fridge Privacy Policy

Effective date: September 8, 2026

Last revised: October 3, 2026

This English translation is provided for convenience. The Japanese version is the official text, and in the event of any inconsistency the Japanese version prevails.

The operator of fridge (the “Service”; the operator, the “Operator”) establishes this Privacy Policy (the “Policy”) regarding the handling of user information in the Service.

1. Operator information

• Operator: Fridge Co. (Ryo Babazono)
• Contact (including complaints and inquiries): info@fridge-co.com
• The Operator’s address will be provided without delay through the contact desk above upon request from the individual concerned.

The Operator is a telecommunications carrier that has filed the notification required under the Telecommunications Business Act of Japan.

2. Secrecy of communications

In accordance with Article 4 of the Telecommunications Business Act of Japan, the Operator protects the secrecy of communications between users (posts, comments and similar content within a Group). This content is handled only mechanically and only to the extent necessary to provide the Service (storage, delivery, creation of slideshows and similar derivatives), and is not viewed or used except in the following cases:

1. where required by law; or
2. where, in response to a report from a user about a violation of the Terms of Service, the reported content is reviewed to the minimum extent necessary (including automated assessment by an external AI moderation service).

3. Information we collect

The Operator collects the following information in providing the Service.

(1) Information users enter or post

• Account information (email address, password, display name, profile image). Authentication is by email address and password.
• Posted content (photos, videos, text, comments, reactions, tags). Metadata such as location information (GPS) contained in posted photos and videos is removed during processing of the post. The date and time of capture may be used to display posts.
• Group information (group name, membership, use of invitation codes)
• Content of inquiries and feedback
• Records of blocks and reports (the User you blocked or reported, the post or comment from which you did so, the reason and details of a report, and the text of the reported content at the time of the report)

(2) Information collected automatically

• Device information (device model, OS version, language setting, device identifiers)
• Log information (IP address, access date and time, operation logs)
• Push notification tokens
• Usage information (types of screens viewed, operation events, etc.), used only for statistical analysis (see the disclosure on external transmission of user information).

(3) Purchase information

• Purchase history and receipt information through the App Store / Google Play (payment details such as credit card numbers are handled by Apple or Google and are not obtained by the Operator)

4. Purposes of use

The information collected is used for the following purposes:

1. providing the Service (storing posted content, sharing and displaying it within Groups, creating slideshows and similar derivatives);
2. authenticating accounts and verifying identity;
3. managing purchases of paid plans, fridge ticket packs and photobooks, and managing fridge ticket balances;
4. delivering notices by push notification and similar means;
5. investigating defects, improving quality and developing new features;
6. analysing usage (statistical analysis);
7. preventing misuse, responding to reports and otherwise keeping the Service safe (including reviewing content using an external AI moderation service);
8. responding to inquiries; and
9. notifying users of important matters such as changes to the Terms.

5. Provision to third parties

The Operator does not provide users’ personal data to third parties except in the following cases:

1. with the user’s consent;
2. where required by law; or
3. where necessary to protect a person’s life, body or property and it is difficult to obtain the consent of the person concerned.

Displaying a user’s posted content to the members of the same Group is sharing at the user’s direction and does not constitute provision to a third party under this Section.

6. Outsourcing to external services (including provision to third parties located abroad)

To the extent necessary to provide the Service, the Operator entrusts the handling of information to the external services below. Their servers are located mainly in the United States. For information on the personal data protection systems of other countries, please refer to the survey published by the Personal Information Protection Commission of Japan (Survey of systems for the protection of personal information in foreign countries). Through contracts with each provider, the Operator takes the measures necessary to ensure that equivalent safeguards under the Act on the Protection of Personal Information of Japan are maintained continuously, and periodically confirms their implementation. On request, the Operator will provide an outline of the safeguards taken by each contractor; please contact the contact desk. Note that the United States has no comprehensive federal privacy law covering the private sector; the private sector is governed by state laws and sector-specific laws.

