Privacy Policy

1. Our approach

We limit collection to information needed to operate and secure the Service, respond to rights concerns, and comply with law, and retain it only for a purpose-based period. This policy applies to both the general and adult areas.

2. Information collected

• Posts: thread titles, text, uploaded images, board, timestamps, and related submission information
• Connection and abuse-prevention data: the connecting IP address is received and transformed with a secret into a hard-to-reverse identifier that changes daily, together with time, board, and request information
• Browser data: post-deletion credentials, display theme, and adult-area age-verification state
• Reports and takedowns: target IDs, categories, explanations, supporting grounds, and the email address entered for an adult-area takedown
• Administrator data: email address received from Google, login state, moderation actions and reasons, legal holds, and access records

3. Purposes

• Accepting, displaying, expiring, and enabling poster deletion of content
• Preventing spam, unauthorized access, prohibited content, age-check evasion, and other misuse
• Handling reports, takedowns, rights concerns, safety issues, and inquiries
• Safety review, quarantine, moderator review, and re-upload prevention for adult images
• Administrator authentication, access control, audits, and legal requests
• Incident investigation, security, service improvement, and legal compliance

4. Retention

• Threads, text, and public images: publication ends 24 hours after thread creation; content is then normally deleted or scrubbed.
• Hard-to-reverse connection identifiers: retained for up to 30 days after posting.
• Reports, moderation actions, and audit records: normally retained for 180 days.
• Adult takedown requests: normally retained for 180 days after receipt; resolved requests are normally retained for 90 days after resolution.
• Administrator sessions: up to seven days. Temporary Google login state lasts up to ten minutes.
• Information subject to a legal duty, dispute, report, or legal hold may be isolated and retained beyond the ordinary period where necessary.

5. Cookies and browser storage

Cookies are used for administrator authentication and adult-area age verification. Deletion credentials and display theme are stored in local storage; temporary navigation state is stored in session storage. If a deletion credential is cleared, it cannot be reissued and poster-initiated deletion may no longer be available.

6. Service providers and international processing

• Cloudflare: site delivery, server processing, database, image storage, abuse prevention, and Turnstile verification
• Google: OAuth authentication for administrators
• These providers may process information outside Japan, including through infrastructure located abroad. Processing is commissioned only as needed for the purposes above.

7. Disclosure to third parties

We do not disclose personal data to third parties except with consent, where required by law, where urgently necessary to protect life, safety, or property and consent is difficult to obtain, where needed by a service provider, or as otherwise permitted by law. We may provide information to police, courts, or other public authorities in response to a lawful request concerning crime or serious rights violations.

8. Security

We use reasonable safeguards including access controls, separation of secrets, encryption in transit, encryption of reports and takedowns, audit records, and deletion after retention periods. No internet service can guarantee complete security.

9. Your rights

Subject to applicable law, you may request notice of purpose, access, correction, addition, deletion, restriction, erasure, or cessation of third-party disclosure of retained personal data. We may verify your identity or authority. Anonymous posts may not be linkable to you, which can prevent us from fulfilling a request.

10. Minors

People under 18 may not use the adult area. If you encounter sexual content involving a minor, do not save or redistribute it; report it immediately through the post report control or Takedown page. Contact police or emergency services where there is immediate danger.

11. Changes

If we materially change the information collected, purposes, or providers, we will update this page and its effective date and provide advance notice on the Service where required.

12. Controller and contact

The Service is individually operated under the name ろばみみ運営事務局. Contact us at robmimi@robamimi.gripe for privacy questions and data rights requests. Use the Takedown page for rights complaints. If the operator incorporates, this section will be updated with the applicable operator information.