Privacy Policy

Last updated: September 27, 2026

This is a translation of the Japanese original. In case of any discrepancy, the Japanese version shall prevail.

CataLabs (the "Operator," "we," or "us") has established this Privacy Policy (this "Policy") as set out below regarding the handling of user information in the "Shiori" app (the "App") and related services (collectively with the App, the "Service"). This Policy has been prepared in light of the Act on the Protection of Personal Information of Japan, as well as the laws applicable depending on where users reside (such as the Personal Information Protection Act of Korea, the General Data Protection Regulation (GDPR) of the EU and the UK, and the California Consumer Privacy Act (CCPA) of the United States).

1. Operator

2. Advertising and Tracking

The Service does not display advertisements. It does not incorporate any mechanism for delivering ads (such as ad SDKs), and we do not collect advertising identifiers (IDFA / Google Advertising ID) or track users across other companies' apps or websites.

3. Information We Collect

  1. Information created or registered by users: the content of booklets (text, photos, handwriting, etc.) and nicknames
  2. Account information: email address, identifiers from the service used to sign in (Google or Apple), and the Firebase Authentication user ID (including the anonymous authentication ID used when you are not signed in)
  3. Usage statistics: information about how the App is used, such as the features and screens used (Google Analytics for Firebase)
  4. Crash reports and device information: the circumstances in which the App terminated abnormally, device model, OS and App versions, etc. (Firebase Crashlytics)
  5. Purchase status: Premium purchase and subscription status, expiration dates, and transaction identifiers (obtained from the App Store / Google Play via RevenueCat). Payment information such as credit card numbers is handled by each store, and we do not collect it.
  6. Information for preventing misuse: information used to verify that access comes from the genuine App (Firebase App Check, which uses Apple App Attest / Google Play Integrity)
  7. Device photo library and camera: accessed with your permission, and only for the purpose of adding photos to booklets. To reduce storage and data usage, imported photos are resized and compressed to the maximum size set by the App (which varies depending on your plan) before being saved.

Consent to sending the information in items 3 (usage statistics) and 4 (crash reports and device information) above is given using the consent checkboxes displayed when you start using the App (your region is determined by your device's region setting). In the EU, the EEA, the UK, Switzerland, and Korea, a checkbox for consenting to sending usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics) is displayed separately from the required checkbox for agreeing to the Terms of Use and this Policy; this checkbox is optional and unticked by default, and this information is sent only if you tick it. Existing users in these regions are asked once in the App. In other regions (such as Japan and the US), a single required checkbox is displayed for agreeing to the Terms of Use, this Policy, and the "How we use your data" explanation together, and by agreeing to it, you also consent to sending usage statistics and crash reports. In every region, you can turn sending off at any time in Settings → Privacy → "Share usage & crash data" in the App; when it is turned off, no usage statistics or crash reports are sent. All features of the Service are available whether or not this information is sent. Your name or nickname, email address, booklet content, and photos are never sent to Google Analytics for Firebase or Firebase Crashlytics, and usage statistics and crash reports are not used for advertising.

In addition, when the App communicates with the external services listed in "5. Storage Location and External Services" below, information relating to the communication, such as your IP address, is transmitted to each of those companies.

4. Purposes of Use

  1. Providing and maintaining the Service (saving booklets, cloud backup and transfer when changing devices, share links, and co-editing)
  2. Authenticating and managing accounts
  3. Displaying participants' nicknames in the sharing features
  4. Verifying Premium purchase and subscription status and providing its benefits
  5. Investigating and fixing defects, and improving the Service by analyzing usage
  6. Preventing unauthorized access and misuse, and ensuring security
  7. Responding to inquiries
  8. Complying with laws and regulations

We do not use personal information beyond the scope of these purposes. If we change the purposes of use, we will notify you in accordance with applicable laws, such as by revising this Policy, and will obtain your consent where required.

5. Storage Location and External Services (Service Providers)

As a rule, booklet data is stored on your device. When you use sign-in, backup, or sharing, or when usage statistics or crash reports are sent, the necessary information is transmitted to and stored by the external services listed below. We entrust the handling of information to these providers to the extent necessary to operate the Service.

