Privacy policy
Document: Japan · Version 2026-10-03.1
1. Scope and responsibility
- Nullon Inc. is responsible for the personal information handling described here for Mirario guests and members. Personal information includes information identifying or reasonably linkable to a person, including account-linked content and inferences. A nickname or removal of direct identifiers does not necessarily make data anonymous.
- This Policy explains processing; it is not a single blanket consent for all processing. We distinguish service delivery, optional choices and separate research. The contact in section 15 handles privacy questions and rights requests.
2. Account, profile and consent information
- Information you provide includes your chosen name, date of birth and gender, and supported profile or preference changes. Authentication services may provide identifiers, email address and connected-account information. We process member and guest IDs, guest authentication and recovery information, account-linking status and sign-in activity to manage access and recovery.
- We process language, time-zone and date-display settings, device region, document-selection country and display language, and consent or withdrawal records such as document type, version and time. Where we ask for a declaration of your Canadian province or territory of residence, we use it to determine service eligibility and select documents. Device settings and declarations are not proof of actual residence.
- If you select Quebec in a regional-declaration flow, we record that selection and its occurrence time on the device, including mistaken selections. If you subsequently select another province or territory and proceed, we ask you to confirm your current declaration. Only where that history exists, after a user account is created we link the fact that Quebec was selected, the last selected province or territory, and the Quebec-selection time to the account through a dedicated submission. We do not send this dedicated information before user creation. If Quebec has never been selected, we do not store or send this special history. It is separate from the ordinary declaration of your current province or territory. We limit its purpose to checking regional declarations, preventing improper circumvention and handling corrections or disputes, and keep only the minimum information for as long as necessary. Selection history alone does not establish residence or deliberate deception and is not a basis for automatic sanctions. The contact in section 13 accepts corrections following mistakes or moves and requests for access or deletion.
- If an age check prevents you from proceeding to consent because you are under eighteen, we record the first refusal time, the date of birth entered at refusal and the correction time. Corrections do not overwrite the original record. Its purposes are limited to checking age eligibility, understanding corrections and addressing intentional circumvention or disputes; refusal history alone does not establish deliberate deception. Before registration, it is retained on the device and transferred to your account if you register later. After registration, it is retained until account closure and then becomes part of the ordinary deletion scope under section 11. Applicable legal retention limits, rights requests and deletion duties take priority, and before registration we do not retain it longer than necessary for its purposes. We do not guarantee preservation across reinstallation or different devices. This refusal history is not used for research and is excluded from research records and provision.
3. Service content, derived information and other people
- We process your future activities, achievements, goals and values, optional work, income and family information, and generated profile summaries and imagined future-world or background stories. We also process chat inputs and outputs, conversation and response ratings, diary conversations and generated diaries, Foresight answers and reports, and information derived from these inputs for personalization and continuity.
- Free text and inferences can reveal sensitive matters such as health, emotions, relationships, beliefs or financial circumstances. Provide only what is needed and avoid another person’s real identifying or sensitive details, particularly information about children in family descriptions. Information about an imagined future is not a verified fact about you or your relatives. We remain responsible for lawful handling of information we receive.
4. Device, usage and diagnostic information
- Analytics and operational processing can include app version, platform, environment, SDK or account identifiers, timestamps, sign-in and feature activity, screen or flow events, message lengths, ratings, purchase and quota events, network information such as IP addresses, and errors or stack traces. PostHog receives custom activity events and error reports; Firebase Analytics supports usage measurement and account properties. Identified events can be linked to a member or guest account.
- Analytics is distinct from optional research use of selected events. Turning research off does not itself turn off all service analytics. We limit diagnostic processing to information necessary for its purpose, but communications and error information can include information linked to an account. See section 13 or contact the privacy contact about available choices and rights under applicable law.
5. Purchases, support and communications
- Stores and RevenueCat provide purchase identifiers, product and transaction information, subscription and trial status, renewal or expiry information, refund or revocation events and entitlements. We use these to check and restore access and reconcile purchases. The app’s store purchase flow does not collect your full payment-card number for Nullon; payment instruments are handled by the store.
- We process feedback and support correspondence and related account information to respond and investigate. Configured internal Slack notifications can contain feedback text, registration identifiers or gender, and operational reports. For enabled service emails, Mailgun may receive an email address and generated future-post summary. Sending feedback or receiving service emails does not give separate consent to publish your private content or conduct research.
