Privacy Policy

Last updated: 2026-10-29

This is an English translation. If it differs from the Japanese version, the Japanese version prevails.

Kyotani Inc (Kyotani Inc., "we") handles user information as follows in providing SNS TOWN (the "Service").

1. Information we hold

• At sign-up: email address, password (stored only as a hash; the original is never stored) and company name.
• When you connect a social account: the access token issued by each network (X, Threads, Facebook Pages, Instagram, LinkedIn, YouTube, TikTok), the account's ID, display name, username and profile image URL, and the network ID of the person who connected it. We never hold your social passwords. Access tokens are stored encrypted.
• While you use the Service: company profile and key messages, images, videos and documents in the asset library (including those imported from Google Drive), text and images you create, schedule and post, posting-cycle settings, credit balance changes, and engagement read back from the networks.
• Recorded automatically: logs such as access time, IP address and browser type; a cookie to keep you signed in (xa_s), and cookies and browser storage that remember display settings and language.

2. Why we use it

• To post to your connected social accounts on your instructions, and to read back post status and engagement.
• To create AI drafts and images from your company profile and assets.
• To manage credits, accept purchases and show usage.
• To verify identity (email confirmation), prevent abuse and bots, and investigate faults.
• To contact you about the Service.

3. Who we share it with

We send information only to the following providers, and only as needed for these purposes. We never sell or provide personal information to any other third party.

• X Corp. (X API) and Meta Platforms, Inc. (Threads API, Graph API for Facebook Pages and Instagram): post text, images and videos, and the access tokens of connected accounts. We use only their official APIs and follow their terms and developer policies.
• LinkedIn Corporation (Share on LinkedIn) and TikTok Pte. Ltd. (Content Posting API): likewise, post text, images and videos, and the access tokens of connected accounts.
• Google LLC (YouTube API Services): if you connect a YouTube channel, the videos, titles, descriptions and visibility you upload, and that channel's access token.
• Anthropic, PBC and OpenAI, L.L.C.: your company profile, key messages and asset contents, to create AI drafts and images.
• Google LLC: if you connect a Google Drive folder, the files in the folder you chose. We access no folder other than the one picked in the Picker.
• Cloudflare, Inc.: as the platform for the Service's servers, database, file storage, bot protection (Turnstile) and analytics (Web Analytics, which uses no cookies).

4. YouTube and Google data

• The Service uses YouTube API Services. By connecting a YouTube channel you agree to the YouTube Terms of Service. Google's handling of information is set out in the Google Privacy Policy.
• From YouTube we receive only the channel ID, name and icon URL, and the IDs and status of videos uploaded. We use these only to post videos on your instructions and show their status, never for advertising, AI training or sale to third parties.
• The Service's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• You can disconnect on the Service's social accounts screen, or revoke access in your Google Account security settings. When access is disconnected or revoked, we delete the access token and channel information we hold.

5. Retention and deletion

• We keep information for as long as your account exists.
• When you disconnect a social account, we delete its access token immediately. If you revoke the app on the network's side, we delete it in the same way on receiving the network's notice.
• To delete your account, or to request disclosure, correction or deletion of information we hold, contact us at the address below. We will act promptly after confirming your identity.
• If you request data deletion from Meta's app settings, we issue a confirmation code and you can check progress at /meta/deleted.

6. Security

All traffic is encrypted with TLS, and access tokens are stored encrypted. Passwords are hashed and login attempts are rate-limited. Servers run on Cloudflare's network with WAF, rate limiting and bot protection enabled.

7. Your posts

Content posted to a network through the Service is published on that network under its terms. You can delete posts from the Service's screens or on each network (Instagram and TikTok do not support deletion via API, so delete those in their apps).

8. Changes

We will announce changes to this policy on this page, and notify significant changes to your registered email address.

9. Contact

Kyotani Inc. (Taishi-cho, Minamikawachi-gun, Osaka, Japan)
Email: regi@sns.town