Privacy Policy

1. Operator

The Service is operated by Monogoo. On request, we will promptly tell you the Operator's name and address. For how to request this, see "12. Contact and complaints."

2. Information we collect

Account and sign-in

To sign in to the app, you use a Google account or an Apple account (iPhone and iPad only). On the website's account deletion page, you can also sign in with a Google or Apple account to delete your account. That page does not keep your sign-in in the browser: it is gone once you finish the deletion, sign out, or close the page. Sign-in is provided by Google's Firebase Authentication, which stores your user ID, sign-in method, email address, display name and profile picture URL. If you hide your email address with Apple, this is the forwarding address Apple issues. Signing in also involves your IP address and the type of browser or app (User-Agent), and Google keeps the IP address for a few weeks.

The Operator's servers store only your user ID and display name. Your email address is shown in the app's "Account" screen and on the account deletion page so that you can check which account you are deleting; it is not stored on the Operator's servers. Profile pictures are not used. You can change your display name in "Settings" → "Account."

Household and item information

We store the following information that you add or edit.

• Households: the household's name, its time zone and currency (set from your device's time zone and region settings when the household is created. The currency is one of the Japanese yen, US dollar, Australian dollar, New Zealand dollar and Singapore dollar; on a device in a region that uses none of them, or whose region cannot be read, it is the Japanese yen. The owner can change the time zone later, and the device's time zone may be read at that time. The owner can choose the currency again only while the household has no items and no contents insurance records), and its contents insurance coverage, renewal date, review schedule and records, and the history of changes to the coverage and renewal date
• Items: name, manufacturer, model number, status (Wishlist, Owned, Let go) and its history, how it was acquired (bought or received as a gift) and when, unit price, quantity and purchase date, favorite, location and category tags, purchase records and notes, purchase interval and estimated next purchase date, the date you let go of it, and whether it was sold and the sale price
• Tags, memories (text and date), and the timeline (records of changes, and notes)

If your item information, photos or documents include information about other people, such as family members, add it only with their consent. We do not intend to collect sensitive personal information such as medical history. Please do not include such information in notes, memories or documents.

Cover photos

For an item's cover photo, we receive the whole photo (JPEG) and the position of the square you choose as the part shown in lists and elsewhere. The Operator's server reads the photo again as an image and re-creates it as a new JPEG with its orientation and colors normalized. Metadata such as location and camera information is not kept. Only the following three re-created images are stored, and the photo we received is deleted once they are made.

• An image for enlarged display (the whole photo, with the same number of pixels as the photo received)
• An image for lists (the chosen square, at 320 × 320 pixels)
• A reduced image for AI and sharing (the chosen square, with its longer side at most 1,600 pixels; made even if you do not use AI)

For each photo, we record the ID of the user who added it, the image size, the position of the chosen square, the processing status, and hash values of the stored images (values calculated from the original data, from which the original data cannot be restored). URLs for showing photos are issued only after confirming that you are the household's owner or a member, and are valid for one hour. The app keeps photos it has shown in a cache on your device.

Documents

You can store receipts, warranties and manuals as documents for each item. We receive the file itself, the document type, the file name, the format and the size. Images chosen from your photos or files are re-created as JPEG or PNG on your device, with location information removed, before they are sent. Images taken with the app and PDFs are sent as they are.

The server does not open documents, check them for viruses or remove metadata; it stores the file as received. Information such as a PDF's document properties is stored as it is contained in the file. For each document, we record its type, file name, format, size, hash value, status, the ID of the user who added it, the ID of the owner whose storage it counts toward, and dates and times. Once a document is saved, the household's owner and members can view it, download it and send it to other apps. URLs for retrieving documents are issued only after confirming that you are the owner or a member, and are valid for 15 minutes.

Sharing a household

A household's owner can share the household with an invitation link. People who join a household through an invitation link are called "members." An invitation link can be used once, by one person, within 7 days of being created. The Operator does not store the invitation link itself; we record only a hash value made from the link, the household ID, the owner's user ID, its status, and dates and times. You send invitation links yourself, with the app you choose.

When you join a household, your display name, role and the date and time you joined are stored as member information and shown to the household's owner and all its members. If you later change your display name, the display name in your member information also changes in every household you own or have joined. The owner's display name and the household's name are also shown, before joining, to a person who opens the invitation link and signs in. If the owner changes their display name after sending the invitation, the new display name is shown. Email addresses are not shown to other people.

When any of the following happens in a shared household, we record the event for each person it concerns and show it in News in the app: sharing being removed (to the person removed), and an invited person joining the household or a member leaving it (to the owner). We record the type of event, the household's ID and name, the display name of the person who joined or left, the date and time, and the user IDs of the person it concerns and of the person who joined or left; names stay as they were when recorded. User IDs are not shown, and are used only to show the record to the person it concerns and to delete records when an account is deleted. When a member deletes their account, it is recorded as leaving, without a display name. An invited person joining the household is also announced to the owner by notification (see "Notifications").

Members can see the household's items, tags, memories, photos, documents, Schedule and Insights (including the contents insurance coverage and Value vs. coverage, the value of the items relative to the coverage), and can add and edit items, tags, memories and photos (amounts are recorded in the household's currency). Including things other people added, they can also delete tags and memories, move items to the trash and restore them, and rename and delete documents. After a member leaves a household or their sharing is removed, the content, photos and documents that member added or edited remain in the household.

AI product suggestions (Fill in from photo with AI)

Only when you press "Fill in from photo with AI" on the screen for adding or editing an item do we create up to 3 suggestions for the product name, manufacturer and model number from one photo. Suggestions are not applied to the item until you choose one.

