Privacy Policy
Contents
- 1. Business Operator and Contact
- 2. Information We Collect
- 3. Purposes of Use
- 4. Sharing Scope (What Is Shown to Users)
- 5. Retention Periods
- 6. Provision to Third Parties
- 7. Entrusting the Handling of Personal Data and Use of External Services
- 8. Information on Transfers to Third Parties in Foreign Countries (Cross-Border Transfers)
- 9. External Transmissions
- 10. Security Measures
- 11. Requests for Disclosure, Correction, Cessation of Use, Deletion, and the Like
- 12. Age and Information About Minors
- 13. Changes to This Policy
- 14. Contact for Inquiries
- 15. For People in the EEA, the United Kingdom, and Switzerland
- 16. For People in the United States
Komadori team ("we", "us" or "our") values the personal information and privacy of users of "Komadori for VRChat" (the "Service"), and handles it as set out below, in compliance with Japan's Act on the Protection of Personal Information (the "APPI") and other applicable laws. The Service is an unofficial service and has no affiliation with VRChat Inc. This English version and the Japanese version of this Privacy Policy have equal weight.
1. Business Operator and Contact
- Operator: Komadori team
- Contact: ing@digital-sorovider.jp (Japanese or English)
- We will promptly tell you the operator's name, address, and representative on request to the contact above. (This is our answer to a request from the person concerned under the APPI.)
2. Information We Collect
The Service collects the following information.
| Category | Content | How it is collected |
|---|---|---|
| Discord account information | Your Discord user ID, display name, and username (through Discord login, within the identify scope only. We do not collect your email address, friend list, server information, and so on. The username is stored so that we can tell whether a resident tool connection is really yours, and is not shown to other users). The identifier of your Discord profile picture (avatar) (a hash value, not the image itself; used only to fetch that picture and make it your account picture when you press "Use my Discord picture") | Discord login |
| Google account information | Only your Google user ID (the OpenID Connect "sub", an identifier that Google assigns to each user and that does not change), collected when you log in with Google or press "Link Google". The scope is openid only; we do not collect your email address, name, profile picture, contacts, and so on. The display name is a temporary name we assign ("User" followed by 4 characters; it is replaced by your VRChat display name once that is known). You can link Discord and Google either one alone or both | Google login |
| Guest information (users who started without logging in) | For users who pressed a button such as "Start without logging in" before October 7, 2026 (from that date, new guests can no longer be created): an internal ID we issue, a temporary display name ("Guest" followed by 4 characters; it is replaced by your VRChat display name once that is known), the time of creation, the time of last use, the number of trial Posts, and a one-way hash made from the IP address at creation time with a salt (a secret value) added (used only to prevent mass creation of fake accounts; we do not store the IP address itself for this purpose). We do not collect Discord or Google information | Guest creation action, resident tool, web |
| VRChat information | Your VRChat user ID and VRChat display name (your resident tool reads them from VRChat's output log and sends them as a self-declaration. We do not check them by querying VRChat) | Resident tool |
| The name you choose | The name you enter in "Choose your name" right after logging in, or in "Name" in Settings (up to 20 characters; you can change it at any time). It is shown to other users, such as the members of your Groups, as your display name | Your actions |
| Account picture | An image you choose and crop to a square (it is shrunk to 256 x 256 pixels on your device before it is sent), or, when you press "Use my Discord picture", your profile picture fetched from Discord by our server (256 x 256 pixels). We keep only one per person, and you can change or remove it at any time | Your actions |
| Language, time zone, and region settings | Your display language; your time zone (a name such as `Asia/Tokyo`, obtained automatically from your browser and changeable on the Account screen); the "NOW!" region derived from it (one of Asia, Europe, or the Americas); and the time offset (difference from Coordinated Universal Time) when a clip was taken. These are used only to adapt notification times and the display language and times to your region. We do not collect location data (such as GPS) | Your actions, web, resident tool |
| Post Content | A 3-second video recording of the view through the VRChat camera's lens (or of the VRChat window, for example when OSC is disabled) (no audio; "NOW!" is the same), a poster image (still image) generated automatically from the video, the time of capture and posting, the world name and ID (can be turned off in the settings; after posting, you can also correct the name or hide it), and a note (caption; up to 100 characters; after posting, you can add or edit it on your own videos). A 3-second video (no audio) of another view of the VRChat camera, with its poster image, that earlier versions of the resident tool recorded at the same time depending on a setting (the "selfie"; other users' avatars or names may appear; the current resident tool does not record selfies). Three reduced still images that the resident tool cuts out of the video while recording and sends (scenes at about 0.3 seconds, the middle, and about 2.7 seconds; JPEG with the long side at most 640 pixels; the "check frames") are discarded without being stored, even when we receive them (for those stored before that, see Sections 4 and 5) | Resident tool, web |
| Relationship information | Account code (an identifier used to confirm a resident-tool connection); Group names, invite codes, and members (including the creator of the Group; up to 20 people per Group); where each video was sent (which Group, and when); your sending settings (your last destinations); the order of your Groups on the home screen (shown only to you); how the videos are laid out in each log (your own display choice); the Group's color and emoji (set automatically when the Group is created; the Group owner can change them); the fact that a Group is a 2-person Group moved over from a former Friend relationship; and a Discord webhook URL that a Group owner has optionally registered (stored as a secret, and displayed partly masked on screen) | Your actions |
| Information about passphrases and invitations in the same instance | Passphrases that Group members issue (three hiragana words; the Group, who issued it, when it was created, and when it expires). Whether the setting "Show me to Komadori users in the same world" (the name shown on screen; matching is done by whether users are in the same instance) is on or off (default: off). While it is on, the location key of the instance you are in, sent by the resident tool (a one-way hash that the resident tool makes from the instance location text in VRChat's output log; we do not receive the original location text. We use the location key only to check whether users are in the same instance, and we do not work out the original location from it), and when it was last sent. Invitations to a Group from users in the same instance (who invited, who was invited, the Group, the time, the expiry, and whether it was accepted or declined) | Resident tool, your actions |
| Information about Public Logs (Everyone's 3 seconds) | The public state of each video (when it was made public and whether to show your name in that day's Public Log), the settings "Always make my clips public" and "Show my name when sharing publicly", when we showed the notice "Please get the OK from anyone in the shot before you share it.", when we stopped a video from being public or picked it for a showcase section, and the result of the automatic check of public videos (passed, or needs review with the reasons (the items that matched, such as sexual content), when it was checked, and how many times we tried), and the record of our approving a video that needed review | Your actions (making public, stopping, changing settings), our actions, and the automatic check |
| Information about Share Pages (sharing with a link) | The record made when you create a Share Page (which videos it shows, their date, whether to show your display name, and when it was created, expires, and was turned off) and the Share Page's thumbnail image (one image your browser makes from your videos' poster images) | Your actions (when you press Share) |
| Settings for what invite pages show | The Group owner's choice "Show yesterday's log on the invite page" (default: on); your choice "Do not show my clips on invite pages" (default: off); the time we showed you notices about these; and whether the guidance shown right after creating a Group has been displayed | Your actions, our processing |
| Information from using the Service | Messages in a Group chat (text and which shared video; for a deleted message we erase its content and keep only when it was deleted) and when you last read the chat, reactions to videos (type and time), when you last opened notifications, votes in Groups made with an earlier feature ("Pick of the day"; the current screens have no voting feature), the day's title, and the Post information used to calculate badges (badges are not stored; they are calculated on the spot) | Your actions, our processing |
| Notification (Web Push) subscription information | Only if you turn notifications on: the subscription information issued by your browser (the URL of the Push service run by your browser's vendor (the endpoint), a public key for encrypting the notification body, and an authentication value); the date and time of subscription and of the last delivery; the number of consecutive failures; on/off settings for each type of notification and the "Pause all notifications" setting; the Groups and users you have muted (their IDs and when you muted them; the people you mute are not told); and a record of notifications sent (type, date and time, and an identifier to prevent duplicate sending; used only to manage the caps on the number of notifications and prevent duplicates) | Your actions (permission in your browser's permission prompt, and "Turn on notifications" on the Account screen or elsewhere) |
