the App earlier than 2.7.0 remain as events in the App) and the values described in paragraph 6. The "iPhone" calendar is deleted if nothing else is in it; otherwise it stays as a calendar in the App. Events in the iPhone Calendar stay as they are. When you change which calendars to import, events imported from calendars you removed are also deleted from the App. If you revoke the App's access to your calendars in iOS Settings, importing stops and the imported events remain in the App as they were at that time (to delete them, turn importing off in the App). When you delete your account, the imported events and the values described in paragraph 6 are also deleted. 9. When you turn importing on, we store on our servers a record of your consent to the explanation shown (the consent version, the date and time, a hash value made from the text shown, the App version, and the type of device), and when you turn it off, we record when you withdrew. When you sign out, the import records on the device (such as the names of your iPhone Calendar calendars) are erased. The events imported to our servers remain, and when you sign in again with the same account, you can choose to continue importing or turn it off.

5. Service Providers

To the extent needed to provide the service, we entrust data handling to the following service providers: • Supabase (database, authentication infrastructure, Edge Functions, data storage) • Resend (authentication email delivery) • Apple (App Store distribution, subscription payment processing, Apple ID authentication) • Google (OAuth authentication, voice recognition [Google Cloud Speech-to-Text]) • Anthropic (generating AI assistant replies and organizing AI memory automatically [Claude models]) • RevenueCat (subscription state synchronization and verification) • Cloudflare (publishing legal documents, relaying traffic for integrations with external AI services) • PostHog (product analytics and usage statistics [USA, us.i.posthog.com]) Each provider handles data in accordance with its own privacy policy. References (for your information): • Supabase: https://supabase.com/privacy • Resend: https://resend.com/legal/privacy-policy • Apple: https://www.apple.com/legal/privacy/ • Google: https://policies.google.com/privacy • Anthropic: https://www.anthropic.com/legal/privacy • RevenueCat: https://www.revenuecat.com/privacy • PostHog: https://posthog.com/privacy [Information sent to PostHog] To understand how the App is used and improve it, and to switch features (Section 3), the App sends the following to PostHog. Sending starts after you agree to the Terms of Service and this Policy when you first use the App (for the recipient's country and related information, see Section 4-5). • Events such as app launches, screen changes, sign-ins, paywall views, the start and result of purchases, and the start of AI feature use, with their date and time • When the App is opened from a link, the URL of that link (the parts of the URL after "?" and "#", and IDs contained in the URL, are not sent) • Screen names (names for the type of screen, e.g. "ai" or "schedule"; IDs of workspaces or schedules are not included) • When you tap a button or other element: the type of element (its component name and any identifier developers attached to it) and the tap position (screen coordinates) • The number of characters in a message sent to the AI (not the message itself) • Actions on the AI memory screens (opening the screen; adding, editing, deleting or resetting memory; turning "Use memory" and "Learn automatically from chats and app use" on or off; opening or undoing a memory-update notice, including one for memory learned automatically), with the type of memory involved (the name of the type, such as "Preferences"), the number of items, what it was learned from automatically (a conversation or a rating), the result of an undo, and whether you chose "Have the AI watch out for this next time" in a rating (not the content of the memory) • The plan and billing period you tried to purchase • Your account ID (a random ID issued by Supabase; not your email address) • Device model and manufacturer, OS and its version, app version, language and region settings, time zone, and screen size In addition, as part of how network communication works, PostHog receives your device's IP address, and PostHog records it. PostHog may estimate your approximate region (such as country and city) from the IP address. We do not send your device's location. We do not send PostHog any text shown on screen or typed by you (task names, schedule names, calendar names, goals, questions to the AI or the text of conversations, the content of AI memory, email addresses, passwords, etc.), or authentication information contained in link URLs (such as the temporary authentication information in a password reset link). We do not record the screen (session replay) (for versions 2.3.2 and earlier, see below). If you turn off "Help improve the app" in "Settings", sending to PostHog from that device stops (version 2.9.0 and later; information already sent is not deleted; if you would like it deleted, please contact us at the contact point in Section 14). Information sent to PostHog is kept for the period set by PostHog's service for our plan (1 year or 7 years). [Information sent to Resend] Our authentication service sends your email address and the message containing a code or recovery link to Resend (Plus Five Five, Inc., United States) to deliver authentication emails, including sign-in, identity verification, and password recovery. We do not send events, tasks, or AI conversations. Delivery times and results are recorded. Sending uses the Tokyo region, but processing and storage also occur in the United States. We do not use open or click tracking. Our current plan retains emails and logs for 30 days; separate records may remain where needed for abuse prevention or legal obligations. See Section 4-5 for the transfer basis. [Information sent to RevenueCat] To confirm purchases and check the status of Paid Plans, the App sends RevenueCat your account ID, purchase information (the product, the date and time, and the App Store purchase record), your device's OS and app version, and similar information. As part of how network communication works, your device's IP address also reaches RevenueCat. We do not send your name or email address. We also use RevenueCat to summarize and analyze purchases, renewals, cancellations, and revenue to improve the plans we offer. [Versions 2.3.2 and earlier] Versions 2.3.2 and earlier differ from the above as follows: • Sending starts when you first launch the App, even before you agree to the Terms of Service and this Policy. • When the App is opened from a link while it is not running, the URL of that link is sent as is. If you open the App from the link in a password reset email, this URL contains temporary authentication information for resetting your password. • When you tap a button or other element, the text shown at that spot (task names, schedule names, parts of AI conversations, etc.) and its accessibility label may be sent. • Screen names may include IDs, such as the ID of the workspace being shown. • Your approximate region (such as country and city) estimated from your IP address may be recorded in PostHog together with the events sent. • They include a screen recording (session replay) feature. Recordings black out input fields, but task names, schedule names, and other text shown on screen are not blacked out.

