Privacy Policy
Last updated: September 22, 2026
Glory Lab, Inc. (the “Company,” “we,” or “us”) operates YOKAI.JP (the “Service”). This policy applies across the Service, including the yokai encyclopedia, search, assessments, Yokai Shrine, AI conversations with yokai, Yokai Town, cards, collections, Maya calendar, email, administration, and contact features.
In this policy, personal data includes information treated as personal data by applicable law, identifiers linked to an account or device, conversation and search content, and other information that can reasonably be associated with a user alone or in combination.
2.1 Account and preferences
- Email address, display name, avatar, and preferred language
- Hashed password and email-verification status
- Profile and authentication information received through Google sign-in (see 2.5)
- Visibility, notification, and promotional-email preferences
2.2 Activity and user content
- Assessment answers and results; fortune, omikuji, and Maya-calendar birth dates and calculated results
- Shrine visits, ema, prayers, votes, likes, comments, feedback, and invitations
- Yosen, Spirit Power, Bonds, contracts, achievements, and exchange, spending, and refund history
- Content in public pages or sharing links that you deliberately create
2.3 Yokai conversations and AI processing
- Your messages, yokai replies, language, timestamps, emotions, and relationship values
- Conversation summaries and memories about you formed by a yokai so the conversation can continue
- Model category, token and cache usage, processing time, estimated cost, and Spirit Power spent
- Smart-search query, scope, method, result count, cache status, charge status, and refund status
For ordinary searches made while signed out, we may store the query and technical information without a user ID to assess search quality. Search history does not directly store an IP address or User-Agent.
2.4 Communications, devices, advertising, and support
- IP address, User-Agent, session, cookies, referrer, pages viewed, and timestamps
- Ad and sponsorship impressions, clicks, page URL, referrer, and related event data
- Name, email address, message, replies, and attachments submitted to support
- Email destination, delivery outcome, delivery-service message ID, and unsubscribe status
2.5 Google sign-in and Google user data
Google sign-in is optional. When you choose to sign in or link an account, we receive your Google account identifier, name, email address, email-verification status, and profile-image URL if provided. We request basic identity and profile permissions (openid, email, profile). We do not receive your Google password or request access to Gmail message content, Google Drive files, contacts, or calendars.
We use this information to create, sign in to, or link your YOKAI.JP account, verify your identity, populate your profile, provide support, and prevent abuse. We also use your email address for account notices and information about the Service according to your email settings. Your name and image may become your display name and avatar and appear on public profiles, posts, or shared pages. Section 8 explains visibility and email preferences.
We store your profile and the link to your Google account in our database hosted by Cloudflare. Web sign-in may also store authentication tokens issued by Google (an ID token, an access token, and a refresh token if issued), granted permissions, and expiry times for authentication and account linking. We use HTTPS in transit and restrict access. Staff access is limited to operational needs such as support and security.
Google verifies your identity, and Cloudflare provides storage and service infrastructure. We use Amazon Web Services SES to send email, providing the destination address and necessary message content. We do not automatically include Google account profile data, such as your name, email address, avatar, or account identifier, or Google authentication tokens in AI requests. If you type your name or other personal information into a conversation or search, that content may be sent to the AI providers described in Section 4 to process your request.
We do not sell Google sign-in data, provide it to data brokers, or use it for ad targeting or training general-purpose AI models. The cookies, analytics, and advertising described in Section 7 do not authorize the use of Google sign-in profile information or authentication tokens for advertising.
Unlinking Google or deleting your account deletes the Google account link and its stored authentication tokens. Unlinking alone does not delete your YOKAI.JP account, copied display name, email address, avatar, or activity history. These are retained and deleted as described in Sections 9 and 10. The exceptions in Section 10 still apply after account deletion, including an HMAC fingerprint of your email address to prevent repeated signup-bonus claims and records needed for legal obligations or disputes.