| Information about reports and blocks | Reports you make (the Post concerned, the reason, and any added description), the users you block, and the operation record of actions we take (such as deleting a Post or suspending a user) | Your actions, our processing |
| Authentication information | Sessions for login and for device connection (tokens are stored hashed and have an expiry: 30 days for the web, 365 days for the resident tool); the time a device session was last used and the version of the resident tool; whether the clip taken before logging in has been posted, and until when it can be posted (15 minutes after logging in); the resident tool's connection code, the device-side secret code, and the code for handing a login over from the resident tool to the web (stored hashed, and expire quickly); and the short confirmation code shown on screen for device approval (stored as is until it expires after 10 minutes); and the temporary request used when you log in from inside the resident tool (to hand the result of the login in your browser to the tool on that PC: a check value the tool creates (PKCE), the number (port) the tool listens on inside that PC only, the tool's version, the invite code when you came from an invite, a one-way hash made with a salt from the network that created the request (the first part of the IP address), and the hashed confirmation code; it expires after 10 minutes) | Login, device connection |
| Communication and access records | IP address, type of browser and device (User-Agent), request date, time and content, error information, and other records generated in operating the web server. In addition, to prevent abuse (rate limiting), we store in the database for a short time only a one-way hash, made from the IP address (rounded to the first 64 bits for IPv6) with a salt (a secret value) added, together with a count (Section 5). We do not store the IP address itself for rate limiting. Rate limiting for login, device connection, invite lookups, and the like is done by Cloudflare's rate-limiting feature, and we pass it only the same hash, not the IP address itself. For installer downloads, we count only the number per day and per version and do not keep IP addresses | Collected automatically |
| Usage measurement information | Unless you turn measurement off (for use from the EEA, the UK, or Switzerland, only if you consent): the types of screens viewed and actions taken, whether the resident tool's operations succeeded (the type of reason only), an anonymous user ID (an ID made from the internal user ID by a one-way conversion, which no one but us can trace back), the type of browser and device, and the approximate region (as described in Section 9) | Web screens, resident tool, our servers |
| Content of inquiries | The content of inquiries and reports, and your contact details. When you send a message from "Contact" on the screen, we receive the category you chose, the message, the reply contact you optionally wrote, the AI support conversation if you chose to attach it, the screen language, where you sent it from (the app, the VR panel, the web, or a phone), and the app version. When you press "Send logs" in the resident tool, we receive that PC's recent resident-tool activity record (before sending, passphrases, file locations that include the PC's user name, codes in URLs and the like are hidden), the versions of the tool and Windows, the capture and OSC settings and status (including the port numbers OSC uses, checked at the moment of sending, and the names of the programs using those ports), and the lines of VRChat's output log that relate to OSC (the port, and whether OSC could start; we do not receive lines with other users' names, worlds or instances), and we use them only to investigate problems (we do not receive videos or images). To investigate, we may have them read by an AI development assistant we use (Anthropic's Claude) (Article 7) | Your communication to us (including operations in the resident tool) |
| AI support questions | The questions you type into "AI support" on the screen, the AI's answers, whether the AI could answer, the model used, the screen language, and the date and time (Section 7) | Your input |
What we do not collect: screenshot images saved by VRChat, VRChat instance IDs themselves (who you are with and where; while the visibility setting is on, we receive only the location key, which the resident tool has turned into a hash), the list of other users in an instance, audio, Discord or VRChat passwords, and advertising identifiers. The reading you type for kana-kanji conversion with the on-screen keyboard in the in-VR panel is only relayed to Google to get conversion candidates and is not stored (Section 7). The Service does not use ad-serving tools. We use web analytics (Google Analytics); you can turn it off at any time in the settings (for use from the EEA, the UK, or Switzerland, only if you consent. Section 9).
About Cookies and similar technologies
The Service uses the following cookies. All of them are essential to providing the Service, and we do not use them to track your behavior or for advertising.
- A cookie that keeps you logged in (session. 30 days for the web; 7 days for a login handed over from the resident tool)
- Temporary cookies used in the middle of login (including login from inside the resident tool), login from an invite link, and guest registration (10 minutes)
- A cookie that remembers that this browser was used to log in to the resident tool (`kd_app_v`. It holds only the tool's version number. 1 year. Used only to decide whether to show "Open in Komadori" first on invite pages)
- A cookie that remembers your choice of display language (`komadori_lang`. 1 year)
We also store the following in your browser (these stay only in your device's browser and are not sent to our servers. You can delete them in your browser settings).
- localStorage / sessionStorage: the times at which you dismissed guides and cards (adding to the home screen, a request to turn on notifications, first steps, and so on), the number of visits, the Group you chose last, your on/off choice for usage measurement (below), and temporary markers used during notifications and login
- Service Worker and its cache (Cache Storage): to show screens when you are offline, it stores only the public parts of the screens (the program, design, fonts, and logo). It does not store content that requires login (videos and personal data). It is also used to receive notifications (Web Push)
While usage measurement is on, Google Analytics stores cookies (`_ga`, and those starting with `_ga_`) in your browser. While it is off (when you have turned it off in the settings, when your browser's "Global Privacy Control (GPC)" or "Do Not Track" is on, or, for use from the EEA, the UK, or Switzerland, until you consent), we do not load the Google Analytics script or communicate with Google. Your on/off choice is stored in your browser's localStorage. You can turn measurement off at any time with "Usage measurement" on the web "Settings" screen (or in the resident tool's settings); when you turn it off, measurement stops and these cookies are deleted.
3. Purposes of Use
We use the information we collect for the following purposes.
- Providing the Service (login, managing Groups, providing notification times, storing Posts and showing them to members of the Groups you chose as destinations, features such as the day's title, badges, reactions, and chat, invitations to Groups (invite links, passphrases, and invitations to users in the same instance), and sending browser notifications (Web Push) if you turn notifications on)
- Verifying your identity, preventing fraud and impersonation, managing authentication, and preventing misuse such as mass creation of guests (rate limiting by hash values of IP addresses)
- Responding to acts that violate the Terms of Service and to reports of rights infringement, and reviewing and deleting Posts
- Investigating failures, ensuring security, and stable operation and quality improvement of the Service
- Responding to inquiries and to requests for deletion, disclosure, and the like
- Showing, within the scope of Section 4, the previous day's Group clips, so that a person who opens an invite link can decide whether to join
- Necessary communications, such as changes to the Terms of Service and this Policy
- Responding as required by law
We will not change the purposes of use beyond the range above. If we change them, we will follow the procedure in Section 13.
4. Sharing Scope (What Is Shown to Users)
- Post Content is shown to the members of the Groups you chose, video by video, as destinations (display names, notes, world names, and the like are shown to the members of those Groups. The display name is the name you chose if you chose one, otherwise your VRChat display name, otherwise your Discord display name (a temporary name for people who log in with Google)). A video for which you chose no destination (unsent, or only you) is shown only to you. You choose the destinations each time after taking a video (videos are not sent automatically). You can also change destinations later in the app. If you leave a Group, your videos that you sent to that Group are no longer visible to its members. A person who newly joins a Group can also see past videos and past chat messages that were sent to that Group, from 3 days before the day they joined (not earlier ones). Members of a Group can also view the record of days on which you did not post.
- Your account picture is shown to you and to logged-in users who are currently in a Group with you, in the circle next to your name and in the row at the top of the home screen. If you leave a Group, it is no longer shown to that Group's members (it may remain for up to one day on devices that already displayed it). It is not shown on screens seen by people who are not logged in, such as invitation pages, Share Pages, and the Public Logs (a circle with your initial is shown instead).
- Videos that you make public yourself can be viewed by anyone, as described in "Public Logs (Everyone's 3 seconds)" below. Public sharing is off by default.
