Privacy Policy

1. Data Controller

HOSHIDOU Operations ("the Company") operates HOSHIDOU ("the Service") in compliance with Japan's Act on the Protection of Personal Information (APPI) and handles user data responsibly.

2. Information Collected

The Service collects the following information:

• · Account information: Email address, display name
• · Birth data: Names, birth dates, birth times, and birth locations entered by the user
• · Purchase and billing information: Subscription status and report purchase history. Credit card numbers are handled directly by our payment processor and never pass through or reside on our servers
• · Usage data: Server logs such as chart calculation requests

3. Purpose of Use

Collected personal information is used only for the following purposes:

• · Providing chart calculation and display services
• · Generating and delivering reports
• · Account authentication and security
• · Processing payments and managing subscription and purchase records
• · Email verification, password reset, and other notifications
• · Service quality improvement and incident response

4. Processors and Third-Party Sharing

We do not share personal information with third parties without user consent, except as required by law. We entrust data to the following providers only to the extent necessary to operate the Service:

Payment processing: Our payment processor — Credit card details are handled directly by the processor and never pass through our servers. We will name the processor in this policy before billing begins.

Report generation: Anthropic, PBC (USA) — To generate reports, the relevant birth data (registered name, birth date, birth time, and birth location) is sent to Anthropic's AI model API. Under Anthropic's commercial terms, data sent through the API is not used to train AI models.

Email delivery: Resend, Inc. (USA) — Email addresses are shared for sending verification and notification emails.

Server infrastructure: Fly.io, Inc. (USA) — Hosts the application and database. Data is stored on servers in the Tokyo region (Japan).

Content delivery: Cloudflare, Inc. (USA) — Delivers the website and app (CDN).

All of the providers above are located in the United States. We have reviewed each provider's published data protection practices and contractual terms, and limit the data they handle to what the Service requires.

5. Analytics

For usage analytics we run our own instance of Umami, an open-source analytics tool. It uses no cookies and measures page views in a form that cannot identify individuals. No analytics data is sent to outside analytics providers.

6. Security Measures

The Service implements the following security measures to prevent unauthorized access, loss, or damage to personal information:

• · Encryption in transit: All communications are encrypted using TLS (HTTPS)
• · Password protection: Passwords are hashed using bcrypt and never stored in plain text
• · Access control: Access to personal information is limited to what is necessary for operations
• · Data location: Data is stored on servers in Japan (Tokyo region)

7. Data Retention

Account and birth data are retained as long as the account exists. When an account is deleted, all associated data is permanently removed. Server logs are retained for a maximum of 90 days before automatic deletion. Payment records are kept for the period required by law.

8. Cookies

The Service uses cookies solely for session management (keeping you logged in). No advertising or tracking cookies are used. Our analytics (Umami, described above) also uses no cookies.

9. Your Rights (APPI Articles 33-35)

Under Japan's Act on the Protection of Personal Information, you have the following rights regarding your personal data:

• · Right to disclosure: You may request to know what personal information we hold about you
• · Right to correction: You may request correction of inaccurate information
• · Right to deletion and suspension: You may request deletion or suspension of use of your personal information
• · Right to stop third-party transfer: You may request that we stop transferring your data to third parties
• · Self-service: You can update your profile, edit or delete birth data, and delete your entire account at any time from account settings

10. Privacy Contact

For requests regarding disclosure, correction, deletion, or suspension of personal information, or for any privacy-related questions, please contact us at support@hoshidou.com or via the in-app feedback feature. We will respond within a reasonable period (generally within 30 days).

11. Complaints

For complaints about how we handle your personal information, please contact us first at support@hoshidou.com. If the matter is not resolved, you may submit a complaint to Japan's Personal Information Protection Commission (https://www.ppc.go.jp/).

12. Policy Updates

This policy may be updated to reflect changes in law or service features. We will notify users of any significant changes through the app or website before they take effect.