Tolkivo Privacy Policy

1. Responsible entity and contact

This policy applies to the client and website services Tolkivo actually provides. The responsible entity for personal-information processing is:

ＥｌｅｋｓＭａｋｅｒ株式会社

The registered address is stated in section 1 of the Terms of Service:

神奈川県藤沢市鵠沼海岸３丁目8－25

オーシャンコースト鵠沼海岸 105

For requests about personal information, contact support@tolkivo.com.

2. Information processed and purposes

We process information necessary for the feature you use. You may choose not to use a feature that requires submission of related content, but the feature may not be available without necessary information.

Feature	Information categories	Purpose
Registration, login, and recovery	Account contact information, verification information, and session records	Identity verification, verification email delivery, login and account security
Real-time translation	Microphone audio, recognized text, language choices, and necessary context	Speech recognition and translation
History and export	Saved sessions, translations, and content you choose to export	History viewing and user-requested export
AI review	Text you select, task parameters, and necessary prompt context	Generating the AI review you request
Purchase and usage	Transaction-verification information from the original purchase channel, product, account association, and allowance records	Verifying entitlements, restoring purchases, handling refunds, preventing duplicate grants and abuse
Security and support	Service events, errors, usage, and support material you submit	Troubleshooting, handling requests, maintaining security, and handling disputes

Submit only what is needed to complete the task. Obtain lawful permission before submitting another person’s speech, confidential information, or personal information. We do not acquire ownership of submitted content merely because you submit it.

3. Third-party service providers

To provide a service you request, we may engage third-party providers to process necessary information, including audio, text, and language parameters needed for speech recognition and translation; selected text and task context needed for AI review; the recipient address and email content needed for verification email; and order and transaction information needed for payment and entitlement verification. Each recipient receives only information related to its function, and no task necessarily sends information to every category of recipient.

The names of specific recipients and the applicable data categories, purposes, and necessary cross-border details are provided in the relevant feature notice or a separate third-party service list. Where law or an app-distribution rule requires notice or consent, we complete the applicable procedure before transmission. If a recipient change adds a new purpose or data scope or requires renewed consent, we update the notice and obtain the necessary consent first.

The relevant feature notice explains the actual recipient, transmitted content, and purpose, and we obtain express consent where legally required. Different providers may process information outside Japan. For cross-border transfers, we provide required information and implement applicable safeguards or consent requirements. System microphone permission does not replace separate consent required for sharing data with a third party.

Entrusted third-party providers must process information within the agreed purpose and applicable law. We may provide necessary information to a lawful authority, to protect legal rights, or in a lawful business transfer, with applicable notice and protection duties. A new purpose beyond this policy requires a lawful basis and the necessary notice and consent procedure.

4. Retention and deletion

We retain information only for as long as necessary to provide the feature, maintain account security, verify transactions, comply with legal duties, or handle a dispute. Retention periods depend on data category, purpose, account state, legal retention duties, and whether a dispute has ended. When the purpose ends and no other lawful reason to retain exists, we delete the information or make it non-identifiable.

You manage local history through the client; clearing local history does not affect a copy exported to another application. Free service-side content follows section 10 of the Terms of Service: 30 consecutive days of inactivity, at least 7 days’ advance notice, and cancellation when the account becomes active again. Paid results and information retained by law follow the exceptions there.

Account deletion, transaction-record retention, deletion of third-party copies, and backup expiry are separate scopes. Information retained by law is used only for the corresponding purpose and not for unrelated services. Backups and third-party copies are not promised to disappear immediately together with local deletion. A rights-request response explains the applicable scope, action taken, and lawful reason for retention.

5. Choices and rights

Use the history-management, permission, and account features provided by the client, or contact support to request access, correction, deletion, restriction, withdrawal of consent, and other rights available under applicable law. We may perform identity verification necessary to protect the account and will process and answer within the period required by applicable law. If a request cannot be fulfilled, we will explain the reason and available legal remedy.