- Messages and shared videos in a chat are shown to the members of that Group (to a person who joined partway, only messages from 3 days before the day they joined are shown; a shared video is shown only to members who can still view it). A reaction is shown to the people who can view that video (the person who sent it and the members of the Group). Messages and reactions are not shown between people who have blocked each other.
- Anyone who knows a passphrase (valid for 24 hours) can join that Group, just as with an invite link. If you tell a passphrase by voice or in the chatbox, other people there may hear or see it. The resident tool's "Show in the VRChat chatbox" sends the passphrase to VRChat on that PC only when you press it (it is shown to people in the same instance).
- Display to users in the same instance: Only while users who turned on "Show me to Komadori users in the same world" are in the same VRChat instance at the same time, they see each other's display names and VRChat display names and can invite each other to Groups. The world and the instance location are not shown. Users who have blocked each other and suspended users are not shown. If you turn the setting off, others can no longer see you, and you can no longer see others. A person who receives an invitation sees the inviter's display name and the Group name.
- Except for "Public Logs (Everyone's 3 seconds)", "Share Pages (sharing with a link)", and "Display on invite pages and similar" below, Post Content is not made public beyond the Groups you chose as destinations.
- Invite link previews (on Discord, X, and so on) show only the Group name and the number of members, not members' names.
- The same applies to selfies recorded earlier (they are delivered to the same scope as videos and poster images, under the same conditions). The current resident tool does not record selfies.
- Videos and poster images are delivered only to members of the destination Groups, using the logged-in person's cookie or device token (except for the display on invite pages and similar, below).
- We do not store check frames. Those stored before that also stay private: they are not delivered or shown to Group members, invite pages, or any other user, and are not used for any other purpose.
Sharing to social media and the like
The app has a feature for sharing a video to an external service such as X. The video for sharing is made inside your browser and is not sent to our servers. You decide whether to share and which external service to hand it to, and how that service handles it is governed by that service's terms and policy. Videos for social media (a single clip, or a day's summary) are made only from your own videos, and the Service's logo is placed at the bottom right. With "Share the log" on the log screen, you can combine the Group's log for the day (including videos that other members sent) into a single video, and save it on your device or hand it over with your device's share feature. This video is also made on your device and is not sent to our servers. Before you hand it outside the Group, get the agreement of the members who sent those videos and of the people shown (Terms of Service, Article 7). When you share by attaching an exported video, we do not attach the URL of a personal page or of the video (when you share with "Link", we hand over the URL of the Share Page described below). We do not post to external services on your behalf. We may record how many times the sharing action is used as the measurement in Section 9 (only the type of sharing, with no personal identification).
Public Logs (Everyone's 3 seconds)
You can choose your own videos, one by one, to make public ("Make public (show everyone)" on the sending screen after taking a video, or "Make public…" in the video's "⋯" menu. If you turn on "Always make my clips public" in the settings, your videos are made public when you send them).
- Who can see them: Anyone, including people who are not logged in (the feed `/explore`, the day pages `/explore/…`, and "Everyone's 3 seconds" sections such as on the top page). We mark them so that search engines do not list them (noindex).
- What is shown: The videos you made public and their poster images, their time and note, the date, and your display name only if you chose "Show my name" when making them public (otherwise it is shown like "Someone's 10/24"). World names, destination Groups, other members' videos, and previously recorded selfies are not shown. The URL of a day page does not contain your user ID (it is an unguessable string made from the user and the date).
- What we record: When you made a video public, whether to show your name, the settings "Always make my clips public" and "Show my name when sharing publicly", and when we showed the notice "Please get the OK from anyone in the shot before you share it." We also record when we stopped a video from being public and when we picked it for a showcase section.
- Automatic check: For a video you make public, we automatically check its poster image (the still image shown with the video on the public pages) with Cloudflare's AI feature that we use (Cloudflare Workers AI), for sexual content, sexual depictions of child-like characters, blood or graphic violence, hate symbols or hate speech, real people's faces, and readable personal information (VRChat avatars are treated as normal). We check only videos you made public, once per video (if you stop sharing and make it public again, we do not check it again). We do not check videos kept within Groups or selfies. Until the check is done (usually a few seconds to a few minutes), the video does not appear in the Public Logs. If an item matches, if there is no poster image, or if the check could not be done, the video goes to "needs review" and does not appear in the Public Logs until our staff look at it and choose to approve it or stop it from being public (we do not automatically delete videos or suspend accounts; the video stays in your destination Groups and your own log). We record the result (passed, or needs review with the reasons, and when it was checked) (Article 7, "Automatic check of public videos").
- What is not shown: Videos we stopped from being public, videos whose automatic check is not finished or that need review, videos of suspended users, and videos with an open report. To a logged-in person, we also do not show videos of people they blocked or who blocked them, or videos they reported.
- When you stop: With "Stop sharing publicly" in the video's "⋯" menu, the video is removed right away from the Public Logs, the feed, and showcase sections (the video itself stays in your destination Groups and your own log). Video URLs already handed out stop working within about 1 hour and 10 minutes at most. We cannot delete copies that other people saved or shared elsewhere.
- Signed URLs: Public videos and poster images are delivered through signed URLs (`/media/p/…`; each works only for that clip and that part, and expires in about 1 hour), separate from normal delivery (which requires logging in). Pages, the API, and video delivery are rate-limited per IP address.
Share Pages (sharing with a link)
When you choose "Link" on the app's share screen and share, we create a page that plays your own videos as they are (a "Share Page", with a `/v/...` URL).
- Who can see it: Anyone who knows the URL can view it without logging in. If you post the URL on social media and the like, that service's users, and the service's systems that make the link's preview image, also read the page and its thumbnail image. We mark Share Pages so that search engines do not list them (noindex).
- What it shows: Only your own videos that you choose (your videos for a day, or a single video; when made from a Group's log, only your videos that you sent to that Group), their poster images, their date, and your display name only if you choose to show it. It does not show other Group members' videos, the Group's name, world names, notes, or selfies recorded in the past. It also shows information about the Service (a short introduction for newcomers and links to get started).
- Thumbnail image: Your browser makes one image for the link preview from those videos' poster images and the date (and, if you choose, your display name), and we store it on our servers. No new video file is made.
- When it stops being visible: It stops working 30 days after you create it. Before then, you can turn it off at any time from "Shared links" on the share screen or in Settings. Videos you delete later, videos of suspended users, and videos with an open report are not shown. It also stops working when no video can be shown.
- We limit how many times Share Pages and their videos can be requested from each IP address.
Display on invite pages and similar (shown to anyone who knows the link)
A Group invite page (/join/...) can be opened without logging in by anyone who knows the link. The following is shown to those people.
- Top of the invite page: The Group name, the Group's color and emoji, the number of members, and the initials of the members' names (the first character only; the names themselves are not shown). When we can tell which member sent the invite link (or issued the passphrase), we show that member's display name as "{name} invited you". For this, invite links that members send carry a short mark (8 characters, containing no user ID or other information) that is fixed for each member who sends them. If the mark does not belong to a current member of the Group (excluding suspended users), no name is shown.
- Group invite page: Of that Group's clips from the previous day (divided at 5:00 in the Group's NOW! region), up to 6 videos (including videos taken with the camera pointed at yourself) and their poster images play automatically without audio. The previous day's title and the number of clips are also shown. The clips are shown without members' names or world names. The selfie videos and poster images that earlier versions of the resident tool recorded at the same time are not shown either. If the title contains a world name, it is replaced with a title that does not use the world name. The Group owner can turn this display off at any time on the Group screen (the default is on, including for existing Groups). When it is off, or when there are no clips that can be shown, only a blurred pattern of colors (from which the original picture cannot be made out) and the number of clips are shown.
- Opt-out: You can exclude your own clips from the invite page display of every Group by turning on "Do not show my clips on invite pages" on the Account screen (the default is off. The clips of a user who turned it on are not included in the invite page videos, color patterns, or counts). We tell you how this display works on the screen where you join a Group, and with a one-time notice to users who already belong to a Group.