6. Purposes and AI processing
- We use the relevant categories above to establish and secure accounts; store and display profiles and histories; generate future posts, chat responses, diaries and Foresight reports; maintain personalized context, summaries and memories; administer purchases and allowances; respond to support and feedback; diagnose failures and improve service quality; check regional declarations and prevent improper circumvention; handle corrections and disputes; and meet legal obligations. We use information to the extent necessary for these stated purposes or another separately explained lawful purpose.
- For AI generation and evaluation, relevant profile, family, conversation, diary, Foresight and recalled-context content may be sent to Vercel AI Gateway and the model providers processing a request. We use Google Gemini for generation and conversations, TypeSafe AI’s Jev for evaluations such as response or context consistency and quality, and xAI Grok to evaluate the significance of changes to background stories. Personalized summaries and retained context may be used in later service interactions. These are ordinary service operations, separate from optional external research.
- We limit AI submissions to what is necessary for the requested function. Recipient processing may include executing requests and processing or retention for operations and security; we manage that handling through contracts and safeguards appropriate under applicable law. An AI submission does not carry a guarantee of zero retention. Contact the privacy contact for information about recipients and data handling. Material changes in processing purposes are subject to the notices and any separate consent or choices required by law under section 14.
7. Service providers and their roles
- Clerk handles member and guest identity, authentication and account recovery; Google or Apple handles supported linked sign-in. RevenueCat and Apple or Google Play handle purchase status and store transactions. PostHog handles behavioral analytics and diagnostics, and Google Firebase handles analytics. Vercel AI Gateway routes AI requests; Google (Gemini), TypeSafe AI (Jev) and xAI (Grok) perform the generation and evaluation described in section 6.
- Google Cloud and our database and infrastructure operators support server hosting, storage, jobs and logs. Mailgun handles enabled service-email delivery. Slack handles configured internal feedback, registration and operations notifications. Each recipient receives information relevant to its role, not necessarily every category.
- We select and oversee processors, use appropriate contracts and safeguards to limit handling to what is necessary for the entrusted purpose, and manage subprocessors. Some services, such as sign-in providers and purchase stores, also process information for independent purposes under their own notices. We assess the basis for those disclosures under applicable law. Provider terms do not replace our obligations.
8. Other disclosures
- We may disclose information where a valid legal requirement applies, or where applicable law permits a necessary, proportionate disclosure to protect life or safety, investigate abuse or protect legal rights. We will assess the legal basis and scope, and provide notices where required. A business transfer requires applicable privacy safeguards and any necessary notice or consent; it does not authorize unrestricted new uses.
- Our policy is not to disclose information for cross-context behavioral advertising. We distinguish ordinary service processing from provision under the optional research described in section 10. We plan research provision to universities, public research institutions and private companies’ research departments, including paid provision from which Nullon may receive compensation. A research label, removal of direct identifiers or replacement of IDs does not by itself establish legal anonymization or exclude a sale or sharing of personal information. We assess sale, sharing and other regulated-disclosure classifications against the actual processing and applicable law, and do not make an affected provision before satisfying required notices, separate authorizations or consent, opt-outs and other choices, international-transfer information and safeguards, and contractual conditions. This Policy or agreement to ordinary app terms does not itself satisfy those separate requirements.
- We obtain prior consent to third-party provision of personal data unless a specific statutory exception applies. We assess domestic outsourcing separately from provision to a foreign recipient. If we undertake joint use, we notify or make readily accessible the required information categories, participants, purposes and responsible party before it starts. Joint use does not authorize handling we have not explained.
9. International processing
- We operate in Japan. Information may be handled in Japan and in foreign countries where service providers and subprocessors process it. Courts or law-enforcement authorities abroad may obtain access under lawful demands, and legal protections may differ. Device settings and province or territory declarations do not limit processing to that region or avoid laws applicable to the actual circumstances.
- We use a basis and safeguards permitted by applicable law for international transfers. Before relying on consent, we provide the required information about destinations, recipients, foreign legal systems and safeguards and obtain the required consent. When using another lawful transfer method, we ensure its conditions and ongoing protections. This Policy is not blanket consent to every foreign transfer. Contact the privacy contact for information about destinations and safeguards.