• When a saved cover photo is used, we send the stored reduced image for AI and sharing (the chosen square).
• When a photo not yet saved is used, the chosen square is cut out on your device and we receive the photo reduced so that its longer side is at most 1,600 pixels, and keep it in a private temporary area until processing finishes or fails. Before sending it to the AI, we re-create it as a JPEG without metadata.

In both cases, the part outside the chosen square is not sent.

We send the AI only one photo and a fixed instruction. When the app is shown in English, we add to the instruction one fixed sentence asking for the suggestions in English. We do not send your user ID, email address, or household or item information. So that the same result can be returned if the connection drops, we keep the suggestions and the processing status (for a photo not yet saved, including the language the suggestions are made in) for 24 hours. We record the number of uses for each account.

The AI we use is Google Cloud's generative AI (Gemini). Google does not use the photos sent to train AI without the Operator's permission. Google's mechanism for temporarily storing and reusing inputs and outputs (caching) is turned off. However, only when Google automatically detects suspected abuse, Google may log the input, including the photo sent, for up to 90 days and have its staff review it to check whether it breaks the usage rules Google sets. These logs are not used for training either. The Operator does not use your photos or AI suggestions for AI training or quality evaluation.

Buying Premium

Premium is bought through in-app purchase on the App Store or Google Play. The App Store or Google Play charges the store account used for the purchase. Neither the Operator nor its service providers receive payment information such as card numbers.

To decide what to show in place of the price while it cannot be loaded from the store, the app reads your device's region setting within the app only. This region is not sent to the Operator's servers and is not stored.

Purchases are managed with the services of RevenueCat, Inc. RevenueCat handles the following information.

• Your identifier (App User ID): your user ID in Firebase Authentication.
• Purchase information: the store's purchase receipt and transaction ID, the product, the price and currency, the dates and times of purchase, renewal and expiry, and the state of the subscription, such as cancellation or refund
• Environment and country: the OS and store type, device model, OS and app versions, app identifiers, language, and country (determined from the country of the transaction or from the IP address; the IP address is not stored after this). On iPhone and iPad, an identifier the device creates for each app developer is also sent.
• Records of the purchase screen being shown

We do not send your email address, display name, item information or photos to RevenueCat. The Operator's server checks your Premium status by asking RevenueCat, and stores for each account the entitlement status, its expiry, when it was checked, what prompted the check (a check from the app or a notice from RevenueCat), and the ID of the last notice processed. For notices of purchase status that RevenueCat sends to the Operator's server, we do not store their content; we store records to prevent duplicates (a hash value of the notice ID, the result of processing, and the date and time).

Ads

On the Free plan, one Google AdMob banner ad is shown on the Home screen. Ads are not shown to Premium users, to users during the Premium trial, or in households whose owner has Premium. We ask Google to always serve only non-personalized ads (ads chosen by the content of the app being shown and your approximate region, not by your past behavior). When requesting ads, we do not send Google your item information, photos, email address, display name, user ID or search terms. On iPhone and iPad, we do not ask for permission to track you across other companies' apps and websites.

When ads are shown, the Google ad software (SDK) built into the app sends Google the following information to serve ads, cap how often they are shown, measure their effectiveness and prevent fraud.

• IP address (used to estimate your approximate region)
• Device and app information, information about app launches and ad views and interactions, and diagnostic information
• Device identifiers (on Android, the App Set ID and, where applicable, identifiers related to the account signed in on the device; the advertising ID is not used. On iPhone and iPad, identifiers for each app or developer)

Google also uses this information to improve its own services and handles it under its own privacy policy as well (How Google uses information from sites or apps that use our services). In regions where the law requires privacy choices, a message from Google is shown before ads. The Operator does not store advertising identifiers. While you have not stopped sending app usage data, records of ad requests, views and clicks remain in Google Analytics, and the Operator uses them only for aggregate statistics (see "App usage data").

Notifications

Notifications (Memory reminders, Repeat purchases, Insurance renewal and New members) are on by default. You can turn off each type in "Settings" → "Notifications." We ask for the device's notification permission when you do something notifications help with, such as adding a favorite, saving a contents insurance renewal date or creating an invitation link, and when you allow notifications from "Settings" → "Notifications." Once the device allows notifications, while any type is on, we register a random ID created on the device, a value identifying where to deliver notifications (on Android, the device's notification value issued by Google; on iPhone, an Expo Push Token), the OS type, and the language the app is shown in (Japanese or English, so that notifications are written in it). When the app's language changes, we register again in the new language the next time you open the app. If the device already allows notifications (devices on Android 12 or earlier allow them from the start), we register at the same moments without asking. On iPhone, registering sends Expo the device's notification value issued by Apple and an ID Expo creates for each device, and we receive an Expo Push Token. Notifications reach Android from the Operator's server through Google's notification service (Firebase Cloud Messaging), and reach iPhone from Expo's service through Apple's notification service. A notification's title may include an item name. A notification of a member joining includes the joining person's display name and the household's name. Depending on your device settings, notification content may also be shown on the lock screen.

If you share a household, Memory reminders and Repeat purchases go to the household's owner and all its members, and Insurance renewal and New members go to the owner only (in each case, except to people who have turned that notification off). Delivery records store a hash value, not the value identifying where to deliver notifications itself.

App usage data

To improve the app, from the time you review the Terms of Use and Privacy Policy and start using the app, we send app usage information to Google LLC's analytics service (Google Analytics for Firebase). Nothing is sent while you are signed out. You can stop sending at any time in "Settings" → "Account" → "Usage data," and stopping does not change the features you can use. When you stop, we delete the Operator's copy of the data sent until then and ask Google to delete it (see "6. Retention and deletion").