- Clips not shown in either: clips of users who are suspended, and clips that have a report under review. For a person who opens an invite page while logged in, clips of users that person has blocked, and of users who have blocked that person, are also not shown.
- Signed short-lived URLs: These videos and poster images are delivered by signed URLs, separate from normal delivery (which requires login). A URL is issued, when the invite page is opened, only for the clips that can be shown, can be used only for that clip and that part (the video or its poster image), and expires in 10 minutes (it cannot be used for selfies recorded earlier). Anyone who knows a URL can watch that video without logging in until it expires. After it expires, opening the invite page again issues a new URL. This delivery has a per-IP-address rate limit.
- Invite link previews (OGP) do not include video or image URLs.
5. Retention Periods
| Information | Retention period |
|---|---|
| Videos, poster images, and selfies (Post Content) | Stored while your account exists. Deleted when you delete a clip or your account (when you delete your account, all Post Content is deleted). The deletions described under "Unused accounts" and "Guests" below also apply. For operational reasons (cost, capacity, safety, and so on), we may shorten the retention period, in which case we will tell you in advance |
| Public Log records (when a video was made public, whether to show your name, when we stopped it from being public, when it was picked, the result of the automatic check) | Same as the video (until the video or the account is deleted). When you stop sharing publicly, we erase the time it was made public and the day page ID (the record that we stopped it and the result of the automatic check are kept until the video is deleted, so that we do not check it again if it is made public again) |
| Share Page (sharing with a link) records and thumbnail images | 30 days after creation. Expired ones and ones you turned off are deleted by daily scheduled processing (the thumbnail image is deleted right away when you turn a Share Page off). Also deleted when you delete your account |
| Check frames | Newly received ones are not stored. Those stored before that are deleted, like the clip's video, when the clip or the account is deleted |
| The day's title and earlier votes | Same as Post Content (while the account exists; until the account is deleted) |
| Chat messages and reactions | Until the account is deleted (when a Group is deleted, its messages are deleted too; a reaction is also deleted when the video is deleted) |
| Information attached to Posts (world name and ID, note, time) | Deleted together with the Post Content |
| Recording files and check frames the resident tool keeps on your PC (those not yet sent or that failed to send, and the one clip kept for the confirmation shown right after posting) | They exist only on your PC, and we do not receive them. They are deleted when posted, discarded, after the deadline, at the next recording, or when the tool exits; any that remain are deleted at the next startup (those more than 24 hours old). After a guest has used up the trial number of Posts, that day's recordings are kept on the PC until you register, and are deleted when the day changes (at 5:00 in your NOW! region). The first clip taken before logging in stays only on your PC until you log in (we do not receive it); right after you log in, it is posted to your "Me" log (visible only to you) and deleted from the PC. It is deleted from the PC if more than 24 hours have passed since it was taken, or if you choose not to use it |
| Account information (Discord ID, Google user ID, display name, the name you chose, VRChat information) and Group relationships and where videos were sent | Until the account is deleted (you delete it in the app, or it is deleted under the Terms) |
| Account picture and the identifier of your Discord profile picture | Until you change or remove the picture (when you change it, the previous picture is deleted on the spot), or until the account is deleted. The Discord identifier is replaced with the new one each time you log in |
| Records of reports | Deleted 1 year after the response (dismissal, deletion of the Post, or suspension). When the user who made a report deletes their account, the reports they made are deleted immediately. When a reported Post is deleted, the report is closed as needing no action |
| Block settings | Until unblocked, or until either account is deleted |
| Administrators' operation records (moderation log) | 1 year from the operation. When the target user or the administrator who acted deletes their account, the link to that person is removed (anonymized) and the record is kept. Kept to check that our operational responses are appropriate |
| Registered accounts that are not in use | If not used for 1 year after the last use, the account and its Post Content and so on are deleted (by a daily scheduled job, in the same way as when you delete your own account). If you have notifications (Web Push) on, we tell you once, about 30 days before deletion (opening the app counts as use and lets you keep the account). If notifications are not available, the account is deleted without advance notice |
| Guest accounts (users who started without logging in) and their data | If not used for 30 days after the last use, the account and its Post Content and so on are deleted (by a daily scheduled job, in the same way as when you delete your own account). If you register with Discord, the account follows the retention periods above for regular accounts. If a registered Discord account already exists, the guest's data is merged into that account and the guest account is deleted |
| Hash of the IP address at guest creation | Until the guest registers with Discord or Google, or until the guest account is deleted (it is erased when you register). Rate-limit counters (these hold only salted hash values, not IP addresses themselves) are deleted by the daily scheduled job after the window length (at most 1 day) has passed, so they remain for about 2 days at most |
| Time of last use | Recorded also for registered accounts so that unused accounts can be deleted (updated at most once an hour). Kept until the account is deleted |
| Notification (Web Push) subscription information and settings | Until you turn notifications off, until you delete your account, or until the subscription becomes invalid (deleted on the spot if the Push service reports it as invalid; if delivery keeps failing, we stop sending and delete it after 30 days). Records of notifications sent are deleted after 3 days. Mute settings are kept until you unmute or delete your account. It is included in your data export and deleted together with your account |
| Signed URLs for invite pages | 10 minutes (not stored; verified from the signature each time). Display settings are kept until the account or Group is deleted |
| Passphrases | Expire after 24 hours and are deleted by a daily scheduled job (they remain for about 2 days at most). Also deleted when the Group is deleted |
| Location keys for the same instance | The resident tool overwrites the key about once a minute, and if it is not updated for 3 minutes, we treat you as not there. It is deleted immediately when you leave the instance, quit VRChat, or turn the visibility setting off. Any that remain are deleted by a daily scheduled job (they remain for about 1 day at most). Also deleted when the account is deleted. The on/off choice of the visibility setting is kept until the account is deleted |
| Invitations in the same instance | Expire after 30 minutes and are deleted by a daily scheduled job (they remain for about 1 day at most). Also deleted when the inviter's or invitee's account, or the Group, is deleted |
| Login handover code | 2 minutes (deleted on the spot when used; expired ones are deleted by a scheduled job) |
| Temporary requests for logging in from inside the resident tool | Expire after 10 minutes and are deleted by a daily scheduled job (they remain for about 1 day at most) |
| Login and device sessions | Until the expiry. Expired ones are deleted by a scheduled job |
| Connection codes and device approval codes | Expire after a short time (5 minutes for connection codes, 10 minutes for device approval codes) and are deleted by scheduled jobs and the like |
| Usage measurement information (Google Analytics) | Follows the retention setting of Google Analytics (by default, detailed event data is kept for 2 months. We do not extend this). If you turn measurement off, we do not measure from then on |
| Access records | We do not store per-request records (access logs) in our own database (for the hash values used for rate limiting, see above). We do not use Cloudflare's retention of HTTP request logs (Logpull log retention), which is off by Cloudflare's default (Cloudflare's explanation). Where we use Cloudflare's Workers Logs (records of the Service's program running, including request content and errors) for failure response and fraud prevention, those records are kept by Cloudflare for up to 7 days and then deleted automatically (the retention period of our plan, Workers Paid; Cloudflare's explanation). Logs that are only viewed on the spot (real-time logs) are not stored (Cloudflare's explanation). Information that Cloudflare handles to operate and secure its own services is governed by Cloudflare's privacy policy |
| Records of inquiries | For the period needed to respond. Messages sent from "Contact" on the screen are deleted one year after they arrive (if you delete your account, they are deleted right away). What we receive through "Send logs" in the resident tool is deleted 30 days after we receive it (the deletion runs once a day, so it may remain for up to about 31 days). If you withdraw it in the resident tool or delete your account, it is deleted right away |
| AI support questions and answers | Deleted 90 days after the question (the deletion runs once a day, so they may remain for up to about 91 days). If you delete your account, they are deleted right away |
Please note that it may take a certain period for deleted data to disappear from backups and caches.
