Privacy Policy

1. What we collect

• Access logs: IP address, User-Agent, referrer URL, pageviews (Vercel Web Analytics)
• Analytics measurement (Phase 2 enhancements): anonymous identifier (UUID stored in localStorage + Cookie, valid for 1 year, used to identify returning visitors); session identifier (UUID stored in localStorage, 30-minute timeout, used for in-session behavior analysis); SHA-256 hash of IP address (the raw IP is NOT stored; used only for country-level aggregation and bot / human classification, not personally identifiable); referral path (referrer URL is stored as scheme + host + path only, query string is discarded) and UTM parameters (utm_source / utm_medium / utm_campaign, etc.); engagement metrics (scroll depth at 25 / 50 / 75 / 100 % and dwell time in 30-second chunks); bot detection (User-Agent pattern matching to classify bot vs. human)
• Local settings: language, filter state, view history (localStorage, browser-only)
• Account info (registered users only): email, display name, auth tokens, display language, email delivery settings (whether the digest email is enabled, selected regions and themes, last sent time)
• Social features: comments, likes, bookmarks, follow relationships
• If you sign in with Google: the email address, name (used as the initial display name) and Google account identifier we receive from Google. We do not receive your Google account password

2. How we use it

• Service operation (article delivery, authentication, social features)
• Quality improvement (anonymous aggregation via Vercel Analytics, error monitoring via Sentry)
• Abuse prevention (rate limit, IP allowlist, etc.)
• Editorial improvement (aggregated reading patterns, no personal identification)
• Sending email (notices such as email address verification and password reset, and the digest email for registered users who opt in. You can stop the digest email at any time from My Page or via the link in each email)
• Signing in with a Google account (identity verification) and creating your account. We use the information received from Google only to provide the features of this site; we do not use it for advertising and do not provide it to third parties except as required by law

3. Cookies / local storage

We use cookies and localStorage to maintain authenticated sessions and improve usability. We do NOT use third-party advertising cookies. You can delete or disable them in browser settings; some features (e.g. authentication) may stop working.

4. Third-party services

We do not provide personal information to third parties except as required by law. We use the following cloud services as part of operating the service: Vercel (static hosting + Analytics), Fly.io (backend), Supabase (database), Google AI (Gemini translation and summary generation), Google (sign-in with a Google account), Resend (email delivery), Sentry (error monitoring). Each provider's privacy policy applies. Some of these providers are located outside Japan, including in the United States, and personal data may be processed outside Japan. Our database and backend run in the Japan (Tokyo) region.

5. Access / correction / deletion

To request access, correction, or deletion of your personal data, please contact info@gospel-ai.tech. We will respond after identity verification, within reasonable scope.

Deletion requests will be processed within 30 days as a rule (in line with GDPR Article 17 and the revised Act on the Protection of Personal Information, Article 35). Records keyed by anonymous_id in the custom_events / analytics_sessions tables are included in the scope of deletion.

6. Revision history

• 2026-05-04: v0.1 draft released
• 2026-05-17: v0.2 — added newly collected items for Phase 2 analytics, clarified 30-day deadline for deletion requests
• 2026-10-05: v0.3 — added collected items, purposes and service provider (Resend) for email delivery
• 2026-10-06: v0.4 — added collected items, purposes and service provider for Google sign-in