KoeFarm Privacy Policy

1. Principle: Your data is yours

The App is built on the principle that farm records are the farmer's own asset. Data you enter (work logs, sales/expenses, field and crop data) is stored only on your device (offline) by default and is not sent to our servers. You can export all data at any time as CSV / JSON / a standard format (OCSM JSON-LD), and delete it.

The App has no account/sign-up feature and does not identify users by name, email address, or similar. We do not display ads and do not conduct cross-app/cross-device third-party tracking (see §12).

That said, certain features — AI analysis of records and the AI agent "Koemaru" — send a limited, specific set of information to external services. The sections below describe exactly what is sent, for what purpose, and to whom.

2. Information we handle

We do not directly collect personally identifying information (name, address, phone number, card number) for use of the App. Payment is handled by Apple; contacting us is optional.

3. Speech recognition

• Japanese: Uses Apple's SFSpeechRecognizer. On supported devices, on-device recognition is preferred. Where on-device recognition is unavailable, processing may occur on Apple's servers (subject to Apple's privacy policy).
• Multilingual mode (optional, beta): Uses the open-source engine whisper.cpp. Recognition itself runs entirely on-device (offline); voice data and transcription results are never sent externally. However, the first time you use multilingual mode, the App downloads the recognition model file from a server operated by Hugging Face, Inc. in the United States, and that download exposes communication information such as your IP address to Hugging Face (see §7, "List of external destinations").

4. AI analysis (record structuring)

To structure the record text you create (e.g., via voice input) more accurately, the App can send that text, via our server (a Supabase Edge Function), to the OpenAI, L.L.C. API (model: gpt-4o-mini) in the United States for analysis.

• Free quota: Up to 15 uses per month are provided automatically at no charge; no sign-up or extra action is required.
• Sent: Record text, crop name, field name.
• Not sent: Precise field coordinates (e.g., lot numbers), sensitive figures such as sales amounts, personal identifiers.
• Opt-in consent: The first time you use AI analysis (or Koemaru) in the App, we show an opt-in consent dialog that clearly states what will be sent. The feature is enabled only if you consent. You can turn it off at any time in Settings.
• When off or over the free quota: The App automatically falls back to on-device rule-based processing; no external transmission occurs.
• Retention: By default, the OpenAI API does not use submitted data to train its models (§9). Our server only tracks the number of analyses and token counts; it does not accumulate the content of your records.

5. The AI agent "Koemaru"

The App includes an AI agent called "Koemaru," which lets you create and summarize records via chat. When you use Koemaru, the following information is sent, via our server (a Supabase Edge Function), to the OpenAI, L.L.C. API (gpt-4o-mini) in the United States:

• The text of your chat messages
• A summary of your crop/planting information and recent work records
• The total amount of this month's sales and expenses (a monthly total only — not itemized detail)
• The location of your field, at the municipality level (street address / lot number is never sent)
• Weekly weather information

Not sent: Personal identifiers such as name or phone number, detailed lot numbers/addresses of fields, full itemized record data.

Usage limits: The free plan includes 15 messages per month; the Premium subscription includes 200 messages per month. Once the limit is reached, you can resume the following month, or via a top-up purchase if one is offered.

Opt-in consent: The first time you use Koemaru, it is covered by the same opt-in consent dialog described in §4. The feature is enabled only if you consent, and you can turn it off at any time in Settings. While off, Koemaru is unavailable.

Koemaru is built with a constraint against giving individualized tax advice, and displays a disclaimer that its answers may contain errors and are for reference only.

6. Weather, map (cadastral polygons), and satellite data

• Weather: Fetched from Open-Meteo (a weather data provider based in Germany). Only a coordinate rounded to a coarse ~1 km grid is sent when retrieving weather.
• Field registration via map (cadastral / "fude" polygons): When you register a field from the map, the App sends the coordinates of the map's currently visible area to Japan's Ministry of Agriculture, Forestry and Fisheries (MAFF) cadastral polygon distribution service (built on Esri's ArcGIS Online, services8.arcgis.com), to retrieve parcel boundary data.
• Satellite growth monitoring (Premium, optional): Only if you configure your own Copernicus Data Space Ecosystem (CDSE, a European service) credentials, the App sends your field's polygon boundary to CDSE to retrieve the vegetation index (NDVI). This feature is entirely opt-in and uses your own credentials; we never mediate or store this data.

7. List of external destinations

Using features of the App may send information to the external providers/services listed below. In the spirit of Article 27-12 of Japan's Telecommunications Business Act (external transmission rules), we list what is sent, for what purpose, and the destination country.

8. Cross-border transfers (transfer to a third party in a foreign country)

As shown above, using the App may send information to providers located outside Japan: OpenAI and Hugging Face (both United States), Open-Meteo (Germany), and the Copernicus Data Space Ecosystem (Europe).

Under Article 28 of Japan's Act on the Protection of Personal Information (APPI), transferring personal data to a third party in a foreign country generally requires obtaining the individual's prior consent. The App shows an opt-in consent dialog the first time you use an AI feature (AI analysis or Koemaru), which clearly states what will be sent and to which country, and sends data to OpenAI only if you consent. If you do not consent, these AI features are unavailable, and records are processed entirely on-device (rule-based).