6. Data Storage

1. User data is stored on cloud infrastructure (Supabase) we use. The database is located in Japan (Tokyo region). 2. The main retention periods are as follows: • Account, todos, deadline tasks, schedules, calendar events and labels, event checklists, undated notes, routines, goals, notes, settings: until you delete your account (items you delete individually are deleted at that time; deleting an event also deletes its checklist) • AI conversations (including summaries of goal-setting chats, the links between conversations and goals, records of memory changes, and partial replies while a reply is being written; see Section 4-2): until you delete the conversation or delete your account • AI memory and the AI shared memo: until you delete or rewrite them, or delete your account (the same applies to the words of yours that memory learned automatically was based on; turning "Use memory" off does not delete AI memory; when memory is full, the oldest items the AI saved may be removed; see Section 4-2) • Records of consent: until you delete your account • Records of AI usage and cost, and of AI Credits granted, used, and expired: until you delete your account (not deleted by "Delete All Data") • Reports of AI replies: until you delete your account (they remain even if you delete the conversation) • Records of purchase notifications, and of attempts to use invitation codes and benefit codes: for a period we set (they remain after you delete your account; see Section 8) • Records for rate limits: about 1 day • Your age group for the AI Features, when the AI Features Terms requiring guardian consent were accepted, and your store country: until you delete your account (the store country is updated each time you open the App) • Recovery codes for two-step verification: until you turn off two-step verification, create new recovery codes, or delete your account (a code that has been used can no longer be used) • Records of integrations with external AI services (the connected service, dates, and API key names): until you delete your account (the permission itself expires when you revoke it or after it goes unused for 30 days at most; an API key works until you revoke it) • Events imported from the iPhone Calendar and records for importing (Section 4-8, paragraph 6): until you turn importing off or delete your account (events deleted in the iPhone Calendar are, as a rule, deleted the next time events are imported; see Section 4-8, paragraph 4) • Records of your consent to importing the iPhone Calendar (Section 4-8, paragraph 9): until you delete your account (when you turn importing off, we record when you withdrew) • Records of deleted events (event and calendar IDs, when and how the event was deleted, and the ID of the account that deleted it; for a record about a specific occurrence of a repeating event, that occurrence's original date and time; no titles, locations, notes, or other such content): for a period we set • Other data: the period needed to achieve the purpose of use, or the period required by law 3. We apply the security measures in Section 11 to stored data. 4. The App also stores the following on your device: • Part of your calendar events (titles, dates and times, locations, notes, etc. for recently viewed periods, so they can be shown without a connection). This is stored separately for each account and erased from the device when you sign out or delete your account. • Content shown in home screen widgets (today's schedule, deadline tasks coming up, routines, workspace tasks, etc.), and routine check-offs made on a widget (until the app sends them to our servers the next time you open it). This is erased from the device when you sign out. • Part of your workspace (the tasks for today and the days just before and after it as last shown, and your workspace settings, so they can be shown as soon as you open the app). This is stored separately for each account and erased