Privacy Policy
Wonderful Life (Aiken Kanrisho) / Wonderful Life Trainer
日本語This policy explains what information the iPhone apps "Wonderful Life (Aiken Kanrisho)" (the "Owner app") and "Wonderful Life Trainer" (the "Trainer app") handle, why, and where.
In short: ads are shown only when you use the server AI (the summary for sharing your diary with a trainer, and when you choose "Server AI" in the AI assistant; not to monthly premium members); there are no ads anywhere else in the app. Optional usage sharing is being prepared for the Trainer app. Collection and upload remain disabled until performance verification and endpoint configuration are complete. We do not sell information to third parties. We do not collect email addresses, phone numbers, passwords, or contacts.
1. Operator and contact
Operator: Yuta Uehara (operator of the app "Aiken Kanrisho")
Questions and data-deletion requests: send a direct message to Instagram "@wonderful.life.app" (https://www.instagram.com/wonderful.life.app).
2. Information the Owner app keeps only on your device
Your dogs' profiles (name, breed, birthday, vaccination dates, photos, etc.), daily records, walk records (route and time), and settings are stored on your device.
- Location is used only while you are using the app, to record walks. It is not sent to the developer's servers.
- Photos are read only when you choose them. Image processing such as cut-outs runs on your device.
- To show widgets, the app and its widget on the same device share some data (Apple App Group). It does not leave the device.
- The AI assistant uses Apple Intelligence (an on-device AI) by default. In that case your questions and dog records do not leave your device.
- When you share your diary with a trainer (section 4), the check for words you may want to hide is done on your device (using the on-device AI, Apple Intelligence, on supported devices). The summary is made by sending only the diary after hiding those words to the consultation server. Whatever AI assistant setting you choose, it is never sent to an outside AI company.
- In the AI assistant, you can choose the on-device AI (Apple Intelligence; free, on supported devices only) or the server AI (section 4; an ad for each question). If you choose the on-device AI, your questions and dog records do not leave your device.
3. What is sent out for each feature, and where
Only when you use the features below, the information they need is stored at the destination shown. Each feature uses its own destination; the data is not mixed.
| Feature | Information sent | Destination |
|---|---|---|
| iCloud sync and family sharing | Dog profiles, daily records, and walk records (when you turn sync or sharing on) | Apple iCloud (CloudKit private database). People you share with can see what you share. |
| Walk friends (walk meetups) | Meetup title, details, date and time, the point you choose as the meeting place and its name, capacity; in-app IDs and display names of hosts and participants; join and arrival records; history used to calculate the trust score; purchase records for restoring the trust score (transaction ID, product ID) | Apple CloudKit (public database). The meetup and the host's display name are visible to other users. |
| Bulletin board "Idea Tree" | An anonymous account ID and the topics, opinions, and likes you post | Google Firebase (Anonymous Authentication, Cloud Firestore, Cloud Functions). Posts are visible to other users. |
| Consult a dog trainer | See section 4 | A dedicated consultation server on Cloudflare |
| AI assistant (ChatGPT) | Only if you switch the AI to "ChatGPT" in Settings and enter your own OpenAI API key: your question text and the dog records needed to answer it (profiles, daily records, walks) | OpenAI. The API key is stored in your device's Keychain and is never sent to the operator. |
| Ads (when you use the server AI) | Information needed to show ads and to confirm that you finished watching (device and app information, IP address, records of ads shown and watched, etc.). Only if you allow tracking is the advertising identifier (IDFA) also used. So that the consultation server can confirm you finished watching, the ticket number and your consultation account ID are attached to the ad. | Google (AdMob). Used to deliver ads and to notify the consultation server that you finished watching. |
| Purchases (premium features, restoring the trust score) | The purchase transaction | Apple (App Store). Card details never reach the operator. |
Each destination also handles information under its own privacy policy (Apple, Google, OpenAI, Cloudflare). Their facilities may be outside Japan.
4. Information handled by "Consult a dog trainer" and the Trainer app
The consultation feature and the Trainer app use a server run by the operator on Cloudflare (Workers, D1, Durable Objects). It stores the following.
