Recoria
Privacy Policy
Service: Recoria／Established: July 18, 2026／Last updated: October 22, 2026 (information collected and retention for the trip planning features added; paid plan names changed)／Operator: Tsubasa Kitajima ("we", "us")
This is an English translation provided for reference. The Japanese version is the governing text, and it prevails if there is any difference between the two.
This Privacy Policy explains how we handle user information in Recoria, a travel journal and sharing app (the "Service").
1. Information we collect
- Account information: Your email address, display name and profile picture obtained when you sign in with Google or with Sign in with Apple (Apple ID). The user ID, bio, profile picture, cover image, travel style tags and next destination that you set.
- Content you post: Photos, text, trip type, budget range, prefecture tags, hashtags, comments, likes, follows, bookmarks, "Want to go" items, prefectures visited, countries visited and badges earned.
- Trip plans: What you create with the Trip Planning plan features: trip title, number of days, departure date, destination prefectures, daily schedule items (time, place, notes), packing lists and packing list templates, budget (categories, amounts, limit), cover settings for the trip booklet, and the links between trips and posts. Only you can see these; they are not shown to other users. The booklet PDF is created on your device and is not stored on the Service's servers.
- Location data attached to photos: We may read the location where a photo was taken (EXIF GPS data) on your device in order to detect the prefecture you visited. To do so, the latitude and longitude are sent to the reverse-geocoding API of the Geospatial Information Authority of Japan, without any information that identifies you. This does not happen if your photo has no location data. Only the resulting prefecture code is stored; precise latitude and longitude are not stored.
- Purchase information: If you purchase a paid plan, the plan, subscription status, subscription period and an anonymous subscriber identifier issued by the store. We never receive your credit card number or other payment details (payment is handled by the App Store).
- Reports and blocks: The targets of reports and blocks you make, and the reasons.
- Contact information you send us: When you use the in-app contact form, the category (bug, how to use, etc.), your message, your reply-to email address (only if you enter one), the app version and the type of OS. These are stored linked to the account that sent them. If you contact us by email, your email address and the content of your email.
- Technical information: IP address, device and browser type and similar information sent automatically when you access the Service (obtained through our hosting provider).
- Usage information: To improve the Service, we record the following actions. We record only the fact that an action occurred, and its count and type; the content of posts, photos, user IDs, email addresses and similar content is not included.
- Actions recorded: completing sign-up, setting a user ID, saving a post, liking, adding to "Want to go", saving to bookmarks, viewing paid plan details, redeeming an invite code, going to the App Store, scrolling the feed, opening a post, showing the in-app review request, sending a contact message (category only; your message and email address are not sent), and translating a post (only the language pair and whether a saved translation was used; the post text and translation are not sent). We do not send which post an action was taken on.
- In the app, we also record app launches, resumes and moves to the background. On the web, we record the pages you view.
- We also collect your approximate region estimated from your IP address (country and city level), device, OS and app version, the referring URL, and an identifier to distinguish users (your account ID while signed in, or a randomly generated identifier when not signed in).
- Information stored on your device: On the web, we use your browser's local storage (a mechanism similar to cookies) to keep you signed in and for the usage analysis above. We do not use cookies themselves. Neither is used for advertising tracking.
2. How we use information
- To provide, maintain and improve the Service (authentication, showing posts, coloring in the map, notifications, etc.).
- To improve features through usage analysis (understanding which features are used and where users get stuck; not to evaluate or select individual users).
- To provide paid plans (the Extended plan, the Trip Planning plan and the Bundle) and manage subscription status (including determining which features are available on each plan).
- To respond to misuse and violations of our Terms (including operating the report and block features).
- To respond to your inquiries (including notifying the operator of new inquiries by email).
- To translate post text: When you tap the "Translate" button on a post, the text of that post is machine-translated and shown to you. The translation is stored in the Service's database so the same post does not need to be translated again, and it is deleted together with the post. Only posts whose button is tapped are translated.