from the device when you sign out or delete your account. • Part of your AI conversations (the list of conversations and the content of recently opened ones) and part of your routines, assignments, and goals (recently shown content, so it can be shown right away). This is stored separately for each account and erased from the device when you sign out or delete your account. • The temporary storage of events, workspace, conversations, and so on described above is erased from your device 7 days after it was saved. The latest content is fetched again from our servers each time it is shown. • Content shown in Live Activities on the iPhone Lock Screen and in the Dynamic Island (the titles, times, and colors of events starting within 60 minutes and events in progress, the title and start time of the next event or time block starting within 12 hours, and the number of today's tasks you have completed). It is created on your device and is not sent to our servers or to Apple's push notification service. Because it appears on the Lock Screen even while your iPhone is locked, anyone who sees your screen may read it. You can turn it off in "Settings" → "Live Activities", and it ends when you sign out. • The sentences Siri reads out (the titles and times of events and time blocks from today until 7 days later, and today's tasks) and the Siri-only key (Section 4-6). These are stored only while "Settings" → "Siri" is on, and are erased when you turn it off or sign out. • Records for importing the iPhone Calendar (the calendars you chose and their names and colors, the device's identification number, import settings, and values for comparing with the previous import). These are stored separately for each account and erased from the device when you turn importing off or sign out. • Your sign-in state, app settings, records of consent, and the "Help improve the app" setting • When your sign-in on this device ends because you signed out on another device, changed your password, or similar, the on-device storage above (including widgets, Siri, and Live Activities) is also erased (version 2.9.0 and later). On Android, the data the App stores on the device is excluded from device backups and from transfers to a new device (version 2.9.0 and later).

7. Your Rights and How to Make Requests

Under Japan's Act on the Protection of Personal Information, you can make the following requests about your personal data we hold. • Notification of the purposes of use, and disclosure (including disclosure of records of provision to third parties) • Correction, addition, or deletion of the content • Suspension of use, erasure, or suspension of provision to third parties In the App, you can also view, correct, and delete events, tasks, and other content on their own screens. You can check and delete AI memory in "What AI remembers", and check and remove connections to external AI services in "Connected apps". Deleting your data and your account is described in Section 8. [How to make a request] • Send your request to support@synthera.jp from the email address registered in the App (if you cannot send from your registered address, including Apple's "Hide My Email" relay address, write from an address where we can reach you and include your registered address in the message; we will explain how to verify your identity. Do not send passwords or verification codes). • To confirm that you are the person concerned, we may ask you to reply to your registered email address or to confirm a sign-in in the App. For a request by an agent, we ask for a document showing the agent's authority. • We do not charge a fee. • We disclose information in the way you ask (electronic data or in writing). If that way would involve great cost or similar difficulty, we will tell you so and respond in another way. • As a rule, we respond within 30 days of receiving your request. If the law does not allow us to meet a request, we will tell you why.

