This English version is a translation; if it differs from the Japanese version, the Japanese version prevails.
Takeshi Yamamoto (the “Operator”) sets out in this Privacy Policy how user information is handled in the BanteNote app for iPhone and iPad and on the website bantenote.com (together, the “Service”). The Operator handles information in accordance with Japan’s Act on the Protection of Personal Information (the “APPI”) and other applicable laws.
1. Our approach
- Your practice records and photos are stored on your device. They leave the device only when you use photo analysis, AI insight or cloud backup.
- Photos and numbers are sent to an external AI service only after you agree.
- There are no ads. We do not use the advertising identifier (IDFA) and do not track you across other companies’ apps or websites.
- We never use your records or photos to train AI.
2. Information we handle and how we use it
2.1 Account information
- What: your email address (when you sign in with email and password, Apple or Google; with Apple this may be a relay address provided by Apple), your name when you sign in with Google (kept by the authentication service but not used by the Service), your account identifier, and how you sign in.
- Why: to sign you in and confirm it is you; to link purchases, your allowance and cloud backups to your account; and to send verification and password reset emails.
- Without an account (guest): you can use the app without an account. When the app talks to our server, it creates an anonymous account that holds only an identifier, used to manage your allowance. No email address or similar information is collected.
2.2 Device and app identifiers
- What: an ID the app creates for each device (shown in Settings as “BanteNote ID”) and an ID used to manage purchases. For cloud backup and account deletion, Apple’s App Attest is used to check that requests come from the genuine app.
- Why: to manage your allowance, prevent abuse, manage purchases, and match support requests.
2.3 Practice records and photos
- What: distances and other numbers, clubs, ranges, drills, notes, photos and settings.
- Where: on your device. They leave the device only in the cases in 2.4 to 2.6.
- Photo metadata: when a photo is imported, its metadata (such as where and when it was taken and the camera model) is removed before it is saved on your device. The capture time is read on the device before import to date the record; it is not sent.
- Photos on your device: by default, photos are deleted automatically 30 days after import (you can change this in Settings). Your records remain after their photos are deleted.
2.4 Photo analysis
- Only if you agree, the photo you analyze is sent through the Operator’s server to an external AI service (section 3) to read the numbers in it.
- Metadata such as the location is also removed from the photos that are sent.
- The numbers read from the photo (the analysis result) are stored on the server and used in your records.
- The image used for analysis is deleted when the analysis ends (within 2 days at the latest). After deletion it remains for 7 days in the storage provider’s systems.
- You can withdraw your consent at any time in the app’s Settings.
2.5 AI insight
- Only if you agree, the numbers of the selected club’s shots (distance, left/right, direction, miss and numbers read from photos), with the club’s name, swing type, period, units and display language, are sent through the Operator’s server to an external AI service (section 3). Photos, notes, range names and dates are not sent.
- Answers are kept on the server for 30 days so the same question can be answered again quickly. The numbers you sent are not stored.
- You can withdraw your consent at any time in Settings (“AI insight consent”).
2.6 Cloud backup (Pro / Pro+)
- When you create a backup, the records, photos and settings on your device are saved together on the Operator’s server (Google Cloud, Tokyo region, Japan).
- Only the latest backup is kept. It is deleted 30 days after your paid plan ends. After deletion it remains for 7 days in the storage provider’s systems.
2.7 Purchases
- Paid plans are bought through the App Store (Apple). The Operator never receives your card number or other payment details.
- The purchase status (plan, product and period) is received through a purchase management service (RevenueCat) and used to provide features and your allowance.
2.8 Allowance records
- The number of photo analyses and AI insights you used, and records of allowance grants, are stored on the server to manage your allowance and prevent abuse.
2.9 Error reports
- When a problem occurs in the app, the app version, OS version, device model and the type and details of the error are sent to the Operator’s server. The app removes account identifiers, email addresses, URLs and similar information before sending.
- They are used to investigate and fix problems.
2.10 Server logs
- The server may record the time, destination, IP address and similar details of requests (logs). They are used for operations, troubleshooting and abuse prevention, and are deleted after 30 days.
2.11 Website and support requests
- Analytics: we use Cloudflare Web Analytics, which does not use cookies.
- Support requests: we receive what you enter in the contact form (the kind of request, your email address and message, and, when opened from the app, the support code, app version, OS and language). Before sending, Cloudflare Turnstile checks that the request comes from a person.
- This information is used to answer you, and answers are sent by email. The first answer may be written by AI; requests that need a person are passed to staff. Notifications to staff do not include personal information. With individual details removed, a question and its answer may be kept as a frequently asked question.
- Support requests are deleted one year after they are resolved.
2.12 Device permissions
- Camera: used only when you choose “Take a photo”.
