Privacy Policy

1. Information We Collect

1.1 Account Information

You can create an account in the following ways:

• Email authentication: Email address and password
• Anonymous account: Temporary user ID only

1.2 User Content

Content created and saved by users in the App:

• Projects, tasks, and list information
• Journal entries
• Time logs (work time records)
• Wiki pages
• Category and tag information
• Statistics data
• Conversation history with the AI assistant (Relis AI)
• Reports on public lists and packs (reason and optional comment)

1.3 Usage Data

To improve the App's functionality, we may collect the following:

• Device type and operating system version
• App version information
• Error logs and crash reports

2. How We Use Your Information

Collected information is used for the following purposes:

• Account creation, management, and authentication
• Providing and improving the App's services and user experience
• Storing and syncing user data
• Improving App features and fixing bugs
• Maintaining security and preventing unauthorized use
• Complying with legal obligations

2.1 Legal Basis for Processing (GDPR Article 6)

When processing personal data of users in the EU/EEA, the App relies on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the service, such as storing and syncing account information and user content
• Legitimate interests (Art. 6(1)(f)): Processing necessary for service stability and security, such as collecting error logs and usage data
• Compliance with a legal obligation (Art. 6(1)(c)): Processing of data required to be retained by law

3. Data Storage and Security

The App uses Supabase as its backend service. User data is encrypted and stored on Supabase's secure cloud infrastructure.

3.1 Security Measures

• SSL/TLS encryption for data in transit
• Hashed storage of passwords
• Access control to prevent unauthorized access
• Regular security audits

3.2 Data Storage Location

User data is stored in Supabase's data centers (primarily in the United States or Europe). Supabase complies with GDPR and other international privacy standards.

4. Third-Party Services

The App uses the following third-party services:

4.1 Supabase

Used as the database and authentication service. See the Supabase Privacy Policy for details.

4.2 Stripe

Used for payment processing of paid plans in the web browser version. Payment information such as credit card details is managed by Stripe and is not stored on the App's servers. See the Stripe Privacy Policy for details.

4.3 Apple App Store (In-App Purchase)

Apple's In-App Purchase is used for payment processing of paid plans in the iOS app. See Apple's Privacy Policy for details.

4.4 Google Play (In-App Purchase)

Google Play's In-App Purchase is used for payment processing in the Android app. See Google's Privacy Policy for details.

4.5 AI Assistant (Relis AI)

When you use Relis AI, the text you enter, any images you attach, and the user content needed for the conversation (such as the projects, lists, and cards the AI reads or edits) are sent to the following providers for AI processing:

• If you use your own API key: the provider you selected in Settings (Anthropic, OpenAI, Google, or DeepSeek). Content you send is handled under that provider's terms and privacy policy. In the web version, requests pass through the App's servers because of browser restrictions, but the App's servers do not store the content in this relay (conversation history is stored as described below).
• If you use the free tier: content is sent through the App's servers to an AI provider (Anthropic [Claude] or Google [Gemini API]; we switch between them depending on usage and availability). In this relay, the App's servers do not store the content; they record only the number of uses and token counts (conversation history is stored as described below). Content sent is handled under each provider's terms and privacy policy (we use services for the free tier under conditions where content is not used for model training). Images cannot be sent on the free tier.
• Automatic first-time study set creation: if you choose to have the AI create a study set when you first launch the App, the topic you enter and the names and descriptions of candidate public lists are sent through the App's servers to the same providers as the free tier. Your own user content, such as projects and cards, is not sent.

API keys are stored on your device (in the OS keychain on iOS, Android, and desktop; in temporary browser storage that is cleared when you close the tab on the web). Only if you choose to save a key to your account is it stored on the App's servers, in encrypted form (the key needed to decrypt it is kept separately from the database).

Your conversation history with the AI is stored and synced on the App's servers, like your other user content. Images you attach to the AI are stored only on your device and are not stored on the App's servers. The first time you attach an image, the App asks you to confirm where it will be sent.