Withdrawing consent does not affect lawful processing based on consent before withdrawal, but a feature relying on that processing may no longer be available. Account deletion, withdrawal of data-processing consent, and cancellation of a paid subscription are separate actions. Manage auto-renewal through the original purchase channel.

6. Security and special information

We take reasonable security measures required by applicable law, including risk-appropriate access controls, transmission protection, and incident handling. No system can guarantee absolute security. Contact support promptly about an account anomaly or suspected data-security issue. We handle and notify legally reportable security incidents as required.

Avoid submitting sensitive information unrelated to a feature. A user who requires guardian consent must obtain the necessary consent before using the service. If information was processed without necessary consent, contact support to request review and lawful action.

7. External services and policy changes

If you intentionally access an external website or share a file with another application, that party’s rules apply to its own conduct; we remain responsible for our own obligations under law.

For a material policy change, we publish the update and effective date and provide required notice. Where renewed consent is legally required, the corresponding processing occurs only after consent is obtained. Contact us through the channel in section 1 of this policy.

When you actively choose Sign in with Google or Sign in with Apple, the provider processes your authorization and supplies Tolkivo with credentials used to verify the sign-in, a provider account identifier, and an email address when authorized and available. Apple may supply a relay address created through Hide My Email. Tolkivo uses this information to create or recognize an account, show linked sign-in methods, verify sensitive account actions, and protect account security. We do not receive your Google or Apple password. This feature does not request access to email contents, cloud files, contacts, or calendar.

Sign in with Google or Apple does not automatically enable email-code sign-in, and a matching email address does not automatically merge accounts or transfer entitlements. Adding a sign-in method requires verification of an existing method on the current account. To revoke Apple authorization, we encrypt and retain the minimum credentials needed for revocation and process provider identifiers with a secret key for account matching. We receive Apple authorization and email-status notifications to update linked identities and invalidate affected sessions. While notification or revocation work is unfinished, only encrypted material needed to continue is retained; unneeded content is cleared after successful processing.

Revocation, deletion, and local data

Stopping Tolkivo's Sign in with Apple in Apple settings revokes that sign-in method, but does not automatically delete the Tolkivo account or cancel a store subscription. Start deletion in More → Account → Delete account. Linked personal information is removed or de-identified through that process; necessary transaction records, security audit records, and backups follow this Privacy Policy. Local text history is managed separately in Privacy & Data. Exported copies, provider accounts, and subscriptions must be managed with the respective services.

Website analytics and provider privacy policies

The website loads GA4 only after you allow it, to measure page views, scrolling, and outbound-link activity. It uses only necessary technical and page information and does not send account identity or conversation text. Advertising storage and personalization are disabled. The Privacy settings link in the footer lets you withdraw analytics consent; theme and analytics consent are stored locally, while language is determined by the URL. Rejecting analytics does not affect the legal pages. Google and Apple process their service interactions under the Google Privacy Policy and Apple Privacy Policy; Tolkivo remains responsible for its own processing. After you consent, Google Analytics may use cookies and online identifiers to measure visits; you can manage cookies in your browser. Withdrawing consent stops subsequent analytics collection but does not automatically delete data already processed; contact support for related rights requests.

Legal bases for processing

This section supplements section 2. Where the EU or UK General Data Protection Regulation or a similar law requires a legal basis, we rely on the bases below. Under Japan’s Act on the Protection of Personal Information we use personal information within the purposes stated in section 2 and in this table.

Purpose	Information	Legal basis
Creating and securing your account, sign-in by email code, Google or Apple, and account recovery	Email address, verification records, provider account identifier, session and installation records	Performance of the contract with you (the Terms of Service)
Real-time speech recognition and translation	Microphone audio, recognized and translated text, language choices and any context terms you set	Performance of the contract
AI review that you request	The text you select and task parameters	Performance of the contract; and your consent given in the app before each submission
Purchases, allowance and entitlement records	Transaction-verification information from the app store, product, account association, allowance and usage records	Performance of the contract; compliance with legal obligations that apply to transaction records
Service security, abuse prevention, rate limiting, troubleshooting and service operations	Service events and errors, keyed hashes of IP address, device identifier and email address, country derived from IP address	Our legitimate interests in keeping the service secure, available and free of abuse
Answering support and rights requests, and handling disputes	Your messages, the material you submit and the related account records	Performance of the contract, compliance with legal obligations, and our legitimate interests in establishing and defending legal claims
Website and Web app measurement	Google Analytics: page views, scrolling, outbound-link activity, cookies and online identifiers. Cloudflare Web Analytics: cookieless page-load measurements	Google Analytics: your consent, which you can withdraw at any time in the website’s Privacy settings. Cloudflare Web Analytics: our legitimate interests in measuring site performance without cookies