10. Separate optional research
- We plan optional research to understand changes toward the same participants’ ideal selves, support analysis and quality improvement within Nullon, and conduct research and improvement with research institutions and other collaborators. The initial study uses the existing ten-item questionnaire with seven-point responses, comparing answers before app use with answers thirty days after completion of that questionnaire to examine attitudes toward the ideal self and changes. There is no participant compensation or research-revenue sharing. The general rule is to use eligible data arising after a person aged eighteen or older reviews study-specific information and turns research consent on. A limited exception permits only age or age group derived from the date of birth entered before consent for age checking to be used as a research record after obtaining explicit research consent explaining this use. The date of birth itself and refusal history are not used or provided for research. This exception does not extend to other pre-consent profiles, conversations, diaries or similar information; creating a snapshot after consent does not make pre-consent information eligible. Planned provision to universities, public research institutions and private companies’ research departments includes paid provision, explained in the initial study-specific information. If the research includes AI model development, training or evaluation necessary for those purposes, that information explains the models’ purposes, uses and scope. It does not authorize unexplained, unrestricted general-purpose commercial training or independent training on all inputs by ordinary service AI providers. The responsible person for research at Nullon is 鈴木拓海, Representative Director, distinct from responsible researchers at recipients. People who meet ordinary service age, regional and contract conditions may use the app after refusing or withdrawing research consent.
- Research data is limited to basic profiles, future-profile and family-information snapshots, research survey answers and selected PostHog events necessary for the research, subject to the limited age or age-group exception explained in this section. The date of birth itself and age-check refusal history are excluded from both internal research records and external research provision. Chat text and diary text are not included in this research disclosure. Before external provision, we remove names and preferred names, email addresses, service user IDs and similar direct identifiers, and plan to assign unique provision IDs distinct from app user IDs and separated by study and recipient. We separate access to the correspondence table and establish how withdrawal and deletion requests will be communicated to recipients before provision. Externally provided survey free text is limited to text from which content enabling identification or re-identification in combination with other fields has been removed; answers with insufficient processing or review are not provided. We also minimize and review dates, quasi-identifiers and family information, respecting third-party rights and required consent, including those of family members and children. These measures alone do not necessarily establish legal anonymization; we prohibit re-identification and explain important remaining risks.
- External research recipients and destination countries are currently undecided. The initial study-specific information and consent explain specific purposes and research fields, AI model uses, data fields, recipient categories and roles, linkage IDs, required international-transfer information, retention criteria, onward-provision conditions and withdrawal limits. If a country is genuinely undecided and law permits an explanation for that situation, we still explain the reasons, known candidate information and other required details. We do not require repeated confirmation for each provision within that explanation and valid consent when law does not require it, but address new purposes, material scope changes and legally required individual consent or separate sale authorization before an affected provision. We distinguish entrusted processing from recipients’ independent research and establish required contracts and management safeguards. Recipients may not provide data onward without our prior approval; even with approval, they must stay within the consent scope and pass on equivalent use restrictions, withdrawal and deletion duties, and applicable international-transfer requirements. This is not blanket permission for unexplained recipients, countries or incompatible purposes. Turning eighteen, editing a profile, accepting app terms or continuing use never automatically opts you into research.
11. Retention, account deletion and research withdrawal
- We retain service information only for as long as necessary for the functions you request and the purposes explained. After account closure, research-consent withdrawal or a valid deletion request, we stop the relevant use or disclosure, assess purpose-based necessity and legal obligations, and delete information no longer required or, only where applicable law permits, anonymize it in accordance with that law’s requirements. Where law sets a response or deletion deadline, we follow it and provide required explanations or notices for lawful exceptions or extensions. Contact the privacy contact about affected information, retention necessity or the status of a request.
- We retain individual research data only as long as necessary for the explained research purposes, and the responsible researcher reviews necessity once each year. Retention is not set to a fixed twenty-year term. The initial study-specific information states retention periods or objective end criteria and review criteria. Research copies become subject to deletion when the research ends, the information is no longer needed or research consent is withdrawn. After receiving withdrawal, including turning research consent off, we stop new research collection, use (including AI model development, training and evaluation) and provision based on that consent, and do not use existing research copies linkable to you for further research. We delete individual answers, research age or age-group records, snapshots, linkage information and other research copies linked to you, and require recipients to take applicable stop-use and deletion measures, subject to this section’s limited exceptions for legally necessary minimum records and statutory deadlines. This does not require blanket deletion of service originals still needed for ordinary app use you continue to request. Already published findings or irreversibly aggregated results that cannot reasonably be linked back to you may not be retractable. Even after lawful training, we cannot guarantee removal of every influence of your data from already trained models; this limit is expressly explained at initial research consent. Prior training does not categorically exempt identifiable or re-identifiable data or models that memorize or reproduce personal information. We address correction, deletion and other duties required by applicable law, including where use was unlawful or identifiable information remains.