You can unlink Google or delete your account in Settings. You cannot unlink your only sign-in method, so first arrange another way to sign in. You can also withdraw permission through your Google Account connections. Withdrawing permission at Google does not delete data already stored by YOKAI.JP. For correction or deletion requests you cannot complete in Settings, use our contact form.
- Authenticate accounts, verify identity, synchronize preferences, and provide support
- Provide assessments, shrine features, search, AI conversations and memory, and public or sharing features
- Manage Yosen, Spirit Power, and Bonds balances, spending, refunds, and abuse prevention
- Analyze search and conversation quality, failures, cost, cache efficiency, and usage trends
- Detect and address spam, unauthorized access, policy violations, and security incidents
- Send authentication, security, and important-change notices, plus promotional email according to your settings
- Deliver and measure advertising and display sponsors or affiliated products
- Comply with law, exercise rights, and handle disputes and audits
We use AI for yokai conversations, conversation summaries and memory, smart search, and generated assessment text. We may dynamically route a request to one or more AI providers according to the feature, language, quality, availability, and safety requirements. Providers may include OpenAI, Google Gemini, DeepSeek, and other contracted services. Information sent for processing may include your input, necessary conversation context, summaries, memories, search terms, yokai or article data, and language.
We do not intentionally place email addresses, passwords, or payment-authentication data in AI prompts. If you enter personal data in a conversation or search field, however, that content will be processed by AI. Do not submit sensitive information that is unnecessary, such as health, financial, identity-document, or confidential information.
AI output and smart-search results indicate relevance to content; they do not guarantee a correct answer, a verified fact, or professional advice. Do not rely on them for medical, legal, financial, safety, or other important decisions.
Ordinary conversations
Conversations with yokai are not public to other users by default. Conversations and memories are stored so you can continue talking with the same yokai and the yokai can remember its relationship with you.
Only when necessary for support, incident investigation, safety and abuse prevention, or quality and cost management may authorized administrators review conversations, summaries, memories, and technical information.
Sharing links you create
When you choose to share, we store a snapshot of the selected conversation, display name, avatar, yokai name, relationship value, and related information on a public page accessible to anyone who knows the URL. We mark the page noindex for search engines, but it is not a secure storage method.
You can revoke sharing later. We cannot delete copies or screenshots already saved by another person.
We engage the following categories of providers, or transmit data to them, only as needed to operate the Service. Providers, processing locations, and system architecture may change.
| Provider or category | Main purpose | Main data |
|---|---|---|
| Cloudflare | Hosting, CDN, D1, KV, R2, Queues, security, AI, and Vectorize | Account, activity, communications, and AI-processing data |
| AI service providers (for example OpenAI, Google Gemini, and DeepSeek) | AI inference, text generation, smart search, and yokai conversations; requests may be routed dynamically | Input, necessary context, summaries or memories, and relevant article or yokai data |
| Amazon Web Services | Email delivery through SES | Email address, subject, body, and delivery information |
| Sign-in and analytics | Authentication data, cookies, browsing and device data, and ad events | |
| Microsoft Corporation (Microsoft Clarity) | Website usage analytics and service improvement | IP address, device and browser data, page URL, referrer, and page-view and interaction data |
| Google LLC (Google AdSense) | Programmatic advertising, ad delivery, measurement, optimization, fraud prevention, and consent management | Cookies and identifiers, IP address, approximate location, device, browsing, referral, and ad-interaction data |
We do not sell personal data itself. We may disclose information as permitted by law when legally required, necessary to protect life, physical safety, or property, as part of a business transfer, or with your consent.
The Service uses cookies required for sign-in, language, and security, Google Analytics for audience measurement, Microsoft Clarity for limited public-page interaction analysis, and Google AdSense for programmatic advertising. If another advertising provider is enabled in the future, we will update this policy as required. Advertising providers may show ads based on previous visits to this or other websites and your consent choices.
On eligible public editorial and catalog pages, we use Microsoft Clarity to analyze site usage and improve presentation and usability. See Microsoft’s privacy statement.