8. Account Deletion and Data Erasure

1. You can delete your account and the data associated with it (including calendars, events, labels, event checklists, and undated notes) from "Settings" → "Delete Account" in the App. To verify your identity, we ask you to enter your password, an email code (email-registered users in version 2.9.0 onward), or re-authenticate with Google / Apple (if you registered with Google or Apple and have set up two-step verification, we check the code from your authenticator app instead of re-authentication). Deleted data cannot be restored. However, shared calendars you created that still have other members are handed over to another member as described in Section 4-7, paragraph 5, and their events, event checklists, and undated notes remain. Events, event checklists, and undated notes you created in other people's shared calendars also remain (their creator is shown as "Former member"). 2. "Settings" → "Delete All Data" deletes the following data while keeping your account (version 2.9.0 and later): events and undated notes in calendars only you see, time blocks, routines, deadline tasks (including steps and repeats), tasks, workspaces, goals and their steps, notes, AI conversations (including ratings), AI memory, and the AI shared memo. Your account, settings, the calendars themselves and their labels, shared calendars and their events, events imported from the iPhone Calendar, your purchase status and AI Credits, consent records, AI usage records, reports of AI replies, and connections to external AI services remain (you can remove connections in "Connected apps"). 3. The App and our app "Jinsei Road" (人生Road) share the same account (sign-in system). If you delete your account in the App and you use Jinsei Road with the same account, your Jinsei Road account and data are deleted as well. 4. Deleting your account does not cancel your subscription automatically. Please cancel it from the settings of the platform where you purchased it (Section 7 of the Terms of Service). 5. If you cannot delete your account in the App, please contact support@synthera.jp. We will delete it after verifying your identity and let you know when it is done. 6. The following data is not erased immediately when you delete your account: • Data contained in backups of the cloud infrastructure we use (erased when the backup retention period has passed) • Usage analytics information sent to PostHog (Section 5). Please contact us if you would like it deleted • Data sent to Anthropic through the AI Features (kept for the period Anthropic sets, as described in Section 4-2) • Audio sent to Google through voice input (subject to how Google handles it; we do not store it on our servers) • Data passed to a Connected Service through an integration with an external AI service (subject to that service's terms) • Records of deleted events (Section 6), which do not include titles, locations, notes, or other such content • Records of changes in shared calendars (Section 4-7, paragraph 7), which include copies of event titles and dates. Your display name is removed from them, and the records are deleted 30 days after they are made • Records of purchase notifications (your account ID, the type of notification, and the date and time), and records of attempts to use invitation codes and benefit codes (to prevent misuse; including your account ID). We keep them for a period we set • Records for rate limits (IP addresses and similar values in a form that cannot be reversed). They are erased in about 1 day • Email exchanges about your inquiries (for the period needed to handle them) • Purchase records kept by Apple, Google, and RevenueCat under their respective terms (if you would like the RevenueCat record deleted, please contact us) • Data we are required by law to retain

9. Cookies and Tracking

The App does not use cookies. We do not track you for advertising purposes (tracking you across other companies' apps or websites), and we do not collect advertising IDs (such as IDFA). We do not sell your personal information. We use PostHog for usage analytics to improve the App (Section 5). You can turn it off with "Help improve the app" in Settings. A list of the information the App sends from your device to outside businesses is in "Information Sent to Third Parties from the App" (https://todo-phoneapp.pages.dev/legal/tosche/en/external-transmission.html).

10. Use by Minors

1. People under 18 must use the App with the consent of a parent or other legal guardian. 2. People under 13 may not use the AI Features. People under 13 living in the United States may not use the App. If we learn that personal information of a person under 13 living in the United States has been registered, we delete that account and its data (Section 2-2 of the Terms of Service). 3. When you first use the AI Features, we ask for your age group (18 or over, 13 to 17, or under 13) and store whether you are "18 or over" or "13 to 17" and, for people aged 13 to 17, when they agreed to the AI Features Terms requiring guardian consent. If you answer "under 13", you cannot use the AI Features and we do not store that answer. Your age group and consent are self-declared; we do not check dates of birth or identity documents. 4. In the AI Features for people aged 13 to 17, we give the AI safety instructions for minors and do not save especially sensitive information such as health information to AI memory (Section 4-2). If an AI reply has a problem, you can report it from the reply's menu. 5. Parents or guardians who notice that their child is using the App without a legal guardian's consent, please contact us at the contact point in Section 14.