- Limited retention exceptions may apply to records required by law or strictly necessary to establish, exercise or defend a claim or demonstrate consent compliance. We limit each exception to its purpose, legal basis, minimum information, restricted access and justified retention period, and delete records when the basis ends. We do not reuse them for research or general personalization. Exceptions are not permission to retain all profiles, conversations or research answers indefinitely.
- Where information subject to deletion remains in recovery-only backups, we isolate it from ordinary use, analytics and research and restrict access and purposes to necessary recovery operations. We delete or replace it under purpose-necessary refresh cycles; if restored, we reapply deletion and stop-use instructions before resuming ordinary processing. Refresh cycles do not extend retention limits or deletion deadlines imposed by applicable law. We take the measures required by applicable law for necessary deletion, including backups.
12. Choices, sensitive information and children
- You can use supported profile and settings changes and the separate research-consent setting, or ask the privacy contact for help. A research switch controls research; it is not a universal analytics or AI-processing switch. We offer specific choices or obtain express consent before optional or sensitive processing where law requires it. If processing is necessary for a requested feature, withdrawing its lawful permission can make that feature unavailable; we explain that consequence and do not require unrelated optional processing.
- Initial availability of the ordinary service is for people aged eighteen or older under section 4 of the Terms; parent or guardian consent alone does not satisfy that eligibility rule. This policy does not remove legal protections for children’s information included in family information or received inadvertently. We apply explanations appropriate to age and understanding, parental notices and required authorization, and access and deletion rights to children’s information in accordance with applicable law. If required authorization is not obtained, we do not undertake the affected personal-information processing and address deletion and other measures required by law. Parents or guardians may contact us about a child’s information; we verify authority proportionately without exposing information to an unauthorized person.
- For sensitive personal information under Japanese law, including qualifying medical or health information, we obtain prior consent unless a lawful exception applies and limit use to the explained purpose. A nickname or guest account does not remove this requirement.
13. Rights and how to request them
- Contact contact@nullon.com to request access, a copy, correction, deletion, cessation or restriction of use or disclosure, information about recipients, or withdrawal of consent as provided by applicable law. Tell us enough to identify your account and request; do not send an account password or unnecessary identity documents. We will use proportionate verification, accept authorized representatives where required, and respond within the applicable legal deadline, explaining any lawful refusal or extension and available challenge routes.
- Rights vary with applicable law and may have limited exceptions; no blanket exclusion applies to usage history, inferences or information without a legal name. We do not penalize you for exercising a protected right. Requests are free where law requires; we explain in advance any reasonable fee permitted by law.
- Japanese-law requests include disclosure of retained personal data and applicable third-party provision records, correction of inaccurate data, and cessation or deletion where statutory conditions are met. We provide required purposes and information about security measures and explain a decision not to comply. Contact the Personal Information Protection Commission for available guidance or complaint procedures.
14. Security, local storage and policy changes
- We use technical and organizational measures appropriate to the information, restrict access to those who need it, manage providers, and respond to incidents with notices to individuals and authorities where law requires. Some server content uses encryption, and the app stores drafts, guest state, settings and authentication or recovery information on the device. We do not guarantee end-to-end encryption or absolute security; authorized service systems can process content.
- Information handling after account closure follows section 11. Clearing device storage or resetting an analytics identity does not itself delete all server or provider information. Uninstalling is not a complete deletion request. Contact the privacy contact about deletion of affected server, provider, backup or log information.
- We identify material policy changes and their effective date through accessible notice. Before processing for new purposes or materially different optional processing, we give notices and obtain consent required by law. Publication alone does not retroactively authorize research or incompatible processing.
15. Privacy contact and complaints
- Provider and privacy contact: Nullon Inc. (株式会社Nullon), Room 301, Kokubunji SG Building, 2-1-36 Minamicho, Kokubunji-shi, Tokyo, Japan. Representative Director: Takumi Suzuki (鈴木拓海). Email: contact@nullon.com. Send questions, rights requests and complaints to this common contact.
- Japan privacy regulator information: https://www.ppc.go.jp/ . You do not have to waive access to a regulator in order to use the service or contact us.