• What is sent: views of screens with fixed names, use of features, the start, success and failure of actions, new items added (including whether it is the first one), setting a repeat purchase schedule, use from notifications, views of introduction screens and the screen for adding an item, views and choices on Premium offers and the purchase screen, results of purchases and restores, and Premium becoming available
• Attached fields: the analytics ID, whether you are a new or existing user, the entry point and place of an offer, the plan type, whether a sample or the real view was shown, and the type of failure
• Categories about items: the status when added (Wishlist or Owned) and how it was acquired (bought or gift); the kind of photo (photo, icon or none); whether each of favorite, manufacturer, model number, quantity, price, purchase date, location, category, documents and memories was filled in; when letting go, whether it was sold and the range of time from acquiring to letting go (under 30 days, under 6 months, under 1 year, under 3 years, 3 years or more); and, among tags whose names are the same as the locations and categories provided from the start (such as Living room or Appliances), those added to items, deleted or renamed (other tags are recorded only as "other location" or "other category," without their names or classification; new names after renaming are not recorded either)
• What Google's software (SDK) records automatically: the app instance ID (an ID Firebase creates for each installation of the app), the date and time, device model, OS and its version, app version, language, approximate region (estimated from the IP address), first launch, sessions and time spent, app and OS updates, app removal and data clearing on Android, ad requests, views and clicks, receipt and opening of notifications, and records of in-app purchases and subscriptions (product, price, currency, conversion from a free period to paid, and renewals; on Android, also cancellations and refunds)
• Android install source: the referral information attached to the Google Play link that led to the installation (for links on the Operator's site, the placement label the Operator added) and the time the link was pressed. This is sent when sending starts.

Not included: item names, manufacturers, model numbers, item amounts (prices and sale prices), dates you entered, the content of notes and memories, names of tags that differ from the names provided from the start, search terms, photos, documents, file names, household names, household, item and tag IDs, invitation links, user IDs, email addresses, display names, and store transaction IDs. Advertising identifiers (the Android advertising ID and the IDFA on iPhone and iPad) and the identifier an iPhone or iPad creates for each app developer are not sent either.

The analytics ID is a random ID that the Operator's server creates when sending starts (including when it restarts), and is used only for Google Analytics. Because it corresponds to an account, we do not treat it as anonymous information. If you use several devices with the same account, you are counted as one person. When sending restarts, a new analytics ID is used, and it is not connected to earlier records.

The app keeps records not yet sent and Firebase app instance information on your device, and sends them to Google when it can connect. Google Analytics uses the IP address to estimate the approximate region and to exclude invalid data, then discards it without logging or storing it. Every day, the Operator exports a copy of the Google Analytics records to Google Cloud's BigQuery (Japan) and uses it for analysis for the same purposes.

Records needed to provide the Service

• Consent records: the version of the Terms of Use you agreed to, the version of the Privacy Policy you reviewed, the date and time of consent, the language of the consent screen (Japanese or English), and the versions of the English translations shown on the English screen. They do not include IP addresses, email addresses or device IDs. When you agree to a new version, the record is replaced with the latest one.
• Plans and usage counts: the start and end of the Premium trial (14 days), the number of new items added in each period, the number of uses of AI product suggestions, and the number and size of documents
• Guide: the guide's state, when guides and the screen for adding an item were first shown and from where, and when the first item was saved
• News: records of items read, dismissed and confirmed (the news item's ID and version, and the date and time)
• Action records: to prevent duplicate processing when the connection drops, the action's ID, type, result (including a copy of what was saved) and date and time
• When requests to create the Inventory CSV were received (to manage the limit on the number of times)

The app keeps on your device the ID of the household you have selected, your place in guides, news, the device ID for notifications, a cache of photos shown, and similar data.

Display language

The app and the website are shown in Japanese and English. The display language is decided from the device's language settings in the app, and from the page address on the website (the addresses of English pages start with https://monogoo.com/en/; only the invitation link page decides it from the browser's language settings). The app sends the language being shown (for English, a tag that includes the region, for example en-AU) with its requests to the Operator's servers. The website's inquiry form sends the page's language. The Operator's servers use it to write texts in that language, such as receipt confirmation emails, the headings of the Inventory CSV, AI product suggestions, and the location and category tags provided from the start in a new household. The Operator's servers record this language only in notification device registrations, consent records, the processing status of AI product suggestions, and inquiry emails delivered to the Operator.

App and device checks

To check that requests from a signed-in user's app come from the genuine Monogoo app, we use Google's Firebase App Check. The app has the app and device checked for tampering, with Google Play Integrity on Android and Apple's App Attest on iPhone, and attaches proof of the result (a value with an expiry) to its requests. For this check, app identifiers and information about the state of the device and app are sent to Google or Apple. The Operator's server only checks whether the proof is valid, and does not store the proof itself. The result of the check (whether valid proof was present, and whether it was Android or iPhone) is kept in the server logs.

Inquiries

On the inquiry form, we receive the type of inquiry, your reply email address, the content, and the display language of the page, and assign an inquiry number. The content and the language are sent by email from Amazon SES (Tokyo region) to the Operator's inbox (support@monogoo.com on Google Workspace). The language is used to write the receipt confirmation email and our reply in that language. The email address you enter is used only for replying and for sending one receipt confirmation email. The receipt confirmation email contains only the inquiry number, the type and the date and time received, not the content of the inquiry. If you contact us directly by email, we receive the sender's name and email address, the subject, the body and any attachments.