Contractor	Country	Entrusted operations
Google LLC (Firebase)	United States	Authentication, database, push notifications and similar
Cloudflare, Inc.	United States	Storage of photo and video data, content delivery, server processing, aggregation of usage statistics
Anthropic PBC	United States	AI assistance (content moderation) when the Operator reviews reports. When the Operator requests it, the reported photo or video (for a video, still frames extracted from it) and the Operator’s question are sent. Automatic transmission of reported content for automated review is being discontinued (until the change is complete, reported content may still be sent for automated review). Used under contract terms that prevent the submitted content from being used to train AI models
RevenueCat, Inc.	United States	Management of billing and purchase status
Expo (650 Industries, Inc.)	United States	Delivery of app updates
Discord Inc.	United States	Forwarding of inquiries, feedback and operational notices to the Operator

7. Security measures

The Operator takes the following security measures to prevent leakage, loss or damage of personal data. Details will be provided without delay on request through the contact desk.

• Basic policy and rules: in addition to this Policy, procedures for handling personal data are documented.
• Organisational measures: persons who handle personal data are limited to the Operator and its contractors, and the state of handling is monitored.
• Human and technical measures: access control, encryption of communications, access restrictions by authentication and protection against unauthorised access from outside.
• Supervision of contractors: contractors are selected after confirming their security arrangements and are contractually required to handle data appropriately.
• Awareness of the external environment: personal data is stored mainly on servers located in the United States (Google LLC, Cloudflare, Inc. and others). The above measures are implemented with an understanding of the U.S. personal data protection system.

8. Retention periods and deletion

• Withdrawal (account deletion): available at any time from the settings screen in the app. If you cannot use the app, you may request deletion through the contact desk (info@fridge-co.com). On withdrawal, the personal data and posted content linked to the account are deleted (except that the upload-request connection records described below are kept for 90 days from collection and then deleted). Complete deletion of media files on the server and deletion from backups may take a certain period of time.
• Notification history (the history of in-app notifications) is deleted 90 days after creation.
• Usage information is deleted when the retention period of the analytics platform (three months) elapses. It is not covered by the deletion carried out when an account is deleted.
• Server operation logs (IP addresses, access timestamps, error information and the like) are stored separately from the analytics data above. Records of the source IP address and time of each request to issue an upload URL made when you upload a photo or video (post attachments and member icons; that is, at the time of the upload request) are kept for 90 days from collection to prevent misuse, to respond to reports and to respond to disclosures required by law, and are then deleted automatically (they are kept for 90 days from collection even after you withdraw); other operation logs are deleted automatically after a shorter period (except logs such as audit logs for which a longer retention period is prescribed).
• Dormant accounts: accounts not used for two years since the last use may have their data deleted after prior notice and information about export options.
• For photos and videos in posts removed after a report, the copies kept for reviewing the report are retained for 90 days after the decision to remove them, to handle objections, repeat reports and inquiries, and are then deleted (this also applies after withdrawal, except where preservation is required by law as described below).
• Notwithstanding the above, where a report to or preservation for the authorities is required by law (such as reports concerning the sexual exploitation of children), the content concerned and related records are preserved, with access restricted, for the period prescribed by law.
• Beyond the above, personal data is not retained longer than necessary to achieve the purposes of use.

9. Children’s information

Accounts on the Service can be created by persons aged 13 or older (Terms of Service, Article 2). Photos and videos of children may be posted within family and friend Groups on the Service. Posters should be considerate of the wishes of the people who appear in their posts (and, for minors, of their guardians). The Operator handles posted content only to the extent necessary to provide the Service.

If you wish to have content in which you (or your child) appear removed, please contact the contact desk. We will respond within a reasonable scope, for example by contacting the poster or removing the content.

Taking into account amendments to the legal framework for children’s personal information (such as rules on handling the personal information of children under 16), the Operator will review the Service and this Policy as necessary.

10. Requests for disclosure and similar matters

Under the Act on the Protection of Personal Information of Japan, users may request notification of the purposes of use, disclosure, correction, addition, deletion, suspension of use and similar measures regarding their retained personal data. Please send requests by email to the contact desk (info@fridge-co.com). After verifying your identity, we will respond without delay. No fee is charged.

11. External transmission of user information

For information transmitted from users’ devices to external parties, please see “External transmission of user information.”

12. Changes to this Policy

This Policy may be revised in response to changes in law or in the content of the Service. Important changes will be announced by appropriate means such as in-app notifications.

13. Contact desk (complaints and inquiries)

Complaints and inquiries regarding the handling of personal information are accepted at:

info@fridge-co.com