11. Security Measures

To prevent leakage, loss, or damage of personal data, we take the following measures. [Rules and organization] • We have set rules for handling personal data (how it is collected, used, stored, provided, and deleted, and who is responsible), with our representative as the person responsible. • If a leak or similar incident occurs or may have occurred, we report it to Japan's Personal Information Protection Commission and notify you as required by law. • We regularly check how personal data is handled and how secure our systems are. [People] • We limit the people who handle personal data to those needed to operate the App, and require them to keep it confidential and to handle it only as far as needed. • When we use external AI tools in our operations (such as investigating defects), we do not let them read Users' personal data, and handle only aggregate values such as counts. [Facilities and technology] • Data is stored in the facilities of a cloud provider with security controls in place (the database is in the Tokyo region). • Communication is encrypted (TLS), and passwords are stored in a form that cannot be reversed (hashed). • You can set up two-step verification with an authenticator app ("Two-step verification"). The data of users who set it up can be read or written only from connections our servers have checked with the code, and by Connected Services, API keys, and Siri keys the user has already authorized. • The database is controlled so that each user can access only their own data, and the keys for administration are kept out of the App. • To prevent unauthorized access, we limit the number of requests repeated within a short time. • Understanding the external environment: we entrust the handling of personal data to businesses in foreign countries (United States of America; Republic of Singapore) (Section 4-5). We take security measures after understanding the systems for protecting personal information in those countries.

12. Changes to This Policy

1. We may change this Policy due to changes in laws, changes to the App, or other reasons. 2. If we change the purposes of use, we do so within the scope reasonably considered to be related to the previous purposes; beyond that scope, we obtain your consent in advance. 3. When we make changes, we announce the content and the date they take effect in the App and on our website. For important changes, we also notify you on the App's screens or by email before they take effect. 4. The changed Policy takes effect from the date set in the announcement.

13. Governing Law and Courts

This Policy is governed by the laws of Japan. Except where the law provides otherwise, the Tokyo District Court or the Tokyo Summary Court has exclusive agreed jurisdiction as the court of first instance for disputes relating to this Policy.

14. Contact

For inquiries about this Policy, complaints about how we handle personal information, and the requests in Section 7, please contact: Business: Synthera (Sole proprietorship (Japan)) Representative: Kiichi Tsukui Address: We will disclose it without delay upon request. Please contact support@synthera.jp. Email: support@synthera.jp Contact form: https://www.synthera.jp/contact We are not a member of any accredited personal information protection organization in Japan.

15. For People Living in the United States

The App is distributed on the App Store in Japan and the United States. For people living in the United States, we also note the following. • The categories of information we collect are in Section 2, and the categories of third parties we provide information to are in Sections 4-2 to 5. How to review and correct your information is in Section 7, how we notify you of changes to this Policy is in Section 12, and the effective date is at the top. • The App does not respond in any special way to "Do Not Track" signals from browsers or similar. The App does not track you across other companies' apps or websites, and does not allow third parties to collect information through the App for such tracking. • We do not sell your personal information or share it with third parties for advertising based on your behavior. • People under 13 living in the United States may not use the App (Section 10). • If your App Store or other store country is the United States, sensitive personal information such as health-related information is not saved to your AI memory (the consent button is not shown either; see Section 4-2). This works by our servers not saving what they judge to fall under such information; because the judgment is based on words and phrases, some information may not be judged as falling under it. We do not infer your health status from the events or conversations you write and save it, or use them for purposes other than providing the App. You can check and delete saved memory at any time.