Kyn Privacy Policy (Effective September 9, 2025)

Becoming, Inc. ("we", "us") is committed to protecting your personal information. This Privacy Policy explains how we handle information in connection with Kyn, a family photo sharing service (the smartphone app and related website, collectively the "Service").

1. Purposes of Processing

We may process personal data for the purposes below.

• Provide, maintain, protect, and improve the Service (features, performance, fraud prevention)
• Account management and support
• Push notifications
• Provide and manage subscriptions (per app store rules)
• Analytics, quality improvement, and marketing (where applicable)

2. Data We Collect

We may collect the following information.

• Authentication data: IDs/tokens issued by authentication providers (for API authentication)
• Profile data: name, nickname, profile image (when you choose to provide them)
• Media data: photos/videos you upload and basic file metadata (content type, size, checksum)
• Push notification tokens: device tokens (e.g., FCM/APNs)
• Usage data: basic app/web actions and error logs (to the extent necessary)
• Device info and IP address: OS/version, hardware model, browser type/version, IP address
• Device identifiers: advertising IDs (Apple IDFA, Google AAID, etc.)
• Billing/subscription state: subscription status (payment processing is handled by app stores)
• Note: A minimal set of data (e.g., an authentication identifier such as a UID) is required to create and use an account. Other data is optional.

2.1 Not Collected / Notes

• We may use non‑sensitive EXIF fields such as capture time (timestamp) for basic features (e.g., sorting), but we do not proactively extract or store sensitive EXIF data such as location (GPS).
• Files may still contain embedded EXIF. For privacy protection, please review and remove or handle such metadata appropriately before sharing. We are not responsible for issues arising solely from embedded metadata.

3. Content Rights and Scope of Use

• You retain copyright in the content (photos/videos) you upload.
• We store and process your content only to the extent necessary to provide and operate the Service.
• We do not sell your content or use it for advertising purposes.

4. Sharing Scope

• Content is shared only with family and acquaintances whom you invite and approve.
• We do not disclose your content to third parties without your consent.

5. Push Notification Tokens

• For push delivery, we store device tokens (e.g., FCM/APNs) linked to your account.
• We delete or disable tokens upon logout, token refresh, or account deletion.

6. Cookies, SDKs, and Opt‑Out

• We may use cookies and SDKs for analytics, quality improvement, and marketing.
• You can restrict or opt out of certain tracking via your device/browser settings. See each OS/browser for instructions.

7. Processors and Service Providers

• We may use the following categories of service providers to operate the Service:
• Infrastructure / storage / CDN
• Authentication / push delivery
• Payments / subscription management
• Analytics / marketing
• Such providers process information only as needed to perform their duties for us.

7.1 International Data Transfers

• We may process and store personal data outside your country of residence for infrastructure and related purposes. Where required, we use appropriate safeguards such as Standard Contractual Clauses (SCC).

8. Retention and Deletion

• We retain personal data for as long as necessary to fulfill the purposes above.
• After you request account deletion, we aim to delete personal data within 30 days (subject to legal obligations).
• Due to backups and technical reasons, deletion may be delayed.
• Access logs (IP address, user agent, etc.) are retained for up to 14 days for security and operations, then deleted.
• When you delete your account, we delete your personal data (subject to legal obligations). Content you previously shared may remain in recipients’ accounts; we are not responsible for recipients’ storage or use.

9. Children’s Privacy

• The Service is not designed for children; it is primarily used by parents and adult family members.
• If a child uses the Service, use must be under the supervision of a parent or guardian.
• Requests to delete children’s information: support@becoming.co.jp
• We do not knowingly collect personal data from children under 13 without verifiable parental consent. If we learn we collected such data without consent, we will delete it promptly.

10. Your Rights

• You may request access, correction, or deletion of your personal data under applicable law. Please contact: support@becoming.co.jp
• We may request additional information to verify your identity when processing requests.
• Residents of certain jurisdictions (e.g., California) may have additional rights under applicable law. We do not sell or share personal information. Where required, we will provide opt‑out methods.

11. Security Measures and Incident Notice

• We use appropriate technical and organizational measures (including encryption in transit and at rest).
• If a personal data breach occurs, we will notify users and regulators without undue delay as required by law.

12. Changes to This Policy

• We may revise this Policy as features evolve or laws change.
• We may notify by methods we consider appropriate.
• Unless we specify otherwise, changes take effect upon your first use after we post the updated Policy in the Service.

13. Contact, Opt‑Out, and Response Times

• Contact: support@becoming.co.jp
• We aim to respond to privacy requests within 45 days (extensions as permitted by law).

14. Additional Information for Europe (GDPR)

• Legal bases: consent, performance of a contract, legitimate interests, legal obligations
• Your rights: access, rectification, erasure, restriction, portability, objection
• Withdrawal of consent: you can withdraw consent at any time (without affecting prior lawful processing)
• Right to complain: you can lodge a complaint with your local supervisory authority
• No sale: we do not sell personal data to third parties
• Examples of mappings: notifications = legitimate interests; subscriptions = performance of a contract; log retention = legitimate interests

---

Operator: Becoming, Inc.

Contact: support@becoming.co.jp

Effective/Last updated: 2025-09-09