Privacy Policy
Last updated: August 1, 2026
This is a complete English translation of cotobo’s Privacy Policy, provided for convenience. The
Japanese version is the governing text. In the event of any conflict or discrepancy between this translation and the Japanese original, the Japanese version controls.
cotobo is currently provided as a beta service. This Policy may be revised in the future; if it is, we will update this page to announce the change.
Tomoki Kawashima (“the Operator”) sets out this Privacy Policy (“this Policy”) for how personal information is handled within cotobo (“the Service”), a lesson-management service for users. The definitions of “User” and “Client” in this Policy are as set out in Article 1 of the Terms of Service.
Article 1 (Information We Collect)
1. User account information
- Email address; password (managed within our authentication provider — the Operator never holds it in plain text); display name; time zone; default currency; and other in-app settings.
- If Google Calendar sync is set up: the email address of the connected Google account, an authentication token (stored encrypted), and event data from the calendars selected for sync (read-only — cotobo never writes events back to Google Calendar).
2. Client information entered by Users
- Name, email address, target/native language, interests, level, time zone, lesson schedule and fees, lesson notes and memos the User records, portal access settings, and similar information.
- Audio recordings of lessons (only when the User uses the recording feature; audio data is stored in the Service’s data storage)
- This information is entered by the User for their own use of the Service — the Operator does not collect it directly from clients.
3. Usage logs and similar data
- Log data such as access timestamps and IP addresses.
- Information stored in cookies and local storage (see Article 4 for details).
Article 2 (Purposes of Use)
- To provide the Service (lesson records, client management, fee and finance management, calendar sync, invoicing, the client portal, and the like).
- To provide AI-assisted features (translation of selected words or sentences, meaning explanations, example sentences, natural rephrasing, and review quizzes; vocabulary-lookup assistance; and katakana readings of client names).
- To send lesson-review reminder emails, invoice emails, and the like.
- To investigate and respond to issues, and to maintain and improve the Service.
Article 3 (Disclosure to Third Parties)
The Service uses the following third-party services, and shares the information necessary for each stated purpose:
| Recipient | Purpose | Information shared |
|---|
| Supabase | Database and authentication platform (where the Service’s data is stored) | All data within the Service — user account information, client information, lesson records, and more. |
| Vercel | Hosting and server runtime environment for the Service | Access logs, etc. |
| Google Calendar API | Only when a User sets up Google Calendar sync, to read events from the selected calendars (read-only) | The connected Google account’s email address, and calendar event data. |
| Anthropic API (Claude) | Processing for AI features (translation of selected words or sentences, meaning explanations, example sentences, natural rephrasing, review quizzes, vocabulary-lookup assistance, and katakana readings of client names) | Depending on the feature: material text, portions of lesson notes the User has entered, and the client’s target language, level, and interests. Only the katakana-reading feature also sends the client’s name. |
| DeepL API | Translation of lesson notes and similar content | Only the text selected for translation. |
| Resend | Sending email (lesson-review reminders, spaced-repetition reminders, invoice delivery, availability notices) | The recipient’s email address, plus — depending on the email type — the client’s name, lesson content, invoice details, and similar information. |
| Exchange-rate API (exchangerate-api.com) | Retrieving exchange rates for currency conversion | None — only exchange-rate data, which contains no personal information. |
Some of the third-party services the Service uses may be operated by providers located outside Japan, or may use servers located outside Japan. The Operator has these third-party services handle information only to the extent necessary to provide the Service.
Beyond what is listed above, the Operator does not disclose personal information to third parties without the individual’s consent, except as required by law.
Article 4 (Cookies and Local Storage)
The Service uses cookies and browser local storage for the following purposes. They are not used for advertising or tracking.
Essential (required to provide the Service)
- Authentication session cookie (keeps you logged in)
- A temporary CSRF-protection cookie used during Google Calendar linking
- Client portal session cookie (keeps the portal login state)
Optional (to preserve your experience of the Service)
- Display preferences (sidebar open/closed state, notebook editor font size and line spacing, etc.)
- The language last selected in the translation feature
- The client portal’s display language setting
- Whether the “Getting Started” guide banner has been dismissed
Article 5 (Retention Period and Deletion)
- Collected information is retained for as long as a User uses the Service, to the extent necessary to provide it.
- Users can delete their own account from Settings. Doing so immediately removes all registered data — including client information, lesson records, notebooks, invoices, material files, and audio recordings — from the Service. To protect against accidental deletion, the deleted data is then kept for up to 30 days in a backup accessible only to the Operator, after which it is permanently deleted and can no longer be restored. While retained, this backup is used solely to respond to a restoration request from the User.
- Requests from a client for disclosure, correction, or deletion of their own information will be handled — either through the client’s User, or by contacting us at the address in Article 7.
- If a personal data breach, loss, damage, or other incident occurs, the Operator will carry out the necessary investigation, notification, recurrence-prevention measures, and other reasonable responses, in accordance with applicable law.
Article 6 (User Responsibility for Client Information)
Client Information is entered into the Service by the User. Explaining this to the client and obtaining their consent is the User’s responsibility. See the Terms of Service for details.
Emails sent to clients from the Service include an explanation of why they are being sent (on the basis of the User’s use of the Service) and a means to opt out of future emails.
Article 7 (Contact for Inquiries and Disclosure Requests)
For questions about this Policy, or requests to disclose, correct, or delete personal data we hold, please contact us at the address below.
cotobo@proton.me