# network-isekai — Privacy Policy

> **DRAFT — not legal advice; counsel review required.**

**Service:** network-isekai (https://isekai.network)
**Last updated:** 2026-08-30
**Governing law:** Japan. This policy is designed to address Japan's **Act on the Protection of Personal Information (APPI)** as the primary regime, and, where applicable, the **EU/UK GDPR** and the **California CCPA/CPRA**.

## 1. Who we are (controller / business)

The Service is operated by **Awai Network** ("we", "us"), which acts as the personal-information handling business (APPI) / data controller (GDPR) / business (CCPA). Legal entity: **AWAI Network, L.L.C.** (Delaware 10704996). Sales contact (営業担当): **Ryo Awai**. Public contact: [support@isekai.network](mailto:support@isekai.network). This page does not invent a registered address, phone, or 代表者. EU/UK GDPR Article 27 representative and Data Protection Officer: 該当なし (not designated).

## 2. What we collect

Because the Service is open and content-addressed, most creative artifacts are **public by design** (see the Terms). We collect:

| Category | Examples | Source |
|---|---|---|
| Identity / authorship | `did:key` / CACAO identifier, display name, hue, profile (ADR-0002, ADR-0006) | You |
| User Content | scenes, logic, dance stages, assets, chat messages (public) | You |
| Social / activity | follows, likes, forks, plays modeled as ActivityStreams/ActivityPub (ADR-0006) | You / Service |
| Virtual economy | gem wallet, mint/attribution ledger tied to your identity (ADR-0006) | Service |
| AI-generation inputs | photos/prompts you submit to the generation backend (ADR-0008) | You |
| Moderation | account tier (`:unset/:minor/:teen/:adult`), reports, moderation status (ADR-0009) | You / Service |
| Technical | IP address, device/browser data, logs, cookies/local storage | Automatic |

`[CONFIRM: exact technical/analytics data collected, cookie and local-storage inventory, and whether any third-party analytics/telemetry is used.]`

## 3. Why we use it (purposes) and legal bases

We use personal information to: operate the Service (host, pin, distribute, fork); attribute authorship and forks; run the social graph, chat, feed ranking, and gem economy; run AI generation you request; moderate content and enforce the Terms; secure the Service and prevent sybil/abuse; and comply with law.

Under GDPR the legal bases are: **performance of a contract** (providing the Service you request), **legitimate interests** (security, anti-abuse, moderation, service improvement), **consent** (where required, e.g. non-essential cookies), and **legal obligation**. Under APPI we use personal information within the scope of the utilization purposes stated here. `[CONFIRM: define and publish the APPI utilization purposes (利用目的) precisely.]`

## 4. Publicity and immutability caveat

Published artifacts are content-addressed, **immutable**, publicly viewable/forkable, and may be **federated to other servers (e.g. Mastodon)** (ADR-0001, ADR-0006, ADR-0008). Personal information you place into public content or a public profile may be copied, forked, cached, or federated beyond our control and may not be fully retractable. Do not put sensitive personal data into public artifacts.

## 5. Sharing and subprocessors

We share personal information with service providers that process it on our behalf, and with federated servers for content you choose to publish. Known infrastructure includes **Cloudflare** (Pages hosting/CDN, Durable Objects for presence/chat) and **Modal** (GPU for AI generation) (README; ADR-0006, ADR-0008). `[CONFIRM: full subprocessor list with roles and locations (Cloudflare, Modal, kotoba/Datomic hosting, TRELLIS/model providers, any TTS/music providers, email, analytics), and links to their terms/DPAs.]` We do not sell personal information. `[CONFIRM: whether any "sharing"/"sale" as defined by CCPA/CPRA occurs, e.g. via analytics or ad SDKs.]`

## 6. International transfers

The infrastructure above may process data outside your country, including outside Japan and the EEA. Transfers rely on `[CONFIRM: transfer mechanism — e.g. GDPR Standard Contractual Clauses; APPI Art. 28 consent or equivalent measures; identification of recipient countries.]`

## 7. Retention

We retain personal information for as long as needed for the purposes above. Note that content-addressed/immutable artifacts and fork lineage are, by design, durable. `[CONFIRM: concrete retention periods per data category (account, logs, moderation records, gem ledger, AI-generation inputs) and deletion approach for immutable/pinned content and backups.]`

## 8. Security

We apply technical and organizational measures including cryptographic identity, sybil-gating, and access controls. No system is perfectly secure. `[CONFIRM: security measures detail and breach-notification process (APPI mandatory reporting to the PPC and affected individuals; GDPR 72-hour regime).]`

## 9. Your rights

- **APPI:** you may request disclosure, correction, addition/deletion, cessation of use, and cessation of third-party provision of your retained personal data, and lodge complaints with the Personal Information Protection Commission (PPC).
- **GDPR (EEA/UK):** access, rectification, erasure, restriction, portability, objection, and withdrawal of consent; and to complain to a supervisory authority.
- **CCPA/CPRA (California):** know, access, delete, correct, and opt out of sale/sharing; non-discrimination for exercising rights.

To exercise rights, contact [support@isekai.network](mailto:support@isekai.network) `[CONFIRM: identity-verification method]`. Note the immutability/federation caveat (§4) may limit erasure of already-published or forked content.

## 10. Children

See the Terms §1. The Service models minor tiers and disables publishing for minors, but does not by itself verify parental consent. `[CONFIRM: children's-data handling consistent with APPI, GDPR Art. 8, and COPPA if US children are in scope.]`

## 11. Changes

We may update this policy; the "Last updated" date reflects the latest version. `[CONFIRM: notice method for material changes.]`

## 12. Contact

Privacy contact: [support@isekai.network](mailto:support@isekai.network). EU/UK GDPR representative: 該当なし (not designated). `[CONFIRM: PPC-related filing/consultation contact details.]`

---

*Draft template grounded in the repository README and ADR-0001/0002/0006/0008/0009/0010. All `[CONFIRM]` items require product and legal-counsel confirmation before publication.*