Google and its advertising partners may use cookies, pixels, tags, server-to-server connections, and similar technologies to deliver, measure, personalize, and secure advertising. They may process device and cookie identifiers, IP address, approximate location, browser and device details, pages viewed, referral source, and ad interactions. See how Google uses information from partner sites for details and available choices.
For direct sponsorships, we record impressions, clicks, page URL, referrer, and environment data to measure performance. Processing after you open an affiliate link, including an Amazon link, is governed by the destination provider’s policy.
You can restrict cookies in your browser, although features such as sign-in may stop working. You can change Google ad personalization in Google Ad Settings. Where consent is required by law, you can make choices through the available consent interface.
Display names, ema, and assessment results have public features. Current defaults make display names, ema, and assessment results public and enable promotional email. Review the content and audience on the ema submission screen and in Settings, and change them at any time.
Messages essential to providing the Service, such as authentication codes, security notices, and important changes to terms or policies, may not be optional. You can stop promotional messages about new features, editorials, and campaigns in Settings or through the unsubscribe link in an email.
| Information | Typical retention |
|---|---|
| Account and preferences | Until account deletion |
| Authentication sessions | Normally expire after 7 days; a security update may end them sooner |
| Conversations, summaries, memories, assessments, shrine activity, service assets, posts, and signed-in searches | As long as needed for the feature or until account deletion |
| Anonymous searches and technical logs | As long as needed for quality, incident investigation, and abuse prevention |
| Shared pages | Until you revoke sharing or delete your account |
| Support, delivery, and audit records | As reasonably needed for support, law, disputes, and abuse prevention |
We may keep aggregated statistics that cannot reasonably be linked to a person or account indefinitely. Data remaining in backups or delivery caches at deletion is removed through ordinary refresh and expiry cycles and is not used except for disaster recovery.
You can close your account in Settings. Closing it deletes the account, authentication data, balances and transactions, assessments, shrine activity, ema, votes, comments, search history, conversations, summaries, yokai memories, memory files stored in R2, and conversation shares. This action cannot be undone.
To prevent repeated collection of sign-up benefits after re-registration, we retain an irreversible fingerprint created from the email address using a secret-key HMAC—not the email address itself—and aggregate counts recorded at deletion. If an inviter’s result must remain, the deleted user ID is replaced with an event-specific anonymous value.
We may retain records independently of the account when reasonably necessary for support, legal compliance, disputes, or security audits, and only to the extent needed for that purpose.
We use reasonable safeguards against loss, alteration, unauthorized disclosure, and misuse, including HTTPS, password hashing, permission management, restricted administrative access, log monitoring, and separation of storage systems.
No internet transmission or storage system is absolutely secure. Use a password you do not share with other services and contact us promptly if you notice unusual account activity.
Subject to applicable law, you may be entitled to request access, correction, deletion, restriction, a copy of your data, withdrawal of consent, or advertising choices. For requests you cannot complete in Settings, use our contact form.
We may ask you to verify your identity to prevent improper disclosure. Legal exceptions may prevent us from fulfilling all or part of a request.
We are a U.S. corporation, and our providers include businesses in the United States and other countries and regions. Your information may therefore be processed or stored outside your country of residence. We use reasonable safeguards required by applicable law, including contracts, access controls, and limiting the data transmitted.
Account registration is intended for people aged 13 or older. Children under 13 must not register an account and should view public content that does not require registration only under a parent or guardian’s supervision. If we learn that we collected information from a child under 13 by mistake, we will verify the circumstances and delete it, including after a parent or guardian contacts us.
We may revise this policy when features, providers, or laws change. For changes that materially affect your rights or how information is used, we will provide reasonable notice through the Service, your registered email address, or another appropriate method. The effective date of a revision appears on this page.
For questions about this policy or our handling of information, please use the contact form.
Operator: Glory Lab, Inc. (a Delaware corporation, United States)
Established: August 1, 2025
Version 2 updated: September 22, 2026