Privacy Policy

Last updated: May 27, 2026

1. Introduction

ZAWA SYSTEM, the operator of Maskly ("the App"), respects your privacy. The App is designed with an "on-device first" approach, meaning image processing is performed primarily on your device. This policy describes how the App handles personal information and image data.

2. No Account Required

The App does not require account creation or sign-in. We do not collect account information such as your name, email address, or phone number. You are identified only on a per-device basis.

3. Image Data

Images you process with the App are handled on your device by default. Masked images are never transmitted to the operator's servers.

However, with your explicit consent, the App may use Google's Gemini AI to enhance detection of license plates, ID cards, and similar items. In that case:

Only an image compressed to a maximum edge of 1280px is transmitted to Gemini AI
The original image, EXIF metadata (location, timestamps, etc.), and the masked image are NOT transmitted
Transmission is solely for the purpose of detecting locations of sensitive objects, and the design relies on Firebase AI Logic / Vertex AI policies which prohibit long-term retention

You can withdraw your consent at any time from the Settings screen. After withdrawal, the App will rely solely on on-device detection (Google ML Kit).

4. Face Data

Maskly does not collect, store, or transmit face data. Face handling is strictly limited to the following:

What is computed: Only bounding box coordinates (x, y, width, height) of faces visible in the photo you select, computed on-device by Google ML Kit Face Detection. No face embeddings, face prints, biometric templates, landmarks for identification, cropped face images, or thumbnails are extracted.
Purpose: The coordinates are used solely to overlay a visual mask (solid fill, blur, or pixelation) on detected face regions so you can safely share the photo. Maskly does not perform face recognition or identification, and does not link faces across photos.
Sharing with third parties: None. Face detection runs entirely on-device via Google ML Kit and does not transmit data off the device. The optional cloud detection path (Google Gemini via Firebase AI Logic) is used only for license plates, ID cards, and text context — never for faces.
Storage location: None. Bounding box coordinates exist only in volatile device memory during the active editing session.
Retention: Zero. Coordinates are discarded immediately when you finish masking, leave the editing screen, or close the app. Nothing related to faces is written to disk, a database, or any server.

5. Information We Collect

The App collects the following information:

Usage analytics (Firebase Analytics): Aggregated, non-personally-identifiable statistics such as launch count, screen navigation, and feature usage
Crash reports: Technical information needed to diagnose crashes (device model, OS version, stack trace, etc.)
Advertising data (Google AdMob): Identifiers used to display and serve ads. On iOS, this complies with your App Tracking Transparency choice
Device information: OS version, language setting, screen size, etc.

6. How We Use Information

We use collected information to:

Provide the personal-information masking feature
Improve app quality and detect issues
Serve and optimize advertising
Detect abusive use (via Firebase App Check)

7. Third-Party Services

The App uses the following third-party services:

Firebase (Google LLC): Hosting, Remote Config, Analytics, Crashlytics, App Check, Firebase AI Logic (Gemini API gateway)
Google Gemini AI (Google LLC): Detection of license plates, ID cards, etc. (only with consent; only the compressed image is sent)
Google ML Kit: On-device detection (face detection, OCR, QR/barcode). Data does not leave your device
Google AdMob (Google LLC): Advertising

Please review each service's privacy policy.

8. Cross-Border Data Transfers

Through the third-party services listed in Section 7, user data may be provided to the following third party located outside Japan:

Google LLC (United States): Firebase Hosting, Remote Config, Analytics, Crashlytics, App Check, Firebase AI Logic (Gemini API gateway), AdMob

For information on the United States personal data protection regime, please refer to the materials published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/). Google LLC handles personal data at a level equivalent to the requirements of Japan's Act on the Protection of Personal Information (APPI), based on its privacy policy (https://policies.google.com/privacy) and applicable contractual safeguards such as standard contractual clauses (SCC).

9. Security Measures

The Operator takes the following measures to prevent leakage, loss, or damage of personal information and to maintain appropriate security:

Basic policy: This Privacy Policy publicly discloses the Operator's approach to handling personal information
Organizational measures: A responsible person for personal information handling is designated, and a dedicated inquiry channel is provided
Personnel measures: Personnel who handle personal information are required to comply with this Policy
Technical measures: Abuse prevention via Firebase App Check, TLS encryption for data in transit, and least-privilege access controls on Firebase
Physical measures: Image data is, as a rule, processed only on the user's device and is not stored on the Operator's servers
Awareness of foreign environments: As stated in Section 8, where personal data is entrusted to a foreign third party (in the United States), the Operator confirms the personal data protection regime of the relevant country and the contractual safeguards in place

10. Data Storage and Deletion

The App itself does not store user content (images, detection results) on the operator's servers. Local app settings are removed when you uninstall the App. Compressed images sent to Gemini are designed to be discarded shortly thereafter, in accordance with Google's policies.

11. Advertising and App Tracking Transparency (iOS)

On iOS, an App Tracking Transparency (ATT) prompt is shown the first time you launch the App. You may decline; all features remain fully usable, but ads may be less personalized.

12. Children's Privacy

The App is not primarily intended for users under 16. Users under 15 should use the App only with the consent of their parent or legal guardian. We do not knowingly collect personal information from children under 13.

13. Your Rights (Disclosure, Correction, Suspension of Use)

Under Japan's Act on the Protection of Personal Information (APPI), you may request notification of the purpose of use, disclosure, correction, addition or deletion of content, suspension of use or erasure, and suspension of third-party provision of retained personal data held by the Operator.

Please submit your request to the contact email below. The Operator will verify that the requester is the data subject or their authorized representative by reasonable means, and will respond promptly in accordance with the APPI and other applicable laws.

Because the App does not require account registration and is designed not to retain directly identifiable personal information on the Operator's servers, the scope of personal data the Operator directly holds is very limited. For information collected anonymously via Firebase Analytics, AdMob, and similar services, you may need to use the opt-out mechanisms provided by the respective service providers.

14. Changes to This Policy

This policy may be updated. For material changes related to AI data handling, the App may ask you to provide consent again. Changes take effect upon posting on this page.

15. Contact and Complaints

For privacy inquiries, requests for disclosure or the like, and complaints, please contact us at:

Operator: ZAWA SYSTEM
Email: info@zawasystem.com

If you are not satisfied with the Operator's response regarding the handling of your personal information, you may also consult Japan's Personal Information Protection Commission (https://www.ppc.go.jp/en/).