  1. Google LLC (United States): Google Privacy Policy
    • Firebase Authentication: account authentication and management
    • Cloud Firestore / Cloud Storage for Firebase: storage of cloud backup and shared booklet data (text, images, nicknames, etc.) (Cloud Firestore in a multi-region location within the United States; Cloud Storage in the us-east1 region in the United States)
    • Google Analytics for Firebase: usage statistics
    • Firebase Crashlytics: collection of crash reports
    • Firebase App Check: prevention of misuse
    • Google Sign-In and Google Play: signing in with a Google account, and payment for in-app purchases on Android
  2. RevenueCat, Inc. (United States): management of subscriptions (purchase and subscription status) — RevenueCat Privacy Policy
  3. Apple Inc. (United States): signing in with Sign in with Apple, and payment for in-app purchases on the App Store — Apple Privacy Policy

6. Provision to Third Parties

  1. We do not provide personal information to third parties without your consent, except where permitted by law, such as where required by law. Provision to the providers listed in "5. Storage Location and External Services" is made in connection with entrusting the handling of information to them to the extent necessary to achieve the purposes of use.
  2. If you issue a share link, any third party who knows the link can view the booklet content and participants' nicknames. Please handle links with care. Note that there is a limit on the number of people who can participate in a single shared booklet.

7. Transfer to Foreign Countries

As you use the Service, your personal information is transferred to and stored in the United States as follows.

Because we are located in Japan, the information of users residing outside Japan is also handled by us in Japan.

8. Retention Periods

  1. Data on your device: until you delete the App
  2. Cloud backups and shared booklets: until you delete them, stop sharing (disable the link), or delete your account
  3. Account information: until you delete your account
  4. Usage statistics: event-level data is retained in accordance with the Google Analytics data retention setting (two months by default). Aggregated statistical data may be retained beyond that period.
  5. Crash reports: approximately 90 days
  6. Purchase records: retained in accordance with the rules of RevenueCat, the App Store, and Google Play, and with legal retention obligations

9. Deletion and Disposal of Information

  1. When you delete the App, the data on your device is deleted.
  2. For share links, the shared data in the cloud is deleted when the person who issued the link (the Creator) stops sharing in the App or deletes the shared booklet.
  3. When a participant leaves a shared booklet (trip plan), that participant's nickname is removed from the participant list.
  4. You can delete your account (including backup data and share links) at any time from Settings → Account → Delete account in the App. When you do so, your backup data in the cloud and any share links you have issued are also deleted. If you are unable to delete your account from within the App, please contact us as described in "17. Contact." We will respond without delay.
  5. Personal information that is no longer needed because its retention period has expired or its purpose of use has been achieved will be promptly deleted electronically using a method that makes it unrecoverable, except where retention is required by law.

10. Your Rights

In accordance with applicable laws, you may exercise the following rights with respect to your personal information:

  1. Request disclosure of (access to) your personal information
  2. Request correction, addition, or deletion
  3. Request suspension of use or restriction of processing
  4. Data portability (the right to receive your own data)
  5. Object to processing
  6. Withdraw consent (withdrawal does not affect the lawfulness of processing carried out before the withdrawal)

You can change your nickname, delete booklets, stop sharing, and delete your account using features in the App. In every region, you can withdraw your consent to sending usage statistics and crash reports at any time by turning off Settings → Privacy → "Share usage & crash data" in the App (when it is turned off, nothing is sent, and no features of the Service are limited). For other requests, please contact info@cata-labs.jp. You may also make a request through a legal representative or an authorized agent. To verify your identity, we may ask you to contact us from the email address registered to your account or take similar steps. We will respond to requests without undue delay (within the period prescribed by applicable law), and if we are unable to comply with a request under applicable law, we will inform you of the reason.

11. Security Measures

To prevent unauthorized access to, and loss or leakage of, the information we collect, we take the following measures:

  1. Organizational and personnel measures: We have designated a Privacy Officer (the CataLabs Privacy Team) and limit the persons who handle personal information to the minimum necessary.
  2. Technical measures: We control access through authentication and security rules, encrypt communications, and prevent unauthorized access using Firebase App Check.
  3. Understanding the external environment: We take security measures based on an understanding of the personal information protection system of the United States, where personal information is stored.

12. Use by Children

Users under the age of 13 should use the Service with the consent of a parent or guardian. Users residing in Korea who are under the age of 14 should use the Service with the consent of their legal representative. We do not knowingly collect personal information from children without such consent. If you become aware that a child's personal information has been provided without such consent, please contact us. After verification, we will promptly delete it.