To prevent abusive or duplicate submissions, we store hash values made from the submission details and the content entered, and the status and number of submissions. These records do not store the body, the email address itself or the IP address. When the form is submitted, Google Cloud Fraud Defense (formerly reCAPTCHA Enterprise) handles a cookie (_GRECAPTCHA), a value stored in the browser (_grecaptcha), the IP address, and browser and interaction information to assess whether the submission is abusive. Google handles this information on the Operator's behalf and does not use it for any other purpose, including ad personalization.

To make sure no inquiry is missed, emails received are sorted and summarized with an AI service (Claude by Anthropic, PBC), which is also used to draft replies and to look into what was asked. We use it with settings under which what we enter is not used for training to improve the AI (for details, see "5. Service providers and handling outside Japan"). Bug reports, requests and inquiries that need a reply are recorded, not publicly, in a development management tool (a service of GitHub, Inc.) as summaries without names, email addresses, phone numbers, addresses, account IDs and the like, together with the message ID and date received (to find the original email) and the inquiry number. Reply drafts and the progress of our response are recorded without the same information. Replies are sent by the Operator.

Website analytics and access logs

The public website (https://monogoo.com) uses Google Analytics 4. For visits from Japan, analytics cookies (_ga and those starting with _ga_; up to 90 days from the first visit) are used by default. Google estimates from the IP address whether a visit is from Japan. Outside Japan, cookies are used only if you turn them on. Even when cookies are not used, the Google measurement code built into each page (the Google tag) may send Google the consent state and cookieless measurement information. This also applies to the News, inquiry, Terms of Use, Privacy Policy and Specified Commercial Transactions Act notice pages opened from the app. The Google tag is not loaded on the account deletion page or on the invitation link page (https://link.monogoo.com).

We send Google the page URL, the referrer (which page or site you came from), the page title, language, screen size, device and browser information, the start of a visit, page views and time spent, scrolling to 90% of a page, pressing an app store badge (which store, and where on the page), and completion of an inquiry submission. Google estimates the approximate region (down to the city level) from the IP address.

• Page URL: the part from "?" or "#" onward is removed. However, values on a link that show where you came from (utm_source, utm_medium, utm_campaign and utm_content; only short values made of letters, digits, "-" and "_") are sent.
• Referrer: from a page on this site, the URL of that page (without the part from "?" or "#" onward) is sent. From other sites, only the site's domain (for example, https://www.youtube.com/) is sent; when opened from an Android app, only the app's name (package name) is sent.

We do not send form input, email addresses, inquiry numbers, app user IDs or item information. Google Analytics uses the IP address to estimate the approximate region and to exclude invalid data, then discards it without logging or storing it. Every day, the Operator exports a copy of the Google Analytics records (except completions of inquiry submissions) to Google Cloud's BigQuery (Japan) and uses it for analysis for the same purposes.

The Service's servers (the server the app communicates with, and the website) record, for each access, the date and time, URL, response result, type of browser or app (User-Agent), referrer, IP address and similar information. Item details and search terms are not included in URLs and are not recorded. Firebase Hosting, which delivers the website, keeps IP addresses for a few months to detect abuse and understand usage.

3. Purposes of use

• To sign you in, manage accounts and verify identity
• To provide the Service's features, such as the household inventory, search, totals, schedules, notifications, the Inventory CSV and share images of items
• To store cover photos and documents, and show and provide them to the household's owner and members
• To share households, send invitations and manage members
• To create product information suggestions from photos and manage the number of uses
• To check the state of Premium purchases, renewals, cancellations, refunds and restores, and manage the features and limits of each plan
• To serve ads on the Free plan, cap how often they are shown, measure their effectiveness and prevent fraud
• To restore from the trash, recover from failures and mistaken operations, and prevent duplicate processing
• To prevent abuse, ensure security and investigate failures
• To respond to inquiries, fix bugs and consider improvements to the Service
• To respond to requests for disclosure and the like
• To send important notices and inform you of changes to the terms and policies
• To aggregate app usage by users who have not stopped sending it, understand how people learned about the app, started using it and keep using it, and improve the app's features and ease of use, Premium offers and promotion methods
• To understand browsing trends on the public website and which posts, ads and sites visitors came from and how many went on to an app store, and improve our information, promotion methods and ease of use

4. Provision to third parties

The Operator does not provide personal data to third parties without your consent, except in the following cases.

• Cases permitted under Japan's Act on the Protection of Personal Information, such as when required by law
• When the businesses listed in "5. Service providers and handling outside Japan" handle information to the extent described there

The following are shown based on your own actions to share or join a household.

• Showing members who have joined a household that household's content, photos and documents, and the display names of its owner and members
• Showing a person who opens an invitation link and signs in the owner's display name and the household's name before joining

When you save the Inventory CSV, documents, share images or invitation links to your device, or send them to other apps, how they are handled after that is governed by the terms and privacy policy of the place you saved or sent them to.

5. Service providers and handling outside Japan

The Operator entrusts the handling of information to the following businesses to the extent needed to provide the Service. We deal with these service providers under each company's data processing agreements and terms (which set out limits on the purposes for which information is handled, confidentiality, security and the like).

We deal with Expo under Expo's terms of service and privacy policy. Expo states that it handles app users' information on the Operator's behalf only to deliver notifications.

Even when our contracting party is a Japanese business, actual storage and processing may be carried out by group companies or subcontractors of each company, such as Google LLC in the United States. Storage locations are as shown in the table, but information may be handled from countries not in the table for maintenance or for support the Operator requests. For Google services whose storage or processing location cannot be specified, the data center locations Google publishes (https://datacenters.google/locations/) are a useful reference.

The following businesses also handle information for their own purposes, such as preventing fraud and improving their services, under their own terms and privacy policies.