| Information | What it is and how it is used |
|---|---|
| Account | An anonymous service account ID and a secret used for API access (when CloudKit authentication is enabled, trainers receive a session token after Apple verifies their iCloud account). The server stores only a SHA-256 hash of the secret, not the secret itself. The secret is kept in your device Keychain and, if iCloud Keychain is on, carried over to your other devices. Even if you do not use consultations, this account is created automatically when you use the server AI in the AI assistant (with a default display name; trainers see nothing until you start a consultation). |
| Private trainer verification evidence | After consent to review, legal name, claimed qualifications and experience, evidence URLs (up to 3), JPEG certificate or evidence images (up to 3, each at most 256 KiB), submission revision, consent/submission dates, findings, sources and audit records are used to check qualifications and experience and decide public listing. Attached image metadata is removed. These records are excluded from public profiles and available only to the trainer, operator and authorized limited reviewers. If review is enabled, evidence is presented to OpenAI Dot (ChatGPT) to compare with public issuer information. Automatic approval requires explicitly configured qualification, issuer, expiry and other conditions; absent configuration, uncertainty or contradictions require manual review. |
| CloudKit identity | When CloudKit authentication is enabled, trainer sign-in uses an iCloud account verified by Apple in the production environment of a dedicated CloudKit container. The Apple Web Auth Token is held in memory only while it is verified; it is not stored, logged, or returned. The server stores only the SHA-256 fingerprint derived from Apple's userRecordName and its mapping to the service account, deleted when the account is deleted. We do not receive your Apple ID, name, or email address. No consultation or profile records are created in CloudKit. |
| One-use CloudKit token proof | When CloudKit authentication is enabled, to prevent reuse of an Apple Web Auth Token the server stores only its hash, not the token. It is kept for 24 hours and removed after expiry by daily cleanup or during the next authentication. The verified token itself is not retained. |
| Trainer sign-in sessions | After identity verification, the server stores a SHA-256 hash of the session token, account ID, and expiry. Sessions expire after 30 days; expired entries are removed at the next sign-in or daily cleanup, and immediately on account deletion. The operator admin login cookie expires after 8 hours and is removed from the browser on logout. |
| Display name | The name shown to the other person. It does not have to be your real name. |
| Consultation messages | The text of the consultation and its topic (for example, the kind of training concern). Stored so it can be delivered to the other person. |
| Dog information (owners only, optional) | Only if you choose to share it, your dog's name, breed, and age in months are shown to the other person. Photos and birthdays are not sent. |
| Diary sharing (owners only, optional) | Only when you use "Share diary": for the period, items, and days you choose, the diary—with the words you chose to hide replaced by "＊＊＊"—is sent to the consultation server, where the server AI (Cloudflare Workers AI) summarizes it for the trainer. The diary sent for summarizing is not stored. Only the text you review, edit, and send is stored, as a consultation message. Photos, walk routes (locations), and birthdays are not sent. |
| AI assistant questions (owners only, optional) | Only when you choose "Server AI" in the AI assistant and ask a question: your question, your earlier questions (up to 2), and material the app makes from the records of the dogs and period the question is about (key points of the diary and notes; totals for toilet, food, weight, mood, medicine, care, and walks; and profile items such as name, breed, birthday, and vaccination dates) are sent as they are (nothing is hidden) to the consultation server, where the server AI (Cloudflare Workers AI) answers. None of the question, material, or answer is stored. Photos and walk routes (locations) are not sent. |
| Server AI tickets (owners only) | To manage how many summaries and AI assistant questions can be used, we store the ticket number, when it was created, how many times it was used, and the record that you finished watching an ad (a number for each ad view), and delete them after 2 days. To confirm a monthly premium membership, the server checks your App Store purchase record and stores a daily count per purchase (the purchase number, date, and count), deleted after 2 days. |
| Trainer public profile (trainers only) | Display name, headline, introduction, specialties, area, years of experience, certifications. Shown to owners in a list after the operator approves the profile. If an invite code was used, that record is also stored. |
| Notification address (optional) | Only if you allow notifications, your Apple push notification address (device token) is stored and used to tell you about new messages. |
| Last-seen time | Used to check activity for safety. |
| Record for sign-up rate limits | To block repeated sign-up, CloudKit authentication, and administrator login abuse, only a salted hash of the IP address (not the IP address itself) is stored temporarily and deleted after 24 hours. |
| Reports and blocks | See section 6. |
The consultation server does not collect location, email addresses, phone numbers, contacts, or advertising identifiers (only Google, which shows the ads, uses the advertising identifier, and only if you allow it; see section 3).
The people in a consultation (owner and trainer) can see the information above that is needed for that consultation. The operator does not read consultations except when a report is made, when investigating abuse is necessary, or when required by law.
Verification evidence (legal name, qualifications, experience, URLs and images) and review audit records are retained while draft or pending. They become eligible for deletion 90 days after the latest review decision and are removed by daily cleanup. Evidence or profile changes require a new review. Evidence and audits are deleted immediately on account deletion. OpenAI also handles information under its privacy policy when Dot review is used. Reviewer login cookies expire after 30 days. Successful authenticated reviewer API use renews the expiry to another 30 days when at least 24 hours have passed since issuance. Cookies expire without renewal for 30 days and are cleared on logout. Changing the reviewer-only key invalidates existing reviewer sessions. Operator admin login sessions still expire after 8 hours.