6. Provision to Third Parties
We do not provide personal data to third parties except in the following cases.
- When you consent
- When required by law
- When necessary to protect a person's life, body, or property, and it is difficult to obtain the person's consent
- When especially necessary to improve public health or promote the sound upbringing of children, and it is difficult to obtain the person's consent
- When it is necessary to cooperate with a government body or the like in carrying out duties prescribed by law, and obtaining the person's consent may impede those duties
Entrustment under Section 7, and entrustment to, or use of, businesses located in foreign countries under Section 8, are not provision to a third party. We do not jointly use personal data.
7. Entrusting the Handling of Personal Data and Use of External Services
To operate the Service, we entrust the handling of personal data to the following businesses, or use their external services. We provide necessary and appropriate supervision of the businesses we entrust.
| Entrusted business / service used | Country | Purpose and content |
|---|---|---|
| Cloudflare, Inc. (Cloudflare Workers, D1, R2, Workers AI) | United States | Hosting of the Service, the database, storage of videos and poster images, processing of communications, the automatic check of the poster images of public videos, and creating AI support answers (Workers AI; see below). It handles almost all of the information in Section 2 |
| Anthropic, PBC (Claude) | United States | We may have it read the records received through "Send logs" in the resident tool (after hiding) to investigate problems (see below) |
| Google LLC (Google Analytics 4) | United States | Usage measurement (unless you turn it off; for use from the EEA, the UK, or Switzerland, only if you consent). Aggregation for quality improvement. What is sent is as described in Section 9 |
| Google LLC, Mozilla Corporation, Apple Inc., Microsoft Corporation (each browser's Push service) | United States and others | Delivering notifications (Web Push). Encrypted notifications are sent only to the service of the vendor of the browser in which you turned notifications on (see below) |
| Google LLC (Login with Google) | United States | Login (OpenID Connect). At login, we receive only your Google user ID (sub); we do not receive your email address, name, and so on |
| Google LLC (kana-kanji conversion) | United States | To get conversion candidates for the reading (hiragana) you type with the on-screen keyboard in the resident tool's in-VR panel, our server sends the reading. We do not store the reading or the candidates (see below) |
| Discord Inc. | United States | Login (OAuth2). At login, we receive your Discord user ID, display name, and the identifier of your profile picture. When you press "Use my Discord picture", we fetch your profile picture from Discord's image delivery (cdn.discordapp.com). When a Group owner registers a webhook, we also send the morning announcement (see below) |
About kana-kanji conversion in the VR keyboard (Google)
While you type hiragana with the on-screen keyboard in the resident tool's in-VR panel, the reading (the hiragana you are in the middle of typing, up to 100 characters) is sent to our server, and our server sends it to Google LLC's conversion service (google.com) to receive conversion candidates such as kanji. We use the reading only to get conversion candidates, and we do not store the reading or the candidates (they are not kept in our database, logs, or usage measurement). Because it is sent from our server, your IP address and cookies are not sent to Google. Google handles the information it receives in accordance with Google's privacy policy. Conversion is not used (and no reading is sent) when you are not logged in, or in the tool window or on the web.
About the day's title
We create "the day's title" on our own servers, by rules, from metadata such as the number of clips, the posting times, and world names. We do not send any information to outside services, including AI services, to create the title. We never send your videos or images to AI, or process them with AI (except that the poster images of videos you make public are checked by Cloudflare's AI, as described in "Automatic check of public videos" below).
About the automatic check of public videos (Cloudflare Workers AI)
Only for videos you make public (Article 4, "Public Logs (Everyone's 3 seconds)"), we pass their poster image (a still image) to the AI feature of Cloudflare, Inc., the same company that hosts the Service (Cloudflare Workers AI; the model is Meta Llama 3.2 11B Vision Instruct running within Cloudflare), to check that it does not show inappropriate content such as sexual content. We pass only the poster image and a fixed text listing the items to check; we do not pass names, world names, notes, or account information. We do not pass the video itself, videos kept within Groups, or selfies. We check each video only once and record the result (passed, or needs review with the reasons, and when it was checked) in our database. We use the result only to decide whether to show the video in the Public Logs and for our staff to review it. Cloudflare states that it does not use Customer Content processed by Workers AI to train AI models, and that for standard requests it does not keep the inputs (images) and outputs once processing is done (Cloudflare's explanation). We do not use the feature that sends content through Workers AI to other AI providers (AI Gateway). The AI's judgment can be wrong. When an item matches, we do not automatically delete the video or suspend the account; our staff look at it and decide.
About AI support (Cloudflare Workers AI)
When a logged-in user types a question into "AI support" on the screen, we pass the question and the few messages before it, together with a description of how the Service works, to the AI feature of Cloudflare, Inc., the same company that hosts the Service (Cloudflare Workers AI; the model is Google Gemma 4 running inside Cloudflare, or Meta Llama 3.3 when it is unavailable), to create an answer. We do not pass your name, account information, or videos. To find and fix gaps in the AI support knowledge, we store the questions and answers (including whether the AI could answer and which model it used) in our database for 90 days, and only our staff can see them (Sections 2 and 5). They are not shown to other users. Cloudflare states that it does not use customer content processed with Workers AI to train AI models and, in normal processing, does not keep the input and output after processing is finished (see Cloudflare's explanation above). AI answers can be wrong.
About investigating "Send logs" records (Anthropic)
To find the cause of problems, we may have the records received through "Send logs" in the resident tool (Article 2; passphrases, file locations that include the PC's user name, codes in URLs and the like are hidden before sending) read by an AI development assistant we use (Anthropic's Claude). Only these records are read; they do not include videos, images or other account information. We use this tool with our account set so that the conversations are not used to train AI. Anthropic handles the information it receives in accordance with Anthropic's terms and Privacy Policy.
About notifications (Web Push)
We send browser notifications (Web Push) only if you turn notifications on. To turn them on, you must allow them in your browser's permission prompt and then press "Turn on notifications" on the Account screen or elsewhere. At any time, on the "Notifications" section of the Account screen, you can turn them off by type, for this device entirely, or temporarily for all your devices ("Pause all notifications"). You can also stop notifications only about a specific Group or from a specific user (mute them) from the Group's settings, from a member's name, or from "This notification" on the screen opened from a notification. We store mute settings on our server and use them only to decide whether to send a notification. The people you mute are not told. To show this setting on the screen opened from a notification, the notification body includes the IDs (identifiers, not names) of the Group and of the user who triggered it.
- Types of notification: when "NOW!" has been posted by 2 or more people in a Group; the "Yesterday's log" every morning (one notification between 7:00 and 10:00 in your time zone, with the Group's title for the previous day); when someone has joined a Group (to the Group owner and to the member who sent them the invite link, issued the passphrase, or invited them in the same instance, with the display name of the person who joined, the Group name, and the number of members); when someone reacts to your video (their display name and the type of reaction; only the first time a given person reacts to a given video); when someone posts in a chat (the Group name, the poster's display name, and the start of the message (up to 60 characters); at most 1 notification per Group every 10 minutes); and the advance notice of deletion when a registered account has not been used for 1 year (once, about 30 days before deletion. This one notification is not covered by the per-type off settings or mutes. If you use "Turn off all notifications" or turn notifications off altogether, you will not receive it)
- Notification text does not include world names, videos, or notes. It also does not include the content of other users' Posts (except the start of the message in a chat notification). The display name is the name the person chose if any, otherwise the person's VRChat name if known, otherwise the display name we hold (the Discord display name; a temporary name for people who log in with Google and for guests). Users you have a block relationship with, and suspended users, are excluded from notifications and from display
- How they are sent: the body of the notification is encrypted with the key of the subscribed device and sent from our servers to the Push service run by the vendor of that device's browser (Google's FCM, and the services of Mozilla, Apple, and Microsoft). The Push service holds the encrypted body until it reaches the device. The Push service cannot read the content of the body. However, the Push service handles the destination endpoint, the date and time of sending, information about our servers, and so on, in accordance with each company's privacy policy
- Limits: at most 3 per person in any 24 hours (the total of the types other than reaction and chat notifications; including the deletion notice). Reaction and chat notifications are counted separately, at most 20 in any 24 hours. We do not send between 2:00 and 7:00 in your time zone (Section 2). One person can register up to 5 devices
- When you dispose of a device, please turn notifications off or set your browser not to allow notifications. If a subscription becomes invalid on the browser side, our server detects it when it tries to send, and deletes the subscription information
About the morning announcement to Discord (Webhook)
Only where a Group owner has registered a Discord webhook URL, every morning, for a Group that has a log for the previous day (divided at 5:00 in the Group's NOW! region), we send the following to that webhook, that is, to Discord Inc. The owner can remove it at any time.