- To show ads (banner ads in the iOS app on the free plan; only non-personalized ads that are not based on your interests).
3. Sharing with and outsourcing to third parties
Except as required by law, we do not provide personal information to third parties without your consent. To operate the Service, we use (outsource to) the following external services.
| Company | Purpose | Information that may be sent |
|---|
| Google LLC | Sign-in (OAuth) | Information needed for authentication |
| Apple Inc. | Sign in with Apple; payment for paid plans | Information needed for authentication and purchases |
| Supabase Inc. | Database, authentication platform and image storage | The registration and posting information described in this Policy |
| Vercel Inc. | Hosting of the web version | Technical information sent when you access the Service |
| RevenueCat, Inc. | Managing subscription status | Plan, subscription status, subscription period, subscriber identifier issued by the store, device information |
| PostHog, Inc. | Usage analysis (to improve features) | The action records, identifier, approximate region, device, OS and app version and referring URL described under "Usage information" in Section 1. Subscription status is linked through RevenueCat |
| Geospatial Information Authority of Japan | Converting latitude and longitude to a prefecture | Photo latitude and longitude (without personally identifying information) |
| Rakuten Group, Inc. (Rakuten Affiliate) | External links from the "Find a place to stay" button | An identifier added to the link when you follow it |
| Google LLC (Google AdMob) | Ads in the iOS app (non-personalized ads only) | Device identifier, IP address (to estimate approximate location), ad views and interactions, diagnostic information |
| Cloudflare, Inc. | Translating posts (machine translation with Workers AI) and relaying contact notifications (server processing) | The text of posts whose Translate button is tapped, the content of contact messages (as described in Section 1), technical information sent with access. Text sent for translation is not used to train AI models (under Cloudflare's Workers AI terms) |
| Plus Five Five, Inc. (Resend) | Notifying the operator of contact messages by email | The content of contact messages (as described in Section 1) |
Each external service also handles information under its own privacy policy. We show only non-personalized ads and do not track you across apps or websites for advertising.
4. Transfers to third parties in foreign countries
The Service provides personal data to the following third parties located outside Japan. By registering for the Service and agreeing to this Policy, you consent to these transfers.
| Recipient | Country | Information provided |
|---|
| Google LLC (authentication, ads) | United States | Information needed for authentication; information related to ads |
| Apple Inc. (authentication, payment) | United States | Information needed for authentication and purchases |
| Supabase Inc. (database, storage) | United States | The registration and posting information described in this Policy |
| Vercel Inc. (hosting) | United States | Technical information sent when you access the Service |
| RevenueCat, Inc. (subscription management) | United States | Plan, subscription status, subscription period, subscriber identifier |
| PostHog, Inc. (usage analysis) | United States | The action records, identifier, approximate region, device, OS and app version and referring URL described under "Usage information" in Section 1 |
| Cloudflare, Inc. (translation and server processing) | United States | The text of posts whose Translate button is tapped, the content of contact messages, technical information sent with access |
| Plus Five Five, Inc. (Resend, email delivery) | United States | The content of contact messages |
- Information on the personal information protection system of the foreign country: For the personal information protection system of the United States, please see the survey of foreign systems published by the Personal Information Protection Commission of Japan (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/, in Japanese).
- Measures taken by the recipients to protect personal information: Each company above sets out security measures for personal data, limits on the purposes of use, management of subcontractors and similar matters in its privacy policy and data processing terms, and we use each company on that basis.
- For questions about this section or to request details, please contact us using the information in Section 13.
5. External links
The Service contains links to external sites (such as accommodation booking sites), including affiliate links. We are not responsible for how information is handled on linked sites.
6. Security measures
We take the following measures to prevent leakage, loss or damage of the information we collect and to otherwise keep it secure.
- Organizational measures: Personal data is handled by the operator alone, who keeps track of how it is handled. We have a procedure for reporting and communication in case of a leak or similar incident.