5. How we use information
- To provide each feature (saving and syncing records, meetups, the bulletin board, consultations, notifications).
- To keep people safe (handling reports, preventing misuse, rate limiting).
- To investigate problems and improve the service. We do not run analytics that track individuals.
- To show ads when you use the server AI, to cover its cost (section 3).
Optional Trainer app usage sharing aggregates fixed operation names, started/success/failed/cancelled counts, and coarse duration buckets by UTC day, app version and platform. It excludes messages, names, diaries, account/device IDs, location and advertising IDs. The operator uses a separate Cloudflare analytics server, not the consultation database. Opting out deletes unsent data and cancels in-flight uploads where possible. Local data is capped at 30 days and 256 KiB; retries end within seven days and at most five attempts. Server daily aggregates are retained for 30 days. Expired data is excluded from queries/retries and physically removed on the next local launch/checkpoint or server cleanup. Uploaded anonymous aggregates cannot be linked back for individual deletion. Cloudflare may process network metadata independently of these application aggregates. All features remain available without participation. Collection and upload are currently disabled pending performance checks and endpoint configuration.
We do not use information for other purposes, and we do not provide or sell it to third parties for advertising or marketing.
6. Reports, blocks, and safety
- In a consultation you can report the other person or a message, and block the other person. A blocked person disappears from each other's lists, requests, and conversations.
- When a report is made, the operator reviews the reason, the details, and a copy of the most recent exchange in that consultation (up to 30 messages), and may hide messages or suspend accounts as needed.
- Messages containing inappropriate words may be blocked from sending.
Report records (including the copy of the exchange) are kept for 1 year after the operator finishes handling them, to respond to misuse and to meet legal obligations, and are then deleted automatically. They are kept for this period even after you leave.
7. Retention and deletion
- Data on your device stays until you delete the app or erase it inside the app. Data synced to iCloud can be deleted from your iCloud settings.
- Consultation data is kept until you leave. When you tap "Delete consultation data and leave" in the Owner app, or "Delete account" in the Trainer app, the consultations and messages you were part of (including the copy on the other person's screen), your profile, notification address, block records, and CloudKit identity mapping are deleted immediately. This cannot be undone. An account created automatically for the AI assistant can be deleted the same way from the "Consult a dog trainer" screen. The one-use proof hash is removed after its 24-hour expiry.
- To delete things you made public to other users, such as walk-friend meetups or bulletin-board posts, please contact us.
8. Children
Walk-friend meetups are intended for adults. If a child uses the apps, a parent or guardian should review this policy.
9. Your rights
To request access, correction, deletion, or suspension of use of your information, contact us at the address in section 1. Actions available in the apps (editing your display name or profile, blocking, leaving) can be done right away in the app.
10. Changes to this policy
When we change this policy, for example because of a new feature, we will update this page and its "Last updated" date. For important changes we will also tell you in the app.
11. Public Q&A and public trainer profiles
Before joining Q&A, you confirm that questions, answers and your public nickname (profile name for trainers) are published on the Web, including to signed-out visitors and search engines. General users may answer and are distinguished from trainers. Diaries and private consultations are never published automatically.
Q&A reuses the consultation account. Dedicated Cloudflare D1 resources store posts, topics, public names, notification consent, and latest activity and viewing times. Only question-level viewing times are aggregated; no visitor tracking identifier is stored. Q&A is free and initially text-only.
After 90 days without creation, edits, answers, additions or views, a question is eligible for a deletion warning. At least 14 days after the warning, inactivity is checked again before deletion. Cleanup runs are bounded, so work may carry over. New activity cancels the warning. Unresolved reports preserve the question.
Deleting a question immediately hides it and its answers; deletion normally starts after 14 days. Deleting an answer erases its body. Account deletion removes your own questions, answers, Q&A notices and public profile. Only the operator can view minimal report snapshots, deleted one year after resolution.
Answers and deletion warnings appear in the in-app notice list. Push is optional and excludes post bodies and contact details. Blocking is shared with private consultations and ends ongoing consultations with that person. Public pages remain accessible without signing in; blocking cannot prevent every third party from reading public information.
A trainer profile is published only after the trainer reviews and enables it. Public fields include name, specialties, area, experience, public qualifications and availability. Evidence and iCloud identity values are never public. We cannot erase third-party copies or guarantee immediate search-result updates after removal. Private consultations begin only at the visitor’s choice.