Privacy Policy

Last updated: June 15, 2026

The business operator of Rukayu (the "Service") (see legal notice under Japanese law; the "Operator") handles users' personal information appropriately. Please review this Policy together with the Terms of Service.

1. Information We Collect

Recipients

• Account information (email address, username, display name, and hashed password).
• Profile information (bio, images, social links, etc.).
• Country of activity, currency settings, and tip amount presets.
• Identifiers required for Stripe Connect integration (account ID and payout status).
• Referral program data (linkage with referrers and referral reward records).

Senders

• Payment information required for transactions (card details, PayPay, etc.) is processed directly by Stripe, Inc., the Payment Provider. The Operator does not retain sensitive payment data such as full card numbers.
• Tip amount, recipient, optional message, and transmission timestamp.

Login (OAuth)

When you log in with Google or Apple, we may receive identifiers, email address, and other data necessary for authentication from those providers.

Technical Information

• IP address, browser type, access timestamp, and referrer URL.
• Cookies (for session persistence and temporary storage of referral links such as ?ref=).
• On-page event data (amount selection, send completion, etc.) for fraud prevention and service improvement.

2. Purposes of Use

• To provide the Service, including tip sending/receiving, payouts, and referral reward payments.
• To assist with identity verification, prevent abuse or misconduct, and maintain security.
• To provide support for inquiries, refunds, and disputes.
• To analyze usage, improve features, and respond to incidents.
• To comply with legal obligations and protect rights.

3. Handling of Usage Data

We use data such as amount ranges, currencies, inbound channels (QR, links, embeds, etc.), and on-page actions solely for fraud prevention and improving the Service. We do not provide or sell this data to third parties. Analytics shown in the recipient dashboard are limited to that recipient's own received-tip data.

4. Third-Party Provision and Outsourcing

• Stripe, Inc.: We provide necessary information for payment processing, Connect account management, identity verification, and refund/dispute handling. Stripe's handling of data is governed by Stripe's privacy policy.
• Hosting and database providers: We entrust data to the extent necessary for operating the Service (e.g., Vercel and Turso).
• We may disclose data where required by law or where necessary to protect life, body, or property.

Except for the processors necessary for payment and operation listed above and where required by law, we do not provide or sell users' personal information to third parties, and we do not provide statistical or insight data to third parties.

5. Cross-Border Transfers

Payment and cloud providers may process data outside Japan. The Operator provides necessary information under contractual arrangements and each provider's security safeguards.

6. Cookies and Similar Technologies

The Service uses cookies for maintaining login sessions, tracking referral links (for a short period until registration completion), and security. If cookies are disabled in your browser, some features may not be available.

7. Retention Period

Personal information is retained for periods necessary to provide the Service, satisfy accounting and legal obligations, and handle disputes. Information no longer required is deleted or anonymized by reasonable means.

8. Security Management

The Operator implements reasonable security measures, including access control, encrypted communications (HTTPS), and password hashing. Absolute security is not guaranteed.

9. User Rights and Account Deletion

Users may delete their account at any time from the app or web dashboard (under "Profile"). Deleting an account erases personal information such as email address, display name, and profile. Transaction records that must be retained for payment, accounting, and legal obligations are kept in anonymized form for the necessary period.

In addition, upon request by the data subject, we will respond within a reasonable scope and in accordance with applicable law to requests for disclosure, correction, suspension of use, deletion, and similar actions. For payment/account information held by Stripe, please also use Stripe's own procedures.

10. Minors

If a minor uses the Service, they must do so with the consent of a parent or legal guardian.

11. Changes to This Policy

The Operator may amend this Policy in response to legal changes or changes in service content. The amended Policy will be announced by posting on this page or equivalent notice, and use after the posting date constitutes agreement to the amended Policy.

12. Contact

For inquiries about handling of personal information, please contact the details listed in the legal notice under the Specified Commercial Transactions Act (rukayu39@gmail.com).