- What we send: the Group name; the previous day's title (if the in-app title does not include a world name, that title; if it does, a separate title made by rules without using the world name. We do not send anything to AI for the announcement); the number of clips; the number of members who posted; and a link to a Komadori page. When "Send test" is pressed, we send test text. Only if the owner turns on "Include invite link in the announcement", we also send the join link for that Group (including the invite code) (default: off)
- What we do not send: members' display names, VRChat names, or user IDs; videos and poster images; notes; and world names.
The announcement is shown to Discord users in the channel it is registered to. The owner is responsible for choosing a channel that may be shown to the Group's members. Destinations are limited to webhooks on discord.com / discordapp.com.
8. Information on Transfers to Third Parties in Foreign Countries (Cross-Border Transfers)
Cloudflare, Inc., Anthropic, PBC, Discord Inc., and Google LLC (for Login with Google, for Google Analytics for usage measurement, and for kana-kanji conversion in the VR keyboard), to which we entrust the handling of personal data or whose external services we use, are located in the United States, and data may be processed and stored on servers in the United States. In addition, because Cloudflare uses data centers around the world, communications may pass through, or be processed in, countries and regions other than the United States.
- The United States has no comprehensive federal personal information protection law equivalent to Japan's APPI. However, there are state laws, rules that businesses set for themselves, and the privacy practices that each company publishes (see the links in Section 7). Information on foreign systems published by Japan's Personal Information Protection Commission can be found on the following page (in Japanese).
- We have concluded, in the form each company provides, contracts and terms (including data processing provisions) under which the entrusted businesses handle personal data in accordance with our instructions.
- We will endeavor to check periodically how these entrusted businesses handle personal data.
In addition to the above, by using the Service, you agree to handling in the countries and regions above.
For people who live in the EEA, the United Kingdom, or Switzerland, the following also applies (see Section 15 for details).
- Transfer of information from you to us (Japan): Japan has received a decision from the EU (and from the United Kingdom) that its level of personal data protection is adequate (an adequacy decision).
- Transfer from us to our entrusted businesses in the United States: this relies on the data processing agreements each company provides (including Standard Contractual Clauses) or on other transfer mechanisms each company uses, such as the EU-U.S. Data Privacy Framework. Each company's mechanism can be checked in the materials that company publishes.
9. External Transmissions
In the Service, information about you is sent from your browser or the resident tool to the following external businesses. The Service does not use ad-serving tools or social media share buttons. As a web analytics tool, we use Google Analytics 4 (you can turn it off at any time in the settings; for use from the EEA, the UK, or Switzerland, only if you consent).
| Destination | Information sent | Purpose | When it is sent |
|---|---|---|---|
| Discord Inc. discord.com | Information needed for login (an OAuth2 authorization request. Your browser moves to a Discord page, and Discord authenticates you) | Login with a Discord account | When you perform the login action |
| Discord Inc. cdn.discordapp.com (sent from our server) | Your Discord user ID and the identifier of your profile picture (included in the URL of the image fetched) | Fetching your profile picture to make it your account picture | When you press "Use my Discord picture" |
| Google LLC accounts.google.com (browser), oauth2.googleapis.com (sent from our server) | Information needed for login (an OpenID Connect authorization request. Your browser moves to a Google page, and Google authenticates you. Our server sends Google the authorization code and our client ID and secret, and receives your user ID (sub). The scope is openid only) | Login with a Google account | When you perform the Login with Google or link action (only where we have enabled Login with Google) |
| Discord Inc. discord.com (sent from our server) | The content of the morning announcement (as in "About the morning announcement to Discord" above) | Announcement to the Discord channel registered by the Group owner | Every morning for a Group with a registered webhook, and when "Send test" is pressed |
| Google LLC Google Analytics 4 (google-analytics.com, googletagmanager.com. The web also loads a script from googletagmanager.com. Only while measurement is on) | As in "Usage measurement with Google Analytics" below | Improving the quality of the Service (finding defects, understanding where first-time users get stuck, and deciding on improvements) | While measurement is on, when you open or operate a screen (web). When the resident tool's operations such as notifying, recording, and posting happen (sent directly from the Windows resident tool. Only while measurement is on) |
| Google LLC (FCM), Mozilla Corporation, Apple Inc., Microsoft Corporation (each browser's Push service. Sent from our server) | The encrypted body of the notification (as in "About notifications (Web Push)" above), the subscription information (endpoint), and the date and time of sending | Delivering notifications to the browser in which you turned notifications on | To users who turned notifications on, when the notification conditions are met ("NOW!" has been posted by enough people, every morning, when someone has joined, when there is a reaction or a chat message, or the advance notice of deletion) |
| Google LLC google.com (sent from our server) | The reading you type with the VR keyboard (hiragana, up to 100 characters). Your IP address, cookies, and account information are not sent | To get kana-kanji conversion candidates (as in "About kana-kanji conversion in the VR keyboard (Google)" above. We do not store it) | In the resident tool's in-VR panel, while you are logged in and typing hiragana with the on-screen keyboard (shortly after you pause typing, or when you press "Convert") |
| Cloudflare, Inc. (hosting of the Service) | IP address, User-Agent, request content, and other information needed to process communications | Providing and delivering the Service, and security | Whenever the Service is used |
- To let the operator know signs of fraud, such as a sudden increase in guests, we may send an alert containing only counts and thresholds to a Discord channel of the operator. It does not include any of your personal information (IP address, ID, name, and so on).
- Apart from our servers (the Service), the resident tool (Windows) sends usage information (such as whether operations succeeded; see below) directly to Google Analytics (google-analytics.com), and only while measurement is on. While it is off, it sends nothing externally. The Google script is not loaded on the resident tool's screens, and no cookies are used. Web fonts (Noto Sans JP, Zen Maru Gothic) are delivered by the Service itself, so there is no communication with a font delivery provider.
Usage measurement with Google Analytics
To improve the quality of the Service (to learn which screens are used most and where people get stuck), we send the following information to Google Analytics 4, provided by Google LLC. We do not send information that shows who you are, such as your name or videos.
- What we send: the type of screen shown (with invite codes and tokens of invite links, account codes, Group IDs, query strings, and the like removed); the types of button actions and feature use (for example: a login action, copying an invite link, playing a video, the type of reaction); the fact that a video could not be played (the type of error); the type of communication error (the broad category of the API concerned and the status); whether the resident tool's operations succeeded and the type of reason for a failure (for example: a notification was shown, recording failed, a selfie could not be taken); whether a post succeeded (only the kind, whether it was late, and whether it had a selfie); video-sharing actions (share_open, share_done and similar: only the type of sharing, with no personal identification, and nothing about the content of the video or what happens on the external service); the version of the resident tool; the anonymous user ID; and what Google Analytics obtains automatically: the type of browser, device, and OS, the language, the screen size, the approximate region (the IP address itself is not stored, by the design of Google Analytics), and the referring site (for external sites, the domain only)
- What we do not send: display names, VRChat names, Discord user IDs and usernames, account codes, invite codes, passphrases, invite link tokens, Group names, world names and IDs, location keys, notes, chat messages, Post (clip) IDs, the content of videos and images, and email addresses
- Anonymous user ID: We use an ID made by converting the internal user ID one-way with a secret key that only we know. It is used to tally the same user's use across multiple days and devices, but no one other than us can identify a user from this ID.