- Saving photos: used only when you export and save an image. To pick photos, the app uses the iPhone’s photo picker, so it does not ask for access to your whole photo library.
- The app does not use location, contacts or the microphone, and does not use push notifications.
3. External services (processors)
To provide the Service, the Operator entrusts the handling of information to the following companies.
| Company | Country | What is entrusted |
|---|---|---|
| Google LLC | United States | Authentication (Firebase Authentication), servers and data storage (Google Cloud; servers and data storage are in the Tokyo region, Japan) |
| RevenueCat, Inc. | United States | Managing purchase status |
| Anthropic, PBC | United States | Photo analysis, AI insight, drafting answers to support requests |
| OpenAI (OpenAI, L.L.C. and its affiliates) | United States | Photo analysis (for example, when Anthropic is unavailable) |
| Cloudflare, Inc. | United States | Website delivery, analytics, receiving support requests and sending reply emails |
- About the external AI services: under their terms, data sent through their APIs is not used to train AI. The providers may keep the data for up to 30 days to monitor abuse (longer where required by law or to enforce their terms). Requests to OpenAI are sent with the setting that does not store responses.
- Processors may change. When they do, this page will be updated.
- Apple and Google services: App Store purchases, Sign in with Apple and App Attest (checking that requests come from the genuine app) are Apple’s services, and Google sign-in is Google’s service; each company handles information under its own privacy policy. The Operator receives only the email address and account identifier used to sign in, the purchase status, and the result of the check.
4. Processing outside Japan
The companies in section 3 are located in the United States. Under the APPI, we provide the following information.
- Country: United States of America
- That country’s personal information protection system: there is no comprehensive federal law; there are sector-specific federal laws and state laws (such as the California Consumer Privacy Act). For details, see the survey of foreign personal information protection systems published by Japan’s Personal Information Protection Commission.
- Measures taken by the processors: each company’s data processing addendum, incorporated into its terms, requires it not to use the data for purposes other than those entrusted, to take security measures, to manage sub-processors, and to delete the data when the service ends. The Operator has reviewed these terms before entrusting the data.
- For more details, please ask through the contact form.
5. Disclosure to third parties
Except as required by law or in similar cases, we do not provide personal information to third parties without your consent (excluding the processors in section 3).
6. Retention
| Information | Period |
|---|---|
| Images for analysis | Deleted when the analysis ends (within 2 days at the latest), then 7 days in the storage provider’s systems |
| Analysis results, allowance records, purchase status records | Until you delete your account |
| AI insight answers | 30 days |
| Cloud backup | The latest one; deleted 30 days after your paid plan ends, then 7 days in the storage provider’s systems |
| Payment notification details | 7 days; minimal matching information 30 days |
| Server logs | 30 days |
| Photos on your device | By default 30 days after import (can be changed in Settings) |
| Support requests | One year after they are resolved |
7. Deletion
- Deleting your account: in the app, go to Settings → Account → Account deletion to delete the information on the server (your account, allowance, purchase status records, analysis results, AI insight answers, cloud backups and so on). You can do this as a guest too.
- Records on your device: deleting your account does not delete the records, photos and settings on your device. Remove them with “Delete local data now” in the app, or by deleting the app.
- What remains after deletion:
- Cloud backups and images for analysis remain for 7 days in the storage provider’s systems.
- Payment notification details remain for 7 days, and minimal matching information for 30 days.
- A record of the deletion process remains for 30 days.
- To prevent the Welcome bonus from being given twice, a one-way matching value made from your verified email address or Apple/Google account, and the time of the grant, are kept for up to 180 days.
- Server logs remain for 30 days.
- Subscriptions: deleting your account does not cancel your subscription. Cancel it in the App Store.
- If you cannot use the app: you can request deletion through the contact form.
8. Security measures
- Only the Operator handles user information.
- Communication is encrypted (HTTPS). The server database cannot be read or written directly from the app or the web.
- API keys and similar secrets are managed in a dedicated system (Google Secret Manager). Cloud backup download URLs expire after 10 minutes.
- For processing outside Japan, see section 4.
9. Your requests
- Under the APPI, you can ask us to notify you of the purpose of use of your retained personal data, to disclose it, to correct, add to or delete it, to stop using or erase it, to stop providing it to third parties, and to disclose records of provision to third parties.
- Please contact us through the contact form. After confirming that you are the person concerned, we will respond without delay by email. There is no fee.
10. Minors
Minors must obtain a parent’s or guardian’s consent before using the Service.
11. Changes to this policy
When we change this policy, we will announce it on this page. Important changes will also be announced in the app or in our news.
12. Operator and contact
- Operator: Takeshi Yamamoto
- Address: disclosed without delay upon request.
- Contact: contact form or email (support@bantenote.com)