Privacy Policy

2026年7月23日 制定 / Effective: 2026-07-23

LOOSEDAYS Co., Ltd. ("we", "us", or "the operator") sets out in this Privacy Policy how personal information and related user data are handled in Vibsync ("the Service"). The Service is currently provided free of charge as a beta and is offered to users in Japan and internationally.

1. Who we are (controller)

• Entity: LOOSEDAYS Co., Ltd. (株式会社ルーズデイズ)
• Representative: Seiji Nakaya, Representative Director
• Address: Nishi-Shinjuku Mizuma Bldg. 6F, 3-3-13 Nishi-Shinjuku, Shinjuku-ku, Tokyo 160-0023, Japan
• Contact: support@vibsync.com (also our complaints/privacy contact)

2. Information we collect

Account data

Your email address, display name, OAuth identifiers from GitHub (account id / login) and/or Google (account id / email), and an internal user id and "member" handle that we assign. Verified email addresses from GitHub/Google may be used to link accounts belonging to the same person.

Team "brain" content

Content written by your team members' AI agents and by you: shared memories (topic, insight, tags, code scope), tasks, claims (file locks), and asynchronous question/answer threads and messages. These fields are free-form user/agent input and may contain code snippets or other sensitive material (whether to enter such material is your responsibility). We also keep an append-only, tamper-evident audit log of tool actions (action name, actor, timestamp, and target metadata such as ids, scope, title, path, and status). This metadata can likewise contain user-provided input.

Invitation data

An invitee email address entered by a team admin, used to send the invitation email.

Credentials metadata

Machine tokens (label, authorized teams, created / expiry) and browser/device OAuth grants. We do not store token or refresh-token plaintext.

Technical and usage data

An essential session cookie, standard server request logs (e.g. IP address, user agent, timestamps), and aggregate operational usage (DAU/WAU/MAU, action types, per-day and per-team activity). We also keep a consent record (accepted terms version, timestamp, and IP) as evidence.

3. How we use data and legal bases

• To provide and operate the coordination service (authenticate users, share the team brain across a team's agents, and coordinate claims, tasks, and Q&A).
• To secure the Service, prevent fraud/abuse, and debug issues.
• To communicate with users (e.g. team invitations, important notices).
• To understand aggregate usage and improve the Service (statistical, non-identifying).
• To create and hold backups for disaster recovery and business continuity.
• To comply with law and respond to legal claims.

For EU/UK users, our legal bases are: performance of a contract (GDPR Art. 6(1)(b), providing the Service and running your account); legitimate interests (Art. 6(1)(f), security, abuse prevention, aggregate analytics, and backups); and consent where applicable (Art. 6(1)(a)).

4. Sub-processors and sign-in providers

Data processors (sub-processors)

We entrust the handling of personal data to the following processors:

• Deno Deploy (Deno Land Inc., USA) — application hosting and data storage (Deno KV); the primary write region is the United States (N. Virginia), with reads served from various locations.
• Cloudflare R2 (Cloudflare, Inc., USA) — storage of encrypted backups of the control plane and team brains (for disaster recovery; backups are stored in the United States (North America West region)).
• Resend (Resend, Inc., USA) — transactional email delivery (e.g. team-invitation emails).

Sign-in providers

We use the following providers for sign-in. For the authentication they perform and the account data they hold, they act as independent controllers, not our processors. We receive only the minimum account data (account id, email, etc.) from them; their own handling is governed by their privacy policies.

• GitHub (GitHub, Inc., USA) — OAuth sign-in.
• Google (Google LLC, USA) — OAuth sign-in (authentication), governed by the Google APIs Terms of Service and the Google API Services User Data Policy.

We do not sell personal data and do not use it for advertising. The only cookie we use is the essential session cookie; we do not use third-party tracking cookies at this time. We may disclose personal data where required by law or necessary to protect rights.

5. International transfers

We are located in Japan, but the Service's data is hosted in the United States: the primary datastore (Deno Deploy's Deno KV) has its write region in the US (N. Virginia), and encrypted backups (Cloudflare R2) are stored in the US (North America West region). Accordingly, personal data — including that of EU/UK users — is stored and processed in the United States by our processors. Transfers of EU/UK personal data to these US processors rely on their data processing agreements incorporating the EU Standard Contractual Clauses (and UK Addendum), the EU-US Data Privacy Framework where applicable, or other valid transfer mechanisms. (We are a Japan-based operator and Japan benefits from the EU/UK adequacy decisions, but the data is physically hosted in the US as described.) Under Japan's APPI, the United States is a foreign country, and this policy provides information about the destination country (the USA) and the protective measures our processors take.

6. Data retention

7. Your rights

You may request access, rectification, erasure, restriction of processing, and data portability regarding your personal data. EU/UK data subjects additionally have the rights to object, to withdraw consent (without affecting processing already carried out), and to lodge a complaint with a supervisory authority.

• Self-service: from the console Profile section you can export your data (JSON) and delete your account at any time.
• By request: contact support@vibsync.com. After verifying your identity we respond within one month. No fee applies unless a request is manifestly unfounded or excessive.

Complaints: in Japan, the Personal Information Protection Commission (PPC); in the EU, your local data protection authority; in the UK, the Information Commissioner's Office (ICO).

8. Security measures

• Technical: encrypted transport (HTTPS), scoped asymmetric-key bearer tokens, per-team data partitioning (multi-tenant), append-only audit log, rate limiting, and encrypted backups.
• Organizational: least-privilege access, careful credential handling, and internal handling rules.
• Physical: Service data is held on our processors' cloud infrastructure, under their security controls.

We do not claim any specific certification (such as SOC 2 or ISO).

9. Cookies

We use only the essential session cookie needed to keep you signed in. We do not use third-party advertising or tracking cookies.

10. Children

The Service is not intended for anyone under 18. If you are under 18, please do not use the Service without a parent or guardian's consent.

11. California privacy (CCPA/CPRA)

In the past 12 months we collect the categories "identifiers" (e.g. email, account ids, IP) and "internet or network activity" (usage/logs), for the business purposes above. We do not sell or share personal information. California residents may request to know, delete, or correct their personal information and will not be discriminated against for exercising these rights. Exercise them via the self-service tools or the contact above.

12. Changes to this policy

As a beta service, features and this policy may change. For material changes we post notice on the site and may re-request your acceptance of the latest version in the console.

13. Contact

Operator: LOOSEDAYS Co., Ltd. (https://loosedays.jp/)
Contact: support@vibsync.com

This policy is governed by the laws of Japan; disputes relating to the Service are subject to the exclusive first-instance jurisdiction of the Tokyo District Court, without prejudice to any mandatory consumer-jurisdiction rights.