Retrieving the multilingual recognition model (Hugging Face) occurs only if you select "multilingual mode," and the information sent is limited to communication metadata (e.g., IP address) generated by the file download — no record content is sent. The coordinates sent for weather (Open-Meteo) are rounded to a coarse ~1 km grid and do not directly identify an individual.

The level of personal-data protection in destination countries may differ from Japan's. You can review each provider's privacy policy here:

• OpenAI: https://openai.com/policies/privacy-policy
• Hugging Face: https://huggingface.co/privacy
• Open-Meteo: https://open-meteo.com/en/terms

9. How OpenAI handles data we send

Data sent via the OpenAI API product used by the App is, per OpenAI's "API data usage policy," not used by default to train OpenAI's models. Retention periods also follow that policy. Please refer to OpenAI's published materials for details.

10. Information stored on our server

The App has no account feature, so we never identify you by name, email, or similar. That said, to manage usage of AI features (AI analysis and Koemaru), our backend server (Supabase, assumed to run in AWS's Tokyo region) stores:

• A device identifier (iOS's identifierForVendor — a random, Apple-provided ID scoped to apps from our developer account)
• Monthly count of AI feature use
• Input/output token counts from AI feature use (for usage aggregation and quota enforcement)

This information is not linked to your name, email, or other contact details. However, because it retains an identifier that continuously identifies the same device, it is not simply anonymous statistical data. We do not describe it as "anonymous"; we manage it appropriately as information that may constitute personal-related information or personal data under the APPI.

Retention period: 1 year from the date of last use. We delete this data after that period. If you would like us to delete this data sooner, please contact us at the support email address in §19. We will verify your request and delete the data without delay.

11. iCloud sync (optional)

If you turn on iCloud sync in Settings, all of your record data, including work logs and sales/expenses, is stored in your own iCloud account (the "private database" of Apple's CloudKit) and synced across your devices signed in with the same Apple ID. This happens entirely through Apple's infrastructure within your own iCloud storage, without passing through our servers. We cannot access this synced data.

iCloud sync is optional and off by default. Please refer to Apple's privacy policy for how Apple handles this data.

12. Tracking and advertising

The App has no account/sign-up feature and displays no ads. We do not embed third-party tracking (e.g., advertising SDKs) that tracks users or devices across apps. We do not request App Tracking Transparency (ATT) permission.

13. Analytics on our website

On the KoeFarm websites we operate (including the pages aimed at agricultural corporations), we run lightweight analytics so we can see which referral channels bring visitors and how far they read.

We use no third-party analytics or advertising tools whatsoever (including Google Analytics). The analytics data is stored only on our own server (Supabase, assumed to run in AWS's Tokyo region).

What we store:

What we do not store: names, email addresses or other personally identifying information; location data; or cookie-based cross-site tracking identifiers.

We do not store IP addresses as analytics data (although, by the nature of network communication, they are transiently recorded in ordinary server-platform access logs).

The session identifier is regenerated every time you close the tab and is not linked to any name, email address, or persistent device identifier. We therefore cannot track a returning visitor.

Only if you submit the pre-registration form do we store, on the same server, the information you entered (email address, name, organization name, workforce size band, crops, your message, and whether you wish to join a pilot) together with the referral information for that submission. We use this solely to reply to your enquiry and to keep you informed about pre-registration, and for no other purpose. To request deletion, please contact us at the address in §19.

14. Third-party disclosure

Except as required by law, we do not disclose your record data to third parties. The external transmissions described in §4–§6 and §8 occur only when you use the corresponding feature and are transmissions incidental to providing that feature — not disclosure to third parties for marketing or other purposes.

15. Retention and deletion

• Records are stored on your device by default. If you turn on iCloud sync, they are also stored in your own iCloud.
• Deleting the App erases on-device data (data stored in iCloud follows your iCloud settings/actions).
• You can export and delete all data from within the App at any time.
• Information stored on our server (device identifier and usage data, §10) is deleted 1 year after your last use.
• Website analytics data (§13) is deleted 1 year after collection. Information received through the pre-registration form is kept until we have finished handling your pre-registration and correspondence, or until you ask us to delete it.

16. Requests for disclosure, etc.

If you, as the data subject, request notification of purpose of use, disclosure, correction, addition, deletion, or suspension of use of your retained personal data under APPI Articles 32–39, we will verify your identity and respond without delay in accordance with the law. Please send such requests to the contact address in §19.

Note that your record data (work logs, sales/expenses, field information, etc.) is stored on your own device (and, optionally, your own iCloud) and is not stored on our servers. The personal data we hold is limited to the device identifier and usage information described in §10.

17. Minors

The App is intended for business operators and agricultural workers. Minors should use it only with the consent of a parent or guardian.

18. Changes

We may revise this Policy in response to legal changes or new features. We will announce significant changes in the App or on this page.

19. Contact

Miyakoya (Koya Miyabayashi)
Email: koyablog.1104@gmail.com

Please direct questions about this Policy, disclosure requests, and data deletion requests to the email address above.