13. For Residents of Korea

  1. Matters relating to the entrustment of personal information processing and cross-border transfers (the items transferred, the destination country, the timing and method of transfer, the name and contact information of the recipient, the purposes of use and retention periods, and how to refuse and the consequences of refusal) are as described in "5. Storage Location and External Services," "7. Transfer to Foreign Countries," and "8. Retention Periods."
  2. The procedures and methods for destroying personal information are as described in "9. Deletion and Disposal of Information," how to exercise your rights is as described in "10. Your Rights," and the measures to ensure security are as described in "11. Security Measures."
  3. Matters concerning the installation, operation, and refusal of automatic collection devices: The Service does not use web cookies. To improve the Service, usage statistics, crash reports, and device information (as described in "3. Information We Collect") are collected automatically by Google Analytics for Firebase and Firebase Crashlytics, which are software development kits (SDKs) built into the App. In Korea (determined by your device's region setting), this information is not sent by default and is collected only if you consent using an optional checkbox (unticked by default) that is displayed when you start using the App, separately from the required consent to the Terms of Use and this Policy (existing users are asked once in the App). It is not collected if you do not consent or if, after consenting, you turn off Settings → Privacy → "Share usage & crash data" in the App; in either case, no features of the Service are limited. We do not collect behavioral information across other companies' apps or websites.
  4. The Privacy Officer is as described in "17. Contact."
  5. For remedies for infringement of personal information, you may file a report with or seek advice from the following organizations:
    • Personal Information Infringement Report Center (개인정보침해 신고센터): privacy.kisa.or.kr / Tel. 118
    • Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회): www.kopico.go.kr / Tel. 1833-6972

14. For Residents of the EU, EEA, and UK

  1. We handle personal information as a controller under the GDPR (including the UK GDPR).
  2. The legal bases for processing personal information are as follows:
    • Performance of a contract: providing the App's features, backup and synchronization, sharing, and processing purchases
    • Legitimate interests: ensuring security (App Check). This processing is carried out for the purpose of preventing misuse, and to the extent that it does not unduly harm your rights and interests.
    • Consent: usage analysis and sending crash reports (when you start using the App, we ask for your consent using an optional checkbox separate from the required consent to the Terms of Use and this Policy; this checkbox is unticked by default, and nothing is sent until you consent; all features of the Service are available even if you do not consent; you can withdraw your consent at any time by turning off Settings → Privacy → "Share usage & crash data" in the App), and other cases where consent is required by law (for example, access to photos)
    • Legal obligations: compliance with legal retention obligations, etc.
  3. Transfers of personal information from the EEA and the UK to the United States are protected by appropriate safeguards, such as the standard contractual clauses (SCCs) provided by each provider.
  4. In addition to the rights described in "10. Your Rights," you have the right to lodge a complaint with the supervisory authority of the country or region where you reside.

15. For Residents of California, USA

  1. The categories of personal information we collect are identifiers (email address, account ID, etc.), user content (booklet content, photos, and nicknames), usage and device information, and purchase information. The sources are you, your device, and the App Store / Google Play. The purposes of use, recipients, and retention periods are as described in "3. Information We Collect," "4. Purposes of Use," "5. Storage Location and External Services," and "8. Retention Periods," respectively.
  2. We do not sell or share personal information (each as defined under the CCPA), nor do we use personal information for targeted advertising.
  3. You have the right to know about your personal information, the right to request its deletion or correction, and the right not to receive discriminatory treatment for exercising your rights. How to exercise these rights is described in "10. Your Rights."

16. Changes to This Policy

This Policy may be revised in response to changes in laws or in the content of the Service. When we revise it, we will announce the revised content and its effective date in the App or on this page. As a rule, we will announce material changes at least 7 days before the effective date, and will obtain your consent where required by law.

17. Contact

For inquiries regarding this Policy or the handling of personal information, requests for disclosure and the like, and complaints or consultations, please contact:

If you reside in Japan, you may also consult the Personal Information Protection Commission. For remedy organizations for residents of Korea, please see "13. For Residents of Korea"; for lodging a complaint with a supervisory authority for residents of the EU, EEA, and UK, please see "14. For Residents of the EU, EEA, and UK."