- Use for advertising: We do not use information obtained through Google Analytics to serve or personalize ads (Google signals and ads personalization are turned off).
- Turning measurement on or off (how to opt out): For use from the EEA (European Economic Area), the UK, or Switzerland (and when the country of the connection is unknown), we ask the first time you open a screen ("Agree" or "Decline"), and we do not send anything to Google until you agree. For use from other countries and regions, we measure without asking. From any country or region, you can stop measurement at any time in the following ways. When you stop it, we do not measure from then on, and the Google Analytics cookies are deleted.
- Turn off "Usage measurement" on the web "Settings" screen or in the resident tool's settings (the web and resident tool choices are stored with your account and are shared)
- Turn on your browser's "Global Privacy Control (GPC)" or "Do Not Track" (in that browser, we treat measurement as off until you choose again in the settings)
- How Google handles it: Google handles information in accordance with Google's privacy policy and related terms. For details, see Google Privacy Policy, Safeguarding your data (Google Analytics), and How Google uses information from sites or apps that use our services. A Google Analytics Opt-out Browser Add-on is also available to disable measurement by Google Analytics per browser.
10. Security Measures
To prevent leakage, loss, or damage of personal data, we take measures such as the following.
- Organizational measures: clearly designating a person responsible for handling, and checking how data is handled
- Personnel measures: training and confidentiality obligations for staff who handle personal data
- Physical measures: storage under the management of the cloud provider (Cloudflare)
- Technical measures: encryption of communications (HTTPS); access control (limiting access to members of the destination Groups); hashing of sessions, connection codes, and login handover codes; signed short-lived URLs for invite page videos (HMAC, 10 minutes, per clip and per part) and rate limiting; CSRF protection that limits writes authenticated by cookies to the same origin; for limiting guest creation, handling IP addresses only after turning them into salted hash values (for other rate limits too, IP addresses are likewise turned into salted hash values before handling and kept only for a short time); and prevention of misuse (connection codes expire quickly and can be used only once)
- Understanding the external environment: we understand the systems of the country where our entrusted businesses are located (the United States) and reflect them in the measures above.
11. Requests for Disclosure, Correction, Cessation of Use, Deletion, and the Like
- Under the APPI, you can request, for the retained personal data we hold about you, notification of the purposes of use, disclosure, correction, addition, or deletion, cessation of use or erasure, and cessation of provision to third parties.
- Please send a request to the contact in Section 1, together with information that lets us confirm it is you, such as your Discord account display name and Discord user ID (if you log in with Google, information such as your account code that identifies the account). After confirming your identity, we will respond within the period prescribed by law. As a rule we do not charge a fee (except where the law provides otherwise).
- You can delete your account yourself at any time from the "Account" screen in the app. When you do, your account information, Post Content (videos, poster images, selfies, and check frames stored earlier), chat messages, reactions, earlier votes, Group relationships and where videos were sent, block settings, device connections, location keys and invitations for the same instance, notification (Web Push) subscription information, settings and records of sending, reports you made, and records of reports about your Posts are deleted immediately (passphrases you issued belong to the Group, so they remain until they expire). If you were the owner of a Group, the Group is handed over to the member who joined earliest (the registered Discord webhook is removed). A Group with no other members left is deleted together with the Group (as in the preceding paragraph, it may take a certain period for data to disappear from backups and caches). Operation records of actions we took are kept after removing the link to you. If you cannot do this in the app, please contact us at the contact above.
- From the "Account" screen, you can export your own data (profile (including the name you chose, the URL of your account picture (which you can open while logged in), and the identifier of your Discord profile picture), Groups (including their order on your home screen), Post information and where each was sent (clips[].shares), sending and other settings (settings, including whether "Show me to Komadori users in the same world" is on), how the videos are laid out in each log (log_layouts), votes, reactions (reactions), chat messages (messages), reports you made, block settings, notification subscription information and settings, same-instance invitations you sent and received (the other person is shown only by account ID; nearby_invites), passphrases you created (passphrases), and Share Pages you created (which videos they show, the date, whether your display name is shown, and when they were created, expire, and were turned off; not the thumbnail image; share_pages), the public state of each video (when it was made public, whether your name is shown, when we stopped it from being public, and the result of the automatic check with its reasons and when it was checked; clips[].public), and the public sharing settings (public_always and public_name_default in settings)) as JSON (this is one way to make a disclosure request). You can delete individual Posts yourself in the Service.
- We also accept at the same contact requests for deletion from people who appear in other users' videos (Article 10 of the Terms of Service). From the "⋯" menu of a Post, you can also report the Post or block the user who posted it.
12. Age and Information About Minors
- The Service can be used only by people aged 16 or older. If you are under 16, you may not use the Service. Age is confirmed by your own declaration, based on the notice next to the login or start button; we do not collect your date of birth.
- If we learn that we have collected information about a person under 16, we will promptly delete it.
- Rules on the handling of children's personal information are expected to be set under the amended APPI. We will review this Policy and the Terms of Service in light of the content of those laws.
13. Changes to This Policy
We may change this Policy in response to changes in law or in the Service. If we make a significant change, we will tell you a reasonable time before the effective date, by posting on the Service's website or by another appropriate method. Changes to the purposes of use are limited to the range reasonably recognized as related to the purposes before the change. The changed content takes effect when it is posted on this page (or on the effective date, if we set one separately).
Change history
- 2026-10-25: We added account pictures (an image you choose and crop, or the picture fetched from Discord with "Use my Discord picture"). We described who can see them (you and logged-in users in a Group with you; they are not shown on screens for people who are not logged in), the identifier of your Discord profile picture that we receive at login, how long we keep them, that we fetch the picture from Discord, and that they are included in the data export (Sections 2, 4, 5, 7, 11, and 15).
- 2026-10-25: We now store AI support questions and answers (including whether the AI could answer and which model it used) for 90 days to fix gaps in the knowledge, and only our staff can see them. We also added them to the data export (Sections 2, 5, 7, 11, and 15).
- 2026-10-25: We added "AI support" and a "Contact" form to the screen. We described that AI support questions are only passed to Cloudflare Workers AI to create an answer and are not stored, what we receive through the Contact form (category, message, optional reply contact, the AI conversation if you choose to attach it, and so on), and how long we keep it (one year after it arrives), and added your messages to the data export (Sections 2, 5, 7, 11, and 15).
- 2026-10-25: We now automatically check the poster images of videos you make public with Cloudflare's AI feature (Cloudflare Workers AI), and when an item matches or the check could not be done, we keep the video out of the Public Logs until our staff review it. We described the items checked, what we pass (only the poster image), how the result is recorded and kept, that Cloudflare does not use it for training, and that the result is included in the data export (Sections 2, 4, 5, 7, 11, and 15).
- 2026-10-24: We added making your own videos public, one by one, so that anyone can view them (Public Logs, the feed "Everyone's 3 seconds", and showcase sections such as the top page; off by default): who can see them, what is shown (no world names; your name only if you choose), what we record (when and how you made them public, and "Always make my clips public"), what is not shown, what happens when you stop, and signed URLs. We revised the statement that there is no public feed, and added the public state and settings to the data export (Sections 2, 4, 5, and 11).
- 2026-10-24: We made notifications easier to turn down. We added "Pause all notifications" and muting for each Group and user, and added these settings to the information we collect, the retention periods and the data export. Notification bodies now include the IDs of the Group and user, so that the screen opened from a notification can show "This notification" (Sections 2, 5, 7 and 11).
- 2026-10-24: We added kana-kanji conversion to the on-screen keyboard in the resident tool's in-VR panel. The reading (hiragana) you type is sent from our server to Google LLC's conversion service only to get conversion candidates. We do not store the reading or the candidates (Sections 2, 7, 8, 9, and 15).
