Privacy Policy
Established: October 4, 2026
This is a translation provided for reference. The Japanese version is the original, and it prevails if the two versions differ.
This Privacy Policy explains how Guinea Pig LLC (the "Operator") handles the personal information of users of Sho (the "Service").
§1. Operator
- Name: Guinea Pig LLC
- Contact: [email protected]
§2. Information We Collect
| Information | When we collect it |
|---|---|
| Username, display name, email address, and password | When you register or change your account. Passwords are stored in a form that cannot be reversed (a hash), and the original is never stored |
| Card text, titles, visibility, language, and uploaded images | When you create or edit a Card |
| Settings such as the languages of Cards to show | When you change your settings |
| IP address, browser type (User-Agent), access time, and accessed URL | When you access the Service (server access logs) |
| Details of errors that occur in your browser (such as the URL and message) | When an error occurs |
| Pages viewed, referrer, browser type, page load time, and similar | When you view a page (web analytics; see Section 6) |
| The content of a report, and the name and email address of the person reporting | When we receive a report of rights infringement |
§3. Purposes of Use
| Purpose | Information | Legal basis |
|---|---|---|
| Registering accounts, verifying identity, and logging in | Account information | Providing the Service (performance of a contract) |
| Storing, displaying, and publishing Cards | Cards and settings | Providing the Service (performance of a contract) |
| Sending important notices about the Service and answering inquiries | Email address | Providing the Service (performance of a contract) |
| Dealing with unauthorized access, spam, and violations of the Terms | Access logs and account information | The Operator's legitimate interests |
| Handling reports of rights infringement | Report content, Cards, and account information | The Operator's legitimate interests |
| Investigating failures, fixing bugs, and understanding and improving usage | Access logs, error details, and web analytics | The Operator's legitimate interests |
| Responding as required by law | Information to the extent necessary | Legal obligations |
The Operator does not use personal information beyond these purposes, and does not use it for advertising.
§4. Disclosure to Third Parties
The Operator does not provide personal information to third parties without your consent, except in the following cases:
- When required by law
- When necessary to protect a person's life, body, or property, and it is difficult to obtain your consent
- When necessary to cooperate with a national or local government body carrying out duties prescribed by law
Note that Cards set to "Public", and usernames and display names, can be viewed by anyone on the Service.
§5. External Services and Transmission of Information
The Operator uses the following external services to run the Service, and entrusts them with handling personal information to that extent. Where information is sent directly from your device to the recipient, it is marked in the "Sent from your device" column.
| Recipient | Purpose | Information handled or sent | Sent from your device |
|---|---|---|---|
| SAKURA internet Inc. (Japan) | Running the servers and sending email | All information stored in the Service, and the content of emails sent | No |
| Cloudflare, Inc. (United States) | Storing backups | All information stored in the Service (encrypted) | No |
| Cloudflare, Inc. (United States) | Relaying and protecting traffic | The content of communication with the Service, IP address, and similar | Yes |
| Cloudflare, Inc. (United States) | Web analytics (Cloudflare Web Analytics) | URL of the page viewed, referrer, browser type, page load time, and similar | Yes |
| Google LLC (United States) | Delivering the heading typeface (Google Fonts) | IP address, browser type, and the URL of the page being viewed (as the referrer) | Yes |
For how each company handles information, see their privacy policies.
§6. Cookies and Web Analytics
The Service uses the following cookies. All of them are needed for the Service to work, and none are used for advertising or for tracking you across other sites.
| Name | Purpose | Retention |
|---|---|---|
sho_session |
Keeping you logged in | Until you log out or it expires |
i18n_redirected |
Remembering the display language | A certain period |
sidebar_width |
Remembering the width of the sidebar | A certain period |
To understand how the Service is used, we use Cloudflare Web Analytics. Cloudflare Web Analytics does not use cookies and does not identify or track individual users.
§7. Retention Period
- Account information, Cards, and images: kept until you delete your account, and erased immediately when you do (except for the backups and records of measures below). Accounts with no login for a long period may be deleted in accordance with Article 7 of the Terms of Service.
- Backups: taken regularly in case of failure, and erased oldest first after a certain period. Therefore, even after you delete your account or a Card, it remains in backups for that period.
- Records of measures taken by the Operator (such as hiding Cards or suspending accounts), and the reports that led to them: kept even after the account is deleted, in case of disputes.
- Images removed from the text of a Card: erased after a certain period.
- Login information: erased when you log out. If you do not log out, it is erased periodically after it expires.
- Temporary information used for email verification, password reset, and similar: erased periodically after it expires.
- Access logs and error records: erased oldest first once they exceed a certain size.
§8. Security Measures
To prevent leakage, loss, or damage of personal information, the Operator takes the following measures:
- Encrypting communication (HTTPS)
- Encrypting backups (stored in a form that even the storage provider cannot read)
- Storing passwords and login information in a form that cannot be reversed (a hash)
- Restricting access to the servers and database to those who need it to run the Service
- Protecting against unauthorized access, for example by limiting the number of login attempts
§9. Your Rights
You can:
- Change your registered information from the Settings page.
- Download each Card, with its text and images bundled together.
- Delete your account and data from the Settings page.
- Request disclosure, correction, suspension of use, deletion, and so on, of the personal information we hold: contact us at the address in Section 12. After confirming your identity, we will respond in accordance with the law.
If you live in the European Economic Area (EEA) or a similar region, you can also lodge a complaint with the data protection authority in your country.
§10. Personal Information of Minors
You may not register an account if you are under 16 years old. If you are under 18 years old, you must obtain the consent of a parent or other legal guardian before using the Service.
§11. Changes to This Policy
The Operator may change this Policy in line with changes to laws or to the Service. We will announce important changes on the Service.
§12. Contact
For inquiries and requests about the handling of personal information, please contact:
- Operator: Guinea Pig LLC
- Email: [email protected]
This Policy is written in Japanese. The English version is a translation for reference, and the Japanese version prevails if the two versions differ.