• Apple and Google (App Store, Google Play, device notification services, Sign in with Apple, Apple's App Attest, Google Play Integrity): to distribute the app, process payments for in-app purchases, manage subscriptions and refunds, deliver notifications, sign you in, and check the app and device, they handle the purchase information of your store account, notification content, sign-in information, and information about the state of the app and device. Both are US businesses (the App Store is provided to users in Japan by iTunes K.K. in Japan), and the information is handled in facilities each company has around the world.
• Google (AdMob): as described under "Ads" in "2. Information we collect."
• Anthropic, PBC (Claude; a US business): to sort and summarize inquiry emails, draft replies and look into what was asked, we send the sender's name and email address, the subject, the body and the date and time received. The Operator uses it with settings under which what we enter is not used for training to improve the AI. Anthropic handles inputs and outputs on servers in the United States and elsewhere, and keeps them for up to 30 days. If it detects suspected abuse, it may keep them for up to 2 years (and the results of its assessment for up to 7 years) and use them to improve its systems for finding abuse (including training AI for that purpose). Where required by law, it may keep them for as long as required.

For businesses outside Japan, we use them after confirming that their contracts, terms and privacy policies provide measures for handling information appropriately. At least once a year, we regularly check how those measures are being carried out and any foreign systems that could affect them. The United States has no comprehensive federal law on the protection of personal information, but has sector-specific federal laws and state laws. Singapore has the Personal Data Protection Act (PDPA). If you need more detailed information about handling outside Japan and the measures each company takes, please request it through "12. Contact and complaints."

The Operator chooses and uses businesses it has confirmed protect users' information to a standard equivalent to this policy.

Information sent to third parties

The website's pages and the app include software from other businesses (tags and SDKs). These send information from your device to the following businesses. Other businesses may collect information about your activities through the Service continuously over time or across other websites and apps only where the businesses listed here handle it to the extent described here.

Website analytics (every page except the account deletion page)

• Recipient: Google LLC (the Google tag; Google Analytics), United States
• Information sent: analytics cookies (_ga and those starting with _ga_), page URLs (including values showing where you came from), referrers, page titles, language, screen size, device and browser information, the start of a visit, page views and time spent, scrolling to 90% of a page, pressing an app store badge, completion of an inquiry submission, whether cookies are used, and the IP address (as described under "Website analytics and access logs" in "2. Information we collect")
• Purpose: the Operator uses it to understand browsing trends, where visitors came from and how many went on to an app store, and to improve our information, promotion methods and ease of use. Because data sharing settings are turned off, Google uses it only to provide, maintain and protect the analytics service (including technical support when the Operator asks for it).
• Retention: data that records each page view or interaction is kept for 14 months from collection (the copy the Operator exports to BigQuery is also deleted after 14 months). However, how long Google keeps cookieless measurement information is set by Google. Cookies last up to 90 days from the first visit.
• How to stop it: use "Cookies and analytics" at the bottom of each page.

Preventing abusive inquiry submissions (inquiry form)

• Recipient: Google Cloud Japan G.K. (Google Cloud Fraud Defense; formerly reCAPTCHA Enterprise), Japan
• Information sent: a cookie (_GRECAPTCHA) and a value stored in the browser (_grecaptcha), the IP address, and browser and interaction information
• Purpose: the Operator uses it to prevent abusive inquiry submissions. Google handles it only as needed to provide and maintain the service and to keep its ability to identify and prevent fraud against changing threats, and does not use it for any other purpose, including ad personalization.
• Retention: not published.
• How to stop it: it cannot be stopped. It is sent only when you submit the form, and not when you contact us directly by email.

Ads (Home screen of the app on the Free plan)

• Recipient: Google LLC (Google Mobile Ads SDK; AdMob and the User Messaging Platform, which shows privacy choice messages), United States
• Information sent: IP address, device and app information, information about app launches and ad views and interactions, diagnostic information, and device identifiers (as described under "Ads" in "2. Information we collect")
• Purpose: the Operator uses it to serve ads on the Free plan. Google uses it to serve ads, cap how often they are shown, measure their effectiveness and prevent fraud, and also to improve its own services.
• Retention: as set by Google.
• How to stop it: ads are not shown, and nothing is sent, for Premium users, users during the Premium trial, and households whose owner has Premium. In regions where the law requires privacy choices, you can change your choice in "Settings" → "Terms and policies" → "Ad privacy settings."

Sign-in (app)

• Recipient: Google Cloud Japan G.K. (Firebase Authentication), Japan (processed in the United States). For Google sign-in, Google LLC (Google accounts), United States. For Apple sign-in, Apple Inc. (Sign in with Apple), United States
• Information sent: the sign-in credential issued by Google or Apple (including the ID of your account with that company, your email address and name, and, for Google, your profile picture URL), the IP address, app identifiers, device model and OS, the store the app was installed from, and app and SDK versions. Google and Apple receive your actions on the sign-in screen and app identifiers.
• Purpose: the Operator uses it to sign you in and verify your identity. Firebase Authentication handles it on the Operator's behalf to provide sign-in and manage accounts, and to prevent fraudulent sign-ups and sign-ins. Google and Apple handle it to provide sign-in with their accounts.
• Retention: in Firebase Authentication, IP addresses are kept for a few weeks. Other information remains until the account is deleted, and is removed from Google's systems within 180 days after deletion.
• How to stop it: it cannot be stopped (it is needed to sign in).