Where processing is based on consent, you can withdraw it at any time; this does not affect processing carried out before withdrawal. Where processing is based on legitimate interests, you can object as described in “Exercising your rights and complaints” below. We do not sell personal information, do not use your content for advertising, and do not make decisions that produce legal effects about you solely by automated means.

Named recipients and service providers

This is the third-party service list referred to in section 3. Each recipient receives only the information needed for its function.

Recipient	Function and information received	Where it is processed
Soniox	Real-time speech recognition and translation. Your device sends microphone audio, language settings and any context terms you set directly to Soniox using a short-lived credential issued by us, and receives recognized and translated text. Soniox states that real-time audio and transcripts are not stored, that content-free operational and billing usage records are retained, and that the content is not used for model training. See the Soniox Privacy Policy.	United States
AI review processing providers	Generating the AI review you request from the text you select and the task parameters. These providers are engaged by us to process the request; a second provider may be used when the first is unavailable or declines the request. They may keep processing records under their own policies. The app refers to them collectively as the Tolkivo AI model and does not list their names.	Outside Japan. Before you submit, the app’s AI review notice states that the text is processed across borders; the specific country depends on the provider that handles the request and is not listed here
Resend	Delivery of verification emails: the recipient email address and the content of the email, including the one-time code.	United States, where the provider is established; its delivery infrastructure may be located in other regions
Cloudflare	Hosting of our API, website and Web app, database and encrypted temporary storage, network security, request logs and cookieless Web Analytics on the website and Web app. It processes account, session, purchase and usage records and request metadata such as IP address. Live audio does not pass through our servers. Text you submit for AI review passes through our servers in transit and is not stored there.	Our application is configured to run in the Tokyo region; this is not a data-residency guarantee. Requests, the database and storage are handled on Cloudflare’s global network, including locations outside Japan
Apple	Sign in with Apple, App Store purchases and subscriptions, transaction verification and server notifications, and, only if you turn it on in the app, consumption information for Apple’s refund review. Apple acts under its own privacy policy for its services.	United States and other countries where Apple operates
Google	Sign in with Google, Google Play purchases and subscriptions where offered, and, on the website only and only after your consent, Google Analytics (GA4). The Web app may download fallback fonts from Google’s font servers, which receive your IP address. Google acts under its own privacy policy for its services.	United States and other countries where Google operates

The Tolkivo apps for iOS and Android do not include advertising or third-party analytics software. If a recipient is added or replaced in a way that changes the purpose or the scope of information, we update this list and the relevant in-app notice first and obtain consent where it is required.

International transfers

We are established in Japan and our records are processed in Japan and on our hosting provider’s network. The recipients listed above process information in the United States and in other countries outside Japan and outside your own country.

For users in the European Economic Area and the United Kingdom, transfers to us in Japan are covered by the adequacy decisions adopted for Japan. Transfers from us or from your device to the recipients above take place because they are necessary to perform the service you request, or, for AI review, on the basis of the consent you give in the app before each submission. The recipient of live audio is identified in this policy; the app does not show a separate consent screen before live translation starts.

For users in Japan: the United States does not have a comprehensive personal-information protection law equivalent to the Act on the Protection of Personal Information, and has not been designated by the Personal Information Protection Commission as a country with an equivalent system. Information on foreign systems is published by the Commission. The measures each named recipient takes are described in its own privacy policy. You can ask us for further information about a transfer through support@tolkivo.com.

