nuipass Privacy Policy

1. Business operator

• Name: Hoshikaru LLC
• Representative: Yuki Kunugi
• Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan

2. Information we collect

• Account: email address, name (optional) and identifier received when you sign in with Apple, Google or your email address
• Profile: display name, display language and notification settings
• Plush: each plush’s name, type, height, birthday and other profile details, color adjustments, room decorations, level and items
• Scans: the video you film around your plush (deleted once the 3D model is made), and the resulting 3D model (.spz) and front preview image
• Travel photos: photos taken with the in-app AR camera, or composites made with a photo, that you choose to save (original photos you pick from your library for compositing are used only on your device and are never uploaded)
• AR Links: the links you create, their expiry, the photo setting, and how many times they were opened
• Purchases: the purchase, renewal and cancellation status of Scan tickets, Fluff and nuipass Plus, and your Fluff balance (payment details such as card numbers are handled by Apple and Google; we never receive them)
• Device and usage: push notification token (Expo), device and app type and version, app usage events (tied to a per-app identifier), and error information
• Website: access logs such as IP address and browser type when you open nuipass.com
• Inquiries: your email address and what you wrote to us

3. Information we don't collect or send

• When the camera is used on an AR Link page (in a browser), the camera image is used only in that device’s browser and is never sent to our servers. Photos taken by recipients are saved only on their device and are not sent to us
• From the in-app AR camera, we only receive the single photo you choose to save
• We do not collect location (GPS) or contacts. Photos from your library are used on your device only when you pick them
• We do not collect advertising identifiers (IDFA / Android advertising ID)

4. How we use information

• To register you, sign you in, confirm your identity and manage your account
• To provide features such as building 3D models, the plush room, the AR camera, photo compositing, AR Links and notifications
• To provide Scan tickets, Fluff and nuipass Plus, and to check purchase status
• To respond to inquiries and send important notices
• To prevent violations of the Terms and misuse, and to keep the Service safe
• To improve the Service and investigate problems by analyzing usage

5. What AR Links show

When you create an AR Link, anyone who has the link (without signing in) can see the plush’s name, your display name and the plush’s 3D model until the link expires (after 24 hours or 7 days) or you stop it in the app. Links can be forwarded, so only send them to people you trust. Nothing else (your email address, other plush, travel photos and so on) is shown through an AR Link. You receive a notification the first time a link is opened.

6. How long we keep information

• Scan videos: deleted once the 3D model is made (or once processing ends, if it fails)
• Account, plush, 3D models and travel photos: kept while your account exists, and deleted when you delete your account
• AR Links: can no longer be viewed once they expire or are stopped. Their records are deleted when you delete your account
• Backups: deleted automatically within 30 days
• Inquiries: 1 year after we finish handling them
• Server access logs: up to 90 days

7. Security measures

• Encrypted connections, and access control that limits your data to you (row-level security)
• Videos, 3D models and photos are stored privately and can only be viewed by you (and people with your AR Link) through time-limited URLs
• We limit who handles data, and choose and supervise external services carefully
• Details of our security measures are available on request to nuipass@hoshikaru.com, as required by law

8. Sharing with third parties

We do not share personal information with third parties without your consent, except as listed below. (Showing the plush you choose through an AR Link you create is done at your direction.)

• When required by law
• When necessary to protect someone’s life, body or property and it is difficult to obtain consent
• In connection with a business succession
• When we entrust handling to the service providers below

9. Service providers

We entrust the handling of information to the following providers, only as needed to provide the Service. Our contracts require them not to use it beyond that purpose.

• Supabase, Inc. (USA): database, file storage (videos, 3D models, photos), authentication and email sign-in. Data region: India (Mumbai)
• Google LLC (USA): building 3D models from videos on Google Cloud (Cloud Run, processed in Singapore), and Android notifications via Firebase
• Expo (650 Industries, Inc., USA): push notification delivery
• RevenueCat, Inc. (USA): purchase status management
• Cloudflare, Inc. (USA): delivery of the website and AR Link pages
• Google LLC (USA): usage analytics with Google Analytics for Firebase
• Apple Inc. and Google LLC: sign-in, payments and notifications

10. Transfers to third parties in other countries

Some of the providers above handle information in the United States and Singapore. You can learn about these countries’ personal information protection systems on the website of the Personal Information Protection Commission of Japan (https://www.ppc.go.jp/). Each provider takes measures for the proper handling of personal information through contracts, certifications and so on.

11. Analytics, ads and cookies

• The app uses Google Analytics for Firebase to analyze usage. We send usage events such as which screens you open and which features you use (for example, starting a scan or creating an AR Link), device and app version information, and a per-app identifier (app instance ID). After you sign in, events are tied to our user ID (random characters, not your name or email address). We never send videos, 3D models, photos or plush names. We do not collect advertising IDs or use data to personalize ads
• The Service shows no ads, and we do not track you across other companies’ apps or websites
• The website (nuipass.com) currently uses no analytics or advertising cookies. Text is displayed with Google Fonts, so opening a page sends your IP address and similar information from your browser to Google

12. Requests for disclosure, correction, suspension or deletion

• You can delete your account and all your data yourself at any time in the app under Settings › Delete account. You can stop AR Links at any time in the app
• For other requests for disclosure, correction, addition, deletion, suspension of use or suspension of sharing, contact nuipass@hoshikaru.com
• After confirming your identity (for example, with the email address you sign in with), we respond without delay as required by law
• We may charge a fee of ¥1,000 per request for disclosure of retained personal data

13. Minors

If you are a minor, use the Service with the consent of a parent or legal guardian. Parents and guardians can contact us at the address above to request disclosure or deletion of a minor’s information.

14. Changes

If we change this policy, we will announce the change and its effective date on this page. We will also notify you in the Service of important changes.

15. Contact

Hoshikaru LLC, personal information desk

Email: nuipass@hoshikaru.com

Address: Shibuya Dogenzaka Tokyu Bldg. 2F-C, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan

Supplementary provision

Established and effective October 18, 2026.