Sign-in (the website's account deletion page)

• Recipient: Google Cloud Japan G.K. (Firebase Authentication), Japan (processed in the United States). Google LLC (the software that opens the sign-in screen, and, for Google sign-in, Google accounts), United States. For Apple sign-in, Apple Inc. (Sign in with Apple), United States
• Information sent: the sign-in credential issued by Google or Apple (including the ID of your account with that company, your email address and name, and, for Google, your profile picture URL), the IP address, the type of browser (User-Agent), the page URL, and the SDK version. Google and Apple receive your actions on the sign-in screen and the page's display language, so that the sign-in screen is shown in the same language as the page. If you signed in with Apple, after the deletion starts, a value issued by Apple is sent to revoke Monogoo's Sign in with Apple.
• Purpose: the Operator uses it to verify the identity of the person whose account is being deleted. The purposes of Firebase Authentication, Google and Apple are the same as in "Sign-in (app)."
• Retention: the sign-in state is not kept in the browser. Retention in Firebase Authentication is the same as in "Sign-in (app)."
• How to stop it: it is sent only when you choose "Sign in to continue" on this page. It is not sent when you delete your account from the app's settings, or when you request deletion by form or email.

App and device checks (app)

• Recipient: Google Cloud Japan G.K. (Firebase App Check), Japan. On Android, Google LLC (Google Play Integrity), United States. On iPhone, Apple Inc. (App Attest), United States
• Information sent: app identifiers and version, information for checking that the device and app have not been tampered with (on Android, including whether the app was obtained from Google Play), and the IP address
• Purpose: the Operator uses it to check that requests from a signed-in user's app come from the genuine Monogoo app. The recipients handle it to check the app and device.
• Retention: Firebase App Check does not store the information used for the check. Google Play Integrity deletes it after a period set by Google.
• How to stop it: it cannot be stopped (it is needed for requests after signing in).

Notifications (app)

• Recipient: on Android, Google LLC (Firebase Cloud Messaging), United States. On iPhone, 650 Industries, Inc. (Expo) and Apple Inc. (Apple's notification service), United States
• Information sent: on Android, to Google: an ID Firebase creates for each installation of the app, the device's notification value, the app version, the device model and OS, and the IP address. On iPhone, to Expo: the device's notification value issued by Apple, the ID Expo creates for each device, app identifiers, and the IP address; to Apple: app identifiers and device information to receive the device's notification value
• Purpose: the Operator uses it to deliver notifications. The recipients handle it to deliver notifications.
• Retention: the ID Firebase creates for each installation of the app remains until the Operator deletes it, and is gone within 180 days after deletion. Expo stores values identifying where to deliver notifications in order to deliver them.
• How to stop it: nothing is sent if you turn off every type in "Settings" → "Notifications," or if you do not allow notifications on the device.

Purchase management (app)

• Recipient: RevenueCat, Inc. (the RevenueCat SDK), United States
• Information sent: your identifier (App User ID), the store's purchase receipt and purchase information, records of the purchase screen being shown, the OS and store type, device model, OS and app versions, app identifiers, language, and the IP address used to determine the country. On iPhone and iPad, the identifier the device creates for each app developer (as described under "Buying Premium" in "2. Information we collect")
• Purpose: the Operator uses it to check the state of Premium purchases, renewals and restores, and to manage each plan's features. RevenueCat handles it on the Operator's behalf to manage purchases.
• Retention: until the account is deleted. The IP address is not stored after the country is determined.
• How to stop it: it cannot be stopped (it is needed to manage purchases).

App usage data (app)

• Recipient: Google LLC (Google Analytics for Firebase), United States
• Information sent: the analytics ID, the app instance ID, app usage, device and OS information, language, first launch and sessions, app and OS updates, ad requests, views and clicks, receipt and opening of notifications, records of in-app purchases and subscriptions, the Android install source, and the IP address (as described under "App usage data" in "2. Information we collect")
• Purpose: the Operator uses it to aggregate app usage, understand how people learned about the app, started using it and keep using it, and improve the app's features and ease of use, Premium offers and promotion methods. Because data sharing settings are turned off, Google uses it only to provide, maintain and protect the analytics service (including technical support when the Operator asks for it).
• Retention: data that records each screen view, interaction and the like is kept for 14 months from collection (the copy the Operator exports to BigQuery is also deleted after 14 months). If you stop sending or delete your account, the Operator deletes its copy and asks Google to delete the data. Of the first records sent when sending starts, those that carry neither the analytics ID nor the app instance ID are handled as described in "6. Retention and deletion."
• How to stop it: in "Settings" → "Account" → "Usage data." Stopping also erases records left on the device that have not been sent.

How Google handles the information it receives is also described in How Google uses information from sites or apps that use our services and in Google's reference information on external transmission (in Japanese).