- 2026-10-24: On the invite page, we now show the display name of the member who sent the invite link (or issued the passphrase) and the initials of the members' names (invite links carry a short mark fixed for each member who sends them). We added the Group's color and emoji to the information we collect. Join notifications now also go to the member who invited the person, and include the Group name and the number of members. We renamed the on-screen setting "Show me to Komadori users in the same instance" to "Show me to Komadori users in the same world" (how matching works has not changed) (Sections 2, 4, 7, and 11).
- 2026-10-22: For use from outside the EEA, the UK, and Switzerland, we now measure usage (Google Analytics) without asking first. We also rewrote, in plainer words, how to stop it ("Usage measurement" in the settings, and your browser's GPC or Do Not Track) and what we send and why. For use from the EEA, the UK, and Switzerland, we still measure only if you consent (Sections 2, 5, 7, 8, and 9).
- 2026-10-20: We added the following to the data export: the order of your Groups on the home screen, the "Show me to Komadori users in the same instance" setting, same-instance invitations, passphrases you created, how the videos are laid out in each log, and Share Pages you created. We added how the videos are laid out in each log to the information we collect (Sections 2 and 11).
- 2026-10-20: We added the feature for sharing your own videos on a page that anyone who knows its URL can view without logging in (a Share Page): who can see it, what it shows (your own videos, the date, and your display name only if you choose), that we store a thumbnail image, and the retention period (30 days; you can turn it off at any time) (Sections 2, 4, and 5).
- 2026-10-19: We added that we use the AI development assistant that reads "Send logs" records (Anthropic's Claude) with our account set so that the conversations are not used to train AI (Article 7). Because we decided not to create "the day's title" with AI, we removed the description of sending metadata to Anthropic's API (Claude API) to generate the title, and stated that we create the title on our own servers by rules (Articles 7 and 15).
- 2026-10-18: We added the information we receive when you press "Send logs" in the resident tool (the resident tool's activity record after hiding, the versions, the capture and OSC settings and status, and the lines of VRChat's output log that relate to OSC) and how long we keep it (30 days after we receive it) (Articles 2 and 5). We added that we may have them read by an AI development assistant we use (Anthropic's Claude) to investigate (Articles 2, 7 and 15).
- 2026-10-13: We added the name you choose yourself ("Choose your name" right after logging in, and "Name" in Settings). It is shown as your display name to members of your Groups and others, is deleted when you delete your account, and is included in the data export (Sections 2, 4, 5, 7, and 11).
- 2026-10-12: We updated the description of Post Content to match how recording works now (recording the view through the camera's lens, no longer recording selfies, and notes you can add after posting; Section 2). We stopped storing check frames (Sections 2, 4, 5, and 7). We removed the description of "Send automatically"; you now choose the destinations each time after taking a video (Sections 2 and 4). We added passphrases and invitations to users in the same instance (the location key) (Sections 2 to 5 and 11). A person who joins a Group partway now sees chat messages only from 3 days before the day they joined (Section 4). We stated that there is no public feed (Section 4). We corrected the types of notifications, the limits, and the quiet hours to match how they work now, and removed the voting result (most votes) from the morning notification and the morning announcement to Discord (Sections 7 and 9). We described the retention of access records concretely (Section 5). We updated the description of the videos shown on invite pages to match how recording works now (Section 4), and corrected the division of the day to 5:00 in the NOW! region (Sections 4, 5, and 7).
- 2026-10-10: In Section 9, we changed the examples of video-sharing actions sent for measurement to share_open and share_done.
- 2026-10-09: We added Group chat, reactions to videos, and sharing the log (combining a day's Group log into one video) (Sections 2, 4, 5, and 11). We added reactions and chat to the types of notifications (Section 7).
- 2026-10-08: In Section 2, we removed a display setting that no longer exists (the home-video-style display) from the localStorage examples.
- 2026-10-07: We stopped the creation of new guests (starting without logging in) (Section 2; existing guests can keep using the Service). We added information about logging in from inside the resident tool (a temporary request), the first clip taken before logging in, and the cookie for "Open in Komadori" on invite pages (`kd_app_v`) (Sections 2 and 5). A person who newly joins a Group can see past videos from 3 days before the day they joined (Section 4).
- 2026-10-02 (effective date; announced by an in-app notice): We changed who can see a video to "the Groups you chose, video by video" (Sections 2 to 4 and 9). We ended the Friends feature (requests, approvals, friend invite links, and searching by friend code), and moved former Friends into 2-person Groups without the other person's approval (pairs who were already in a Group together, and pairs who had blocked each other, were not moved). What the other person can see is the same as before (each other's videos), and notifications and the invite page's "yesterday's log" start turned off. We will explain the move once with an in-app notice. A Group is now limited to 20 people. We renamed the "friend code" the "account code" (the value is the same). We added sharing to social media and the like (Section 4) and the measurement of that action (Section 9).
14. Contact for Inquiries
The contact for inquiries about this Policy and the handling of personal information, and for requests for disclosure and the like, is as follows.
- Operator: Komadori team
- Contact: ing@digital-sorovider.jp (Japanese or English)
- We will promptly tell you the operator's name, address, and representative on request to the contact above. (This is our answer to a request from the person concerned under the APPI.)
15. For People in the EEA, the United Kingdom, and Switzerland
For people who live in the EEA (European Economic Area), the United Kingdom, or Switzerland, in addition to the other sections of this Policy, we handle personal data as follows. We follow whichever of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection applies.
Controller: Komadori team (Japan). The details of the operator's identity, such as name and address, are available on request at the contact in Section 14 (ing@digital-sorovider.jp), and we will answer promptly.
Lawful basis for processing: We handle personal data on the following bases.
| Processing | Lawful basis |
|---|---|
| Storing and sharing accounts and clips, and providing notification times | Performance of a contract (GDPR Article 6(1)(b)) |
| Kana-kanji conversion in the VR keyboard (relayed to Google; not stored) | Performance of a contract (GDPR Article 6(1)(b)) |
| Creating AI support answers (Cloudflare Workers AI) | Performance of a contract (GDPR Article 6(1)(b)) |
| Storing AI support questions and answers for 90 days to improve the knowledge | Legitimate interests (Article 6(1)(f); to fix mistakes and gaps in AI support) |
| Investigating problems with records received through "Send logs" (including having Anthropic's Claude read them) | Legitimate interests (Article 6(1)(f)) |
| Fraud prevention, rate limiting, hashing of IP addresses, responding to reports, and security management | Legitimate interests (Article 6(1)(f)) |
| Automatic check of the poster images of public videos (Cloudflare Workers AI) | Legitimate interests (Article 6(1)(f); to avoid showing inappropriate content in places anyone can see) |
| Google Analytics and Web Push notifications | Consent (Article 6(1)(a)). You can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal |
| Responding as required by law | Legal obligation (Article 6(1)(c)) |
Your rights: You have the right to ask for access (disclosure), correction, erasure, restriction of processing, data portability (from "Export" on the Account screen you can receive your own data as JSON), to object, and to withdraw consent. Please send requests to the contact in Section 14. After confirming your identity, we will, as a rule, respond within 1 month.
Complaints: If you are dissatisfied with how we handle your data, you can lodge a complaint with a data protection supervisory authority in the country where you live, where you work, or where you believe an infringement took place. If you contact us first, we will respond in good faith.
Cross-border transfers: As described in Section 8.
Automated decision-making: We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you. The automatic check of public videos (Article 7) only holds a video back from the Public Logs until our staff review it; deleting videos and suspending accounts are decided by people.
Retention periods: As described in Section 5.
Whether providing information is required: If you do not provide the information needed for login (such as Discord or Google identifiers), you cannot use the Service. Providing other information (such as for measurement and notifications) is optional.
Age: The Service can be used only by people aged 16 or older (Section 12).
16. For People in the United States
We do not sell your personal information. We also do not share your personal information for cross-context behavioral advertising (advertising based on your activity across other services).
End