Privacy Policy

Display preferences and Twitch support

We store your UI language, time zone, and preferred discovery language to personalize the display and sync settings across devices. Guest preferences stay in browser storage; signed-in preferences are stored in Supabase and the browser. You can change them in Settings. Language and location do not restrict which creators you can browse.

For supported official Twitch accounts, we retrieve public live status, titles, schedules, and VOD information through the Twitch API. Loading Twitch images or following Twitch links may send your IP address, browser information, and related requests to Twitch. We do not provide a feature that retrieves your Twitch login credentials, private viewing history, or followed-channel list.

1. Scope and operator

This Policy applies to personal and other user information handled by the operator identified on the Contact page in providing OshiDeck. External services linked from OshiDeck handle information under their own policies.

Operator information and the privacy contact are described on the Contact page.

2. Information we handle

We do not currently offer Google/YouTube account authorization or retrieve your YouTube watch history, private playlists, or subscription list. We do receive the creators and playlists you select on OshiDeck. You do not need to enter your Google or YouTube password into OshiDeck.

• Account information: email address, display name, user ID, registration and authentication timestamps, and authentication state. Passwords are processed through the authentication service.
• Deck information: saved creators, group names, memberships, order, and selected group.
• Playlist information: list names, saved YouTube video IDs, save times, list memberships, and order.
• Agreement records: the version of the Terms and Policy accepted and the acceptance time. First-use records are stored in the browser; signup records are stored with the account.
• Connection and maintenance information: IP address, access time, requested resource, browser information, and error, authentication, and security records. This includes information processed by hosting and authentication providers.
• Contact information: reply address, contact name, report content, verification materials, and handling history.
• Public activity information: talent and channel names, IDs and images; video titles, descriptions, streaming times and public statistics; and officially published affiliation and activity information. Where this identifies an individual, it is also handled under this Policy.

3. Purposes of use

OshiDeck does not currently operate its own advertising delivery or behavioral advertising tracking. We do not supply your saved creators, playlists, or contact details as sales leads to talents or agencies, or sell them for advertising. We will explain new purposes or optional tracking before introduction and obtain consent where necessary.

• Creating and authenticating accounts, maintaining sessions, and resetting passwords.
• Saving and syncing creators, groups, and playlists and displaying feeds for your selections.
• Finding, organizing, updating, and displaying public activity information and linking to its source.
• Investigating failures, improving quality, preventing abuse, and maintaining security.
• Handling inquiries, corrections, rights reports, and data deletion requests.
• Communicating important service or terms changes, meeting legal obligations, and protecting necessary rights.

4. Cookies and browser storage

Authentication cookies maintain login sessions. Local storage retains guest creators and groups, the selected group, and agreement records. To resume an action after sign-in, we temporarily keep the selected video or notification timing in sessionStorage for the same tab. Records older than one hour are not resumed; they are removed when you close the resume dialog or when their expiry is detected. These technologies support deck functionality and preserve your choices.

You can delete or restrict cookies and site data in your browser. This may sign you out, erase guest data, or display the agreement screen again. It does not delete account data stored on our servers.

Even in guest mode, relevant creator IDs and similar information are sent when requesting a feed. Guest use does not mean that no communication occurs with our servers or external content providers.

5. External services and transmitted information

External image providers and linked sites may use cookies under their own terms and settings. Once you move to YouTube, a social network, or a store, that service’s policy applies.

• Supabase provides authentication and data storage, processing email addresses, authentication information, deck and playlist data, and related information. Service providers are also involved in verification and password-reset emails.
• Cloudflare delivers and protects the website, APIs, and shared feeds, processing connection information such as IP addresses and requests.
• Google/YouTube: we use YouTube API Services for public channel and video information. When your browser requests thumbnails or icons from YouTube or other image hosts, it sends information such as your IP address, browser information, and the requested image to that host.
• Email services used for inquiries process messages, sender and recipient information, and attachments. Opening an email app does not send a message to OshiDeck; it reaches us after you send it.

6. Providers, disclosure, and international processing

We use external providers for authentication, hosting, storage, and email as necessary to operate the Service. We limit information to what is needed and manage its handling according to the purpose and required safeguards. We may share necessary information with advisers or relevant service providers to resolve inquiries or rights reports.

We do not disclose personal information to third parties except with your consent, as required by law, or as otherwise permitted by applicable law. There is currently no feature that publishes your saved creators, groups, or playlists to other general users.

Providers’ locations and infrastructure may involve processing outside Japan. Where international transfers require consent, contractual measures, or other safeguards, we follow applicable law. Agreement to this Policy does not replace any separately required disclosure or consent. Contact us for information about processing locations and safeguards.

7. Retention and deletion

We retain account, deck, and playlist information as needed for ongoing use, synchronization, and handling requests. We delete affected information following deletion operations for creators, groups, or playlists or a verified account-deletion request. We do not currently provide automatic account deletion after a fixed period of inactivity.

We retain inquiries and rights reports as needed to handle cases, prevent recurrence, meet legal obligations, and address disputes. Connection, authentication, and maintenance logs are retained for operation and security under the relevant infrastructure settings. Information no longer needed is deleted or made non-identifying.

Retention decisions consider the purpose, whether a case is resolved, statutory requirements, security needs, and relevant limitation periods. You can contact us about specific information and its retention.

Information may remain for a period in backups or legally required records after deletion. We limit it to recovery, legal compliance, or the applicable retained purpose and do not reuse it for ordinary service delivery. Removal of public activity listings is handled separately through the rights contact channel.

8. Access, correction, deletion, and other requests

You can change or delete saved creators, groups, and playlists in the interface. Contact us for account deletion, access, correction, cessation of use, or similar requests. For account requests, use your registered email address where possible; we verify identity only as necessary. We will not ask for passwords or verification codes.

We respond under applicable law, explaining any additional information needed, the outcome, and reasons for any part we cannot fulfill. We follow statutory response deadlines where applicable. If a legally permitted procedure involves a fee, we explain it in advance.

Where processing relies on consent that you may withdraw, contact us to withdraw it. Withdrawal does not affect earlier lawful processing, and processing needed on another basis, such as contract performance or legal obligations, may continue.

9. Users outside Japan

Depending on applicable law and circumstances, you may have rights to access, rectify, erase, restrict processing, port data, object, withdraw consent, or complain to a supervisory authority. We handle applicable rights under their legal requirements.

Where EEA or UK data protection law applies, processing necessary to provide accounts, decks, and playlists relies on contract performance; necessary operation and security rely on legitimate interests; legal compliance relies on legal obligations; and optional processing relies on consent where needed. For legitimate interests, we consider the balance with users’ rights and interests.

We do not provide a feature that makes decisions with legal or similarly significant effects on users solely through automated processing.

10. Security and minors

We work to prevent leaks, unauthorized access, and tampering through authentication, user-specific access controls, encrypted connections, and management of operational access. If an incident occurs, we investigate, limit its impact, and make legally required reports and notifications.

Minors should review this information with a parent or guardian where necessary. If we learn that information requiring parental consent was collected without it, we take appropriate action such as stopping its use or deleting it. Parents and guardians may contact us with concerns.

11. Changes and contact

We update this Policy when information, purposes, providers, or other practices change. We explain material changes and their effective date through the Service or other appropriate means and obtain renewed consent where required by law.

Contact us with privacy questions or complaints. Japanese is the original language and translations are also provided; this does not limit rights under applicable law.