6. Retention and deletion

• Household and item information, photos and documents: stored until you delete them, delete the household or delete your account. They are not deleted automatically even if you have not used the Service for a long time.
• Trash: items moved to the trash are kept for 30 days, along with their photos, documents, memories and the like. After 30 days, they are permanently deleted automatically. Tags and memories do not go to the trash; they are permanently deleted right away after you confirm. Deleting a household cannot be undone.
• Files of deleted photos and documents: kept hidden for 7 days so they can be recovered if deleted by mistake, then permanently deleted. Photos and documents being received, and temporary photos for AI, are deleted once processing ends; any left over are deleted automatically after one day.
• AI suggestions and processing status: deleted 24 hours after they are created.
• Inputs to the AI (including photos sent) that Google logs to check for abuse: only when Google detects suspected abuse, up to 90 days.
• Action records: deleted 30 days after they are created. Even if you delete tags or memories, copies contained in action records remain until then.
• Notification delivery records: deleted 90 days after delivery ends. Notification device registrations are removed when you turn off all notifications, sign out or delete your account.
• Records of purchase status notices sent from RevenueCat to the Operator's server: deleted after 90 days.
• App usage data: data in Google Analytics that records each screen view, interaction and the like is deleted by a monthly process once 14 months have passed since collection. Aggregated reports are not deleted. The copy exported to BigQuery is deleted 14 months after export. If you stop sending or delete your account, the Operator deletes from its copy the records of that analytics ID and of the app instance IDs that were sending with that analytics ID, and also asks Google to delete them by both IDs. To cover records that arrive late, this is done twice: when we receive the request, and 8 days later. Deletion at Google is carried out under Google's procedures and timing. However, the first records sent when sending starts (including when it restarts or when you sign in again), such as the first launch and the start of a session, are sent without either the analytics ID or the app instance ID. Of these, the Operator deletes from its copy those that can be reliably linked to that analytics ID's records on the same device, but those that cannot be linked are not deleted (they are deleted 14 months after export). These records are not covered by deletion requests to Google (how long Google keeps them is set by Google). Until the second round is done, the analytics ID, the app instance IDs and the processing status are kept, without being linked to your account, so that the requests can be made again; they are deleted once it is done (normally within 9 days of receiving the request). Data deleted in BigQuery remains in Google's systems for up to 9 days for recovery.
• Invitation records: kept until the household is deleted or the owner's account is deleted.
• Records of household sharing events (shown in News): deleted 90 days after they are recorded.
• History of contents insurance changes: kept until the household is deleted.
• Emails and response records of inquiries (by form and by email, including requests for disclosure and the like and requests to delete accounts): those more than one year past the end of the month in which we finished responding (for those needing no reply, the month we decided no reply was needed) are deleted together once a month. Where needed to comply with the law, for disputes or for security investigations, they are kept only for as long as needed. Hash values of inquiries reach their expiry after 48 hours, and records of the number of submissions 24 hours after the end of the limit period, and are normally deleted within 24 hours after that.
• Summaries of bug reports and requests, and records of inquiries (GitHub): kept without a set period, as records of development and our responses. After the original email is deleted, the summaries and records are not used in connection with the person who made the inquiry.
• Inquiry emails sent to Anthropic to sort and summarize: up to 30 days on Anthropic's servers. If Anthropic detects suspected abuse, up to 2 years (and up to 7 years for the results of its assessment), or for as long as required where required by law. Logs of the sorting and summarizing work left on the Operator's devices are deleted on the same schedule as the inquiry emails.
• Addresses to which a receipt confirmation email could not be delivered, and addresses whose recipients reported it as spam: remain on Amazon SES's suppression list, so that we do not send to the same address, until the Operator removes them.
• Server logs: deleted after 30 days. Where needed to investigate a security incident, kept only for as long as needed. Records of administrative operations (which contain no user information) are kept for 400 days.
• IP addresses kept by Firebase Hosting: a few months (kept by Google to detect abuse and understand usage).
• Data in Google Analytics that records each page view or interaction: deleted by a monthly process once 14 months have passed since collection. Aggregated reports are not deleted. How long cookieless measurement information is kept is set by Google.
• The copy of website analytics records exported to BigQuery: deleted 14 months after export. Data deleted in BigQuery remains in Google's systems for up to 9 days for recovery.
• Backups: to recover from failures and mistaken operations, we keep 7 days of database history and daily backups (kept for 7 days, in Japan). Data that has been changed or deleted (including deleted accounts) remains in these for up to 7 days. They are used only to recover from failures and mistaken operations, and the data of deleted accounts is not restored. If the whole database is restored from a backup, it returns to the state at the time the backup was taken (normally within the past day, at most about 2 days before), so later changes may be lost or deleted data may come back. In that case, we will tell you in News in the app.

Records deleted on expiry are normally deleted within 24 hours after they expire.

Deleting your account

You can delete your account from "Settings" → "Account" → "Delete account" after verifying your identity. You can also delete it on the website's account deletion page by signing in with your Google or Apple account. Deleting removes the following information, in order: purchase management records (RevenueCat customer records), households you own (items, tags, memories, photos, documents, invitations and the like), plans and usage counts, consent records, notification settings and device registrations, your usage data choice, and sign-in information (the Firebase Authentication user). App usage data that was sent is deleted from the Operator's copy, and we ask Google to delete it (in two rounds, as described for app usage data in the retention list). Records the app kept on that device (the ID of the household you selected, a cache of photos shown, usage records not yet sent and the like) are also erased. If you delete on the website, the records kept on a device with the app installed are erased when you delete the app on that device. Files saved to your device or sent to other apps are not erased (see "7. Your choices"). Deleting your account does not cancel App Store or Google Play subscriptions.

• While your own household has members, remove their sharing before deleting.
• In households you joined as a member, your member information (including your display name) is deleted. The content, photos and documents you added to or edited in that household remain in the household, and your user ID is removed from those records.
• For records of household sharing events, those addressed to you are deleted, and your display name and user ID are removed from those addressed to others.
• To check the progress of the deletion, a record containing only a hash value made from your user ID and the processing status is kept for 30 days after the deletion is complete.
• It may take up to 180 days for Firebase Authentication user information to be removed from Google's systems.
• Even if you sign up again with the same Google or Apple account, deleted data does not come back.

If you cannot use the app, you can sign in and delete your account on the account deletion page. If you cannot sign in, you can request deletion by form or email, following the instructions on the same page.