Retention periods

This table supplements section 4. “No fixed period” means that our systems do not delete the record automatically after a set time; we keep it while the stated purpose continues and delete or de-identify it on a valid request unless a law requires us to keep it.

Information	How long it is kept
Live audio, recognized text and translations	Not stored on our servers. Audio is processed in real time by the speech provider. Conversation history is kept only on your device until you delete it or remove the app.
Email verification codes	A code is valid for 10 minutes and only a keyed hash of it is stored. The email address on the verification record is erased when the code is used, expires, is locked or cannot be delivered. The remaining record (hashes and timestamps) has no fixed period.
Sign-in sessions	An access credential is valid for 10 minutes and a sign-in session for at most 30 days, after which you sign in again. Session records hold keyed hashes, are revoked when you sign out or delete the account, and have no fixed period.
Temporary Google or Apple sign-in records	Valid for 5 minutes and purged after they expire. The encrypted credential kept to revoke Apple authorization is erased when revocation succeeds; revocation is retried for up to 7 days.
Account record and email address	Kept while the account exists. When you delete the account, the email address and sign-in identities are deleted or erased immediately and sessions are revoked. A pseudonymous account record, a deletion record and installation records without your email address remain; no fixed period.
Deletion confirmation for accounts that used Google or Apple sign-in	30 days, as a hash, then purged.
Purchase, transaction, allowance and usage records	No fixed period. They are kept as an append-only ledger to verify entitlements, handle refunds and disputes and meet legal record-keeping duties. After account deletion they remain in pseudonymized form, no longer linked to your email address or sign-in identity. Signed store notifications are erased once processed.
AI review	The text you submit and the generated report pass through our servers and are not stored there in readable form. The encrypted result is held for at most 10 minutes for delivery and is deleted when your app confirms receipt or by a periodic cleanup after it expires. Content-free task records (identifiers, status, digests) have no fixed period. The AI review processing providers may keep processing records under their own policies.
Security and rate-limit records	Keyed hashes of IP address, device identifier and email address, counted in 60-second windows; no fixed period.
Country code	Kept with the account’s operational record; no fixed period.
Records of acceptance of legal documents on the Web app	No fixed period; kept as evidence of the version you accepted.
Server request logs	Kept by our hosting provider’s logging service for its standard period; we have not configured a longer one. Logs are designed not to contain email addresses, conversation text or audio.
Database backups	Backups made before maintenance have no fixed period, are used only for recovery, and may contain records that were later deleted from the live system.
Website analytics	Kept by Google Analytics and by Cloudflare Web Analytics under the settings of those services; withdrawing Google Analytics consent stops further collection by it.
Support correspondence	No fixed period; kept as long as needed to handle the request and any related dispute.

We do not currently carry out the idle-account cleanup described in section 10 of the Terms of Service. If we start, the advance notice described there applies.

Approximate location

The apps do not request location permission and do not use GPS or other precise location. When you sign in or a session is created, our hosting provider derives a two-letter country code from your IP address. We store the country at registration and the most recent country with your account’s operational record, and use it for service operations, support and abuse prevention. IP addresses are used in transit and, for rate limiting, as keyed hashes; our database does not store them in readable form.

Exercising your rights and complaints

To exercise a right, write to support@tolkivo.com from the email address of your account, or use the in-app controls: More → Account → Delete account, Privacy & Data for on-device history, and the website’s Privacy settings for analytics. Depending on the law that applies to you, you can request access to and a copy of your information, correction, deletion, restriction, data portability, an explanation of how it is used, and you can object to processing based on legitimate interests and withdraw consent. We may need to verify your identity and we answer within the period required by the applicable law. Exercising these rights is free of charge unless the law allows a fee.

If you believe our processing infringes the law, you have the right to lodge a complaint with a supervisory authority, in particular the data-protection authority of the country where you live or work in the European Economic Area or the United Kingdom. In Japan you can contact the Personal Information Protection Commission. We would appreciate the chance to address your concern first through support@tolkivo.com.