4.6 Reporting Public Content

When you report a public list or pack, the reason, any optional comment, and the reporting account are recorded. We use this information only to review and act on the report, and we never disclose the reporter's information to the publisher.

4.7 External AI Apps

Only if you choose to connect an external AI app such as ChatGPT (OpenAI) or Claude (Anthropic) to Relis, that app can access your account data, after you verify your identity and grant permission on the Relis sign-in page. Unless you connect one, no external AI app can access your Relis data.

• What it can read: your projects, lists, items, today's plan, quick memos, journal entries, wiki pages, study statistics, subscription status, and public list and pack search results.
• Writing: only if you grant write permission, it can add or update items, memos, journal entries, and wiki pages, and create or update projects and lists. The App does not provide a delete function to external AI apps.
• Sending to the AI provider: the external AI app processes what it reads using its provider's service (such as OpenAI or Anthropic). That handling is governed by the provider's terms and privacy policy, and we cannot control it.

What we store: to manage the connection, we store the connected app's registration information and the connection tokens we issue (an access token is valid for 1 hour; a refresh token expires if it is not used for 90 days). Your password is never given to the external AI app. Your sign-in session (Supabase session) is encrypted and kept inside our servers, and is not given to the external AI app.

Disconnecting: remove the Relis connector (plugin) in the external AI app. If you think a connection remains, or you cannot remove it, contact us at the address in the "Contact" section below, and we will revoke the connection on our side.

5. Sharing and Disclosure of Information

The App does not share users' personal information with third parties except in the following cases:

• With the explicit consent of the user
• To comply with legal obligations (court orders, requests from law enforcement, etc.)
• To protect the rights, property, or safety of the App
• Sharing with service providers (such as Supabase) to the extent necessary to provide the service
• Sending content to AI providers when you use the AI assistant or the automatic first-time study set creation (see 4.5)
• Providing content to an external AI app (and its provider) when you choose to connect one (see 4.7)

6. Your Rights

You have the following rights. To exercise these rights, please contact us using the contact information below:

• Right of access (Art. 15): You can request access to your personal data
• Right to rectification (Art. 16): You can request correction of inaccurate personal data
• Right to erasure (Art. 17): You can request deletion of your personal data (also available via the account deletion feature in the App)
• Right to restriction of processing (Art. 18): You can request that we restrict the processing of your personal data in certain circumstances
• Right to data portability (Art. 20): You can request that your personal data be exported in a machine-readable format
• Right to object (Art. 21): You can object to the processing of your personal data based on legitimate interests
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing prior to withdrawal

Users in the EU/EEA also have the right to lodge a complaint with the supervisory authority in your country (Art. 77). You may contact the supervisory authority before contacting us, but we encourage you to reach out to us first.

7. Data Retention and Deletion

7.1 Retention Period

Your data is retained for as long as your account is active. When you delete your account, all associated data will be deleted.

7.2 Account Deletion

You can delete your account at any time from the Settings screen in the App. The following data will be permanently deleted:

• Profile information
• Projects, tasks, and lists
• Journal entries
• Time logs
• Wiki pages
• Statistics data

Deleted data cannot be restored, so please proceed with care.

7.3 Account and Data Deletion Request (Google Play)

If you cannot delete your account from within the App or need assistance, please request deletion of your account and associated data via:

Email: info@prest-square.jp

Please include the email address of the account you wish to delete.

8. Changes to This Policy

The App may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notifications or email. The date of the last update is shown at the top of this page.

9. Cookies and Similar Technologies

The App may use cookies and similar technologies to maintain authentication sessions and improve the user experience. These are used to keep you logged in and remember your app settings.

10. International Data Transfers

Your data may be transferred to and stored outside your country (in Supabase's US or European data centers). For transfers outside the EU/EEA (e.g., to the United States), Supabase relies on the Standard Contractual Clauses (SCCs) approved by the European Commission to ensure your data is handled with appropriate safeguards. See Supabase's Data Processing Addendum (DPA) for details.

10.1 Automated Decision-Making and Profiling

The App does not perform automated decision-making or profiling (GDPR Article 22) that produces legal effects or similarly significant impacts on users.