Privacy Policy

SpaceNote / StarFactory, Inc.
Last updated: October 12, 2026
This English translation is provided for convenience. If it differs from the Japanese version, the Japanese version prevails.

StarFactory, Inc. ("we", "us") sets out this policy on how we handle user information in the handwriting note app "SpaceNote" (the "App").

1. Information we collect

• Account information: the email address and user identifier used for sign-in (via Firebase Authentication). You can also use the App anonymously.
• Content you create: handwriting, imported PDFs, notes, images and similar content. If you enable cloud sync, this content is stored in our cloud for syncing.
• Purchase information: the purchase and renewal status of subscriptions (processed through RevenueCat and the Apple/Google platforms; we do not hold card or other payment details).
• Diagnostic information: to improve the App's stability, we collect diagnostic information when it crashes, such as where the crash occurred, your device model and OS, and the app version (Firebase Crashlytics).
• Usage and device information: usage such as the days you open the App and how often screens and features are used, plus your device model, OS and app version, and display language (Firebase Analytics and our servers). This does not include the contents of your handwriting or notes.
• Link to your user identifier: we collect diagnostic and usage information linked to your account's user identifier (the Support ID shown in Settings), so that we can investigate inquiries and understand usage.
• Device identifier: to count devices on the free plan and to sync, the App sends our servers a random identifier (UUID) that it generates for each installation. It is not the advertising ID or a hardware identifier of your device.
• Advertising information: to deliver ads, our ad provider (Google AdMob) collects device identifiers such as the advertising ID, your approximate region inferred from your IP address, and whether ads were shown or tapped (Section 5).
• Notification identifiers: your device's token and display language, used to deliver announcements as push notifications (Firebase Cloud Messaging).

2. How we use it

• To provide the App (sign-in, cloud sync and subscription management).
• To answer inquiries and provide support.
• To find problems, improve quality and analyze usage statistically.
• To deliver ads (Section 5) and announcements.

3. Your handwriting and other content, and machine learning

We use the handwriting, notes, PDFs and other content you create only to sync it and provide the service. We never use this content to train machine-learning (AI) models.

4. Sharing and service providers

Except as required by law, we do not share personal data with third parties without your consent. To the extent needed to provide the service, we use external services for sign-in, diagnostics, usage analytics and notifications (Google Firebase), payments (RevenueCat, Apple, Google), advertising (Google AdMob) and cloud storage (such as Cloudflare R2). These providers may handle data outside Japan (Section 8).

5. Advertising

Ads (Google AdMob) are shown when you use the App for free. They are not shown while you have the paid plan (Cloud Sync) or the Remove Ads plan.

• We request non-personalized ads only. On iOS we do not track you across other companies' apps or websites and do not ask for tracking permission.
• Google may use device identifiers such as the advertising ID, and your approximate region, to deliver ads, limit how often they appear, prevent fraud and measure performance. See How Google uses information from sites or apps that use our services.
• On Android you can reset or delete your advertising ID in your device settings (Privacy > Ads).
• On Android devices in regions that require consent, such as the European Economic Area and the UK, we ask for your consent before showing ads. You can change your choice at any time in Settings > Account & data > Ad privacy settings.

6. Retention and deletion

When you delete your account from "Account & data" in the App, we erase your sync data and stored files from our servers. However, to answer purchase inquiries and meet legal obligations, we keep records of purchases and billing (purchase history and entitlement status) and records of sync processing times after deletion; these do not include the contents of your notes.

Analytics and diagnostic data are kept for the periods below and then deleted.

• Usage data in Firebase Analytics (user-level data): [TO CONFIRM: Google Analytics data retention setting]
• Diagnostic information in Firebase Crashlytics: 90 days
• Records of sync processing times on our servers: 90 days
• Usage records on our servers (days the App was opened, feature usage counts, device model and similar): until your account is deleted

Data in the cloud is kept for one year from your last use on the free plan, and with no time limit while a subscription is active on the paid plan. See Article 3 of the Terms of Service for details.

You can also delete only some of your data, such as notes, PDFs or pages, while keeping your account. Anything you delete in the App is removed from the cloud sync data when you sync, and the stored files are erased after a certain period. See Account deletion for the steps.

7. Security measures

We take the following measures to prevent the leakage, loss or damage of personal data.

• Encryption in transit: communication between the App and our servers is encrypted with TLS.
• Encryption at rest: note data and handwriting, PDF and image files stored in the cloud are encrypted with keys managed by our servers.
• Access control: access to the production environment and data is limited to staff who need it for their work, and each person authenticates with their own key.
• Supervision of service providers: we choose service providers after checking how they protect personal data, and require appropriate handling through contracts and terms.

8. Providing data to and using service providers in other countries

To provide the service, we entrust the handling of personal data to the following businesses outside Japan.

• United States Google LLC: sign-in, usage analytics, diagnostics and notifications (Firebase), and advertising (Google AdMob)
• United States RevenueCat, Inc.: managing subscription purchase status
• United States Cloudflare, Inc.: storing handwriting, PDF and image files (Cloudflare R2) and relaying traffic
• United States The Constant Company, LLC (Vultr): infrastructure for our servers and database (data is stored in a data center in Tokyo)

Purchases on the App Store and Google Play are handled by Apple Inc. (United States) and Google LLC (United States) under their own terms.

We have checked the personal information protection system of the United States using the "Survey of Personal Information Protection Systems in Foreign Countries" published by Japan's Personal Information Protection Commission. The United States has no comprehensive federal personal information protection law; personal information is protected by sector-specific federal laws and state laws (such as the California Consumer Privacy Act).

We have confirmed that each of the businesses above sets out security measures and a ban on use for other purposes in its contracts or terms on handling personal data (such as data processing terms), and we entrust data to them on that basis.

9. Use by minors

If you are a minor, please use the App with the consent of a parent or other legal guardian. The same applies to purchasing a paid plan.

10. Act on the Protection of Personal Information (APPI)

We comply with Japan's Act on the Protection of Personal Information. To request notification of the purpose of use, or disclosure, correction, addition, deletion, suspension of use, erasure or suspension of provision to third parties of retained personal data, please contact us below. We will verify your identity and respond in accordance with the law.

11. Business operator and contact

StarFactory, Inc.
Address: 2F Suzuwa Bldg., 5-2-3 Asakusabashi, Taito-ku, Tokyo 111-0053, Japan
Representative: Shunsuke Hondo
Corporate number: 2010501039699

Questions about this policy: [email protected]
Support & FAQ / Terms of Service