7. Your choices

• You can stop and restart sending app usage data in "Settings" → "Account" → "Usage data." Stopping ends sending to Google Analytics and erases records left on the device that have not been sent; for data already sent, we delete the Operator's copy and ask Google to delete it (see "6. Retention and deletion"). Restarting creates a new analytics ID, which is not linked to earlier records.
• In regions where the law requires privacy choices for ads, "Ad privacy settings" appears in "Settings" → "Terms and policies," where you can change your choice. Even without making a choice, you can use every feature other than ads.
• You can stop and restart website analytics with "Cookies and analytics" at the bottom of each page. When stopped, that browser does not load the Google tag, and Google Analytics cookies are deleted. Records sent before then remain in Google Analytics and in the BigQuery copy until their retention period ends. The setting is kept for each browser, and goes back to the default if you clear the site's data. We do not respond to browsers' Do Not Track signals, because there is no agreed standard for how to treat them. To stop analytics, please use this setting.
• You can turn each type of notification on or off in "Settings" → "Notifications." You can change permissions for the camera, photos and notifications in your device's settings. Even if you turn notifications off or do not allow them on the device, you can use every feature other than notifications.
• You can save the Inventory CSV (Premium and the Premium trial) and documents to your device or send them to other apps. Files saved to your device and files at places you sent them cannot be deleted by the Operator, even after you sign out, delete your account or leave a household.

8. Security measures

• Basic policy: we have set a policy for handling personal data appropriately, and publish it in this policy.
• Rules for handling: we have set the methods and responsibilities for collecting, using, storing, providing and deleting data as operating procedures.
• Organizational measures: we limit the people who handle personal data and their permissions to what is needed, and have set procedures for reporting and responding to incidents.
• Human measures: we ensure that people who handle personal data keep it confidential and handle it appropriately.
• Physical measures: we prevent the theft and loss of devices that handle personal data, and use screen locks and encryption.
• Technical measures: encryption of communications, verification of signed-in users, access control by household, private storage and URLs valid only for a short time, minimizing administrative permissions, multi-factor authentication for administrative accounts, and monitoring of logs. Photos are re-created without metadata. Documents are not checked for viruses and are delivered as received to the owner and members of the same household.
• Understanding the external environment: when handling personal data outside Japan, we take security measures after understanding that country's system for protecting personal information (see "5. Service providers and handling outside Japan").

Complete security on the internet cannot be guaranteed.

9. Requests for disclosure and the like

For retained personal data, you can request notification of the purposes of use, disclosure (including disclosure of records of provision to third parties), correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties.

• How to request: choose "Privacy" on the inquiry form, or tell us what you are requesting at support@monogoo.com.
• Verifying your identity: please tell us the email address shown in the app's "Settings" → "Account." We will send a confirmation email to that address and confirm that you are the person concerned, for example by your reply. For requests by an agent, please provide documents confirming the agent's authority.
• Method of disclosure: we disclose by the method you request, such as by email. If that method is difficult, we will discuss it with you.
• No fee is charged.

You can check, correct and delete much of what you have added in the app. If you live outside Japan, you can also request, in the same way, the exercise of rights granted by the laws of your country or region (see "13. For users outside Japan").

10. Use by minors

The Service is not directed at children under 13. If you use the app through the App Store or Google Play outside Japan, you must be 13 or older. For these users, we do not knowingly collect personal information from children under 13, and if we learn that we have collected it, we will delete it.

Minors should use the Service with the consent of a parent or other legal guardian. Please also check with your legal guardian whether to keep sending app usage data.

We do not ask for your date of birth. For users of the App Store or Google Play in the United States, when the store provides an age range or the status of a parent's consent, the app reads it on the device to comply with the law. This information is used only to determine whether you can use the Service and to check changes that require a parent's approval, and the age range is not stored. It is not sent to the Operator's servers, to ads, to usage analytics or to any other third party.

11. Changes to this policy

We revise this policy in response to changes in features, service providers, laws and the like. We change the purposes of use only to the extent reasonably recognized as related to the purposes before the change, and notify you of or publish the changed purposes. If we handle personal information beyond that scope, we obtain your consent in advance. For changes with a significant effect on your rights or the purposes for which your information is used, we let you know in the app and, where necessary, ask you to review the latest version. The content of this version is always available at https://monogoo.com/privacy/versions/2026-10-21-v1 (the Japanese original; this translation is at https://monogoo.com/en/privacy/versions/2026-10-21-v1).

12. Contact and complaints

For questions about this policy or the handling of your information, complaints, and requests for disclosure and the like, choose "Privacy" on the inquiry form. If you cannot use the form, contact us at support@monogoo.com. We accept inquiries in Japanese and English (the English inquiry form is at https://monogoo.com/en/support).

13. For users outside Japan

• Where information is handled: the Service is provided from Japan by an operator in Japan, and users' information is stored mainly in Japan. We also use the businesses in the United States and elsewhere listed in "5. Service providers and handling outside Japan." The information of users who live outside Japan is also handled in Japan and in the countries listed there.
• Age: if you use the app through the App Store or Google Play outside Japan, you must be 13 or older (see "10. Use by minors").
• Household settings: a household's time zone and currency are set from the device's settings when the household is created. The owner can change the time zone later. The owner can choose the currency again only while the household has no items and no contents insurance records (see "Household and item information" in "2. Information we collect"). Members also record amounts in the household's currency. Amounts are recorded in the household's currency, and currencies are not converted.
• Rights and complaints: if the laws of your country or region grant rights such as checking, correcting or deleting your personal information, you can make requests in the same way as in "9. Requests for disclosure and the like." You can also lodge a complaint with the personal information protection authority of your country or region.
• Contact: for users who live outside Japan, including inquiries about Singapore's Personal Data Protection Act (PDPA), the contact is the same as in "12. Contact and complaints."

14. Language of this policy

This policy is written in Japanese. An English translation is also provided, but in case of any discrepancy between the Japanese and English versions, the Japanese version prevails.