- Personnel measures: No one other than the operator handles personal data. When outsourcing work to a third party, we confirm conditions including confidentiality before doing so.
- Physical measures: Devices used for the Service are protected with screen locks and similar measures so that third parties cannot operate them.
- Technical measures: Communications are encrypted with HTTPS. The database uses row-level access control (Row Level Security) so that users can access only the data they are permitted to access. Authentication uses the Google and Apple authentication platforms, and we never hold your password. Administrative permissions are kept to the minimum necessary.
- Understanding the external environment: Some personal data is stored on servers located in the United States. We take the measures described in Section 4 with an understanding of that country's personal information protection system.
7. Retention and deletion
- Posts and account information are kept until you delete your account.
- The Service provides account deletion from within the app. When you delete your account, your account and the related posts, likes, comments, follows and other data are deleted (except backups and data we are required to keep by law).
- When you delete a post or your account, the images are no longer shown in the Service. For technical reasons, deleting the image files themselves from storage may take some time. If you would like them deleted promptly, please contact us using the information below.
- Messages sent to us through the contact form are kept as a record of our response and are deleted when you delete your account.
- Trip plans are deleted when you delete your account. When you delete a trip, its schedule, packing list and budget are also deleted (posts that were linked to the trip are not deleted).
- Deleting your account does not automatically cancel a paid plan subscription. Please cancel your subscription separately in your App Store settings (Terms of Use, Article 8; in Japanese).
8. Use by minors
Children under 13 may not use the Service. Minors should use the Service with the consent of a parent or guardian. If you purchase a paid plan, please obtain the consent of a parent or other legal guardian in advance.
9. Requests for disclosure, correction, deletion and more
You may request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure and suspension of provision to third parties of personal data we hold about you. You can do much of this through the in-app settings and account deletion, or contact us using the information in Section 13. Once we have confirmed your identity, we will respond without delay. We do not charge a fee.
10. Complaints
Complaints about how the Service handles personal information are accepted at the contact information in Section 13. We are not a member of an accredited personal information protection organization.
11. Changes to this Policy
We may change this Policy as necessary. We will announce important changes in the app or on our website.
12. Operator information
Name: Tsubasa Kitajima (sole proprietor)
Address: Because we operate the Service as an individual, our address is not published on this website. If you would like it disclosed, please request it using the contact information below and we will respond without delay.
13. Contact
Please contact us from "Settings > Contact us" in the app, or at the email address below.
Email: recoriaapp@gmail.com
Operator: Tsubasa Kitajima
14. Language
The Japanese version of this Policy is the governing text. This English version is a translation provided for reference, and the Japanese version prevails if there is any difference.
15. For users outside Japan
If you live outside Japan (including the United Kingdom), the following also applies in addition to the sections above.
- Controller: Tsubasa Kitajima (see Section 13 for contact details).
- Legal bases: We process data to perform our contract with you (your account, posts, paid plans and other parts of providing the Service), for our legitimate interests (usage analysis, responding to misuse, security and non-personalized ads), on the basis of your choice to use a photo that contains location data (for reading photo location data), and to comply with legal obligations where required.
- Your rights: You can request access to your data, correction, erasure, restriction of processing, objection to processing based on legitimate interests (including usage analysis), data portability, and withdrawal of consent. Contact us using the information in Section 13, and we will respond, in principle, within one month.
- International transfers: Your data is processed in Japan, where the operator is located, and in the United States, where the companies in Section 3 are located. It is protected under each company's data processing terms (including standard contractual clauses where applicable).
- Retention of usage information: Usage information recorded in PostHog is kept for as long as needed for analysis. It is not deleted automatically when you delete your account. If you would like it deleted, please contact us using the information in Section 13.
- Complaints: In addition to contacting us (Section 10), you can lodge a complaint with the data protection authority in your country (in the United Kingdom, the Information Commissioner's Office (ICO)).