Last updated: 2026-10-10 / Effective date: 2026-10-10
This Privacy Policy explains how TO Apps (the “Operator”) handles information in connection with the Shuffleep app (the “Service”).
The Japanese version prevails in the event of a discrepancy with the English version, without limiting mandatory consumer or language rights under applicable law.
| Information | Purpose |
|---|---|
| Onboarding status and settings such as theme, volume and session composition | Restoring settings and displaying screens |
| Time of acceptance of the Terms and this Policy, document revisions, language, app version and OS type | Recording consent and presenting revisions |
| Custom Word Set names and selected words | Saving sets created by the User |
| Downloaded audio and management information such as target, size and completion time | Offline playback and download management |
| Cumulative session count, the time the last session ended and the time an app-open ad was last shown, used to manage ad frequency | Managing how often ads are shown (not sent off the device) |
| Scheduled time and text of the notification about an interrupted session (an OS notification schedule on Android) | Notifying the User when a session is interrupted (canceled when no longer needed) |
| Setting for receiving reminders before a subscription renews, scheduled reminders (time and text), records of reminders shown and in-app notices dismissed, and the time subscription information was confirmed | Sending reminders and showing in-app notices before a subscription renews, and preventing duplicates. Reminders are scheduled only if the User opts in. They are canceled when the User turns off this setting or when the subscription is confirmed to be no longer eligible. Records that are no longer needed are deleted the next time the app processes them |
The app does not upload the information in the table above to the Operator’s servers. Separately from that table, subscription purchase-action records (Section 1.2) are also stored on the device for as long as needed to send and match them (Article 6(4)). In addition, the SDKs for subscription management, ad consent management and update delivery store identifiers (such as the customer ID in Section 1.2) and ad-related consent status on the device. Depending on OS settings, this information may be included in the OS provider’s cloud backups or device transfers.
Custom Word Set names allow free text. Please do not enter unnecessary personal information or confidential information of others. The app does not measure sleep or record the content of sessions (session-related information stored on the device is limited to the table above).
The following transmissions accompany use of the app and related pages. HTTPS connections also disclose connection information such as an IP address to the recipient. Please also review each provider’s privacy information.
| Recipient | Information and trigger | Operator’s purpose | Recipient’s purpose |
|---|---|---|---|
| RevenueCat, Inc. | When subscription management is initialized after acceptance of the Terms and this Policy (including for Users who have not made a purchase), on purchase or restore, and when the Operator’s server checks entitlements (when audio listings are retrieved and when a code is applied): customer ID, purchase and subscription information, store type, technical device and app information, and records of time-limited Premium granted via codes. When the User taps a subscription purchase button, a record relating to consent to automatic renewal is also associated with the customer ID and sent. This record includes the terms shown before purchase (such as price, monthly-equivalent amount and discount display, next billing date, currency and renewal period), identifiers of the screens and wording shown, an identifier and the time of each action, the product and plan, display language, app version, and the Google order number after purchase. Records may be sent even if the purchase does not complete, and records that could not be sent may be sent later | Determining entitlements, restoring purchases, providing time-limited Premium via codes, support matching, and verifying and keeping records of consent to automatic renewal | Providing subscription management, maintenance and security |
Operator’s delivery and storage infrastructure (Cloudflare, Inc., assets.toapps.dev and Cloudflare R2) |
At app startup, including before acceptance of the Terms and this Policy: requested paths and connection information to retrieve operational settings (minimum supported version, download suspension and notices) (no customer ID). When audio listings are retrieved and when a code is applied on Android: RevenueCat customer ID, app version, OS type, requested paths, connection information and the entered code (when a code is applied). When audio files are downloaded: requested paths and connection information (no customer ID). Exports from RevenueCat by the Operator: customer IDs, records relating to consent to automatic renewal, and purchase and subscription transaction records (see the paragraphs after this table) | Delivering operational settings (minimum supported version, download suspension and notices), checking Premium entitlement, delivering audio, validating codes and providing time-limited Premium, and keeping records to verify consent to automatic renewal | Delivery, caching, storage, operations and security by Cloudflare |
| Apple / Google stores | Purchases, restores and subscription management: store account-related purchase information and payment information. On Android, after acceptance of the Terms and this Policy, at launch and when returning to the app: queries to Google Play to determine the storefront country and obtain age signals (Article 9). On Android, when billing features are used after acceptance of the Terms and this Policy (including at launch), Google Play’s billing library sends Google information on how billing operations are working (success or failure and connection issues), the library version, and app and device information (such as device model, OS version, country or region, and language) | Processing purchases and checking entitlements; responding to age signals under U.S. state laws (Article 9) | Payment, subscription management and fraud prevention, and Google’s improvement of its billing library and handling of its errors, under the stores’ own terms and privacy policies |
| Google Mobile Ads (Google LLC and its affiliates) | After the Terms and this Policy are accepted, Google’s consent management platform (User Messaging Platform, UMP) checks ad-related consent status, and the SDK is initialized if UMP permits it. Ad requests are made with non-personalized settings when UMP permits them and Free ad-display conditions are met. On Android, for U.S. Google Play accounts (including when the storefront country cannot be determined), this processing may not take place depending on age-signal results (Article 9). UMP and the SDK may process IP/connection information and approximate location inferred from it, available advertising/device identifiers, information about the app in which ads are shown, ads shown, app interactions, and diagnostic, performance and crash information. If a subscription is purchased after the SDK has been initialized, purchase information such as the product, price and currency may be sent to Google through Google Play services to measure ad effectiveness | Serving and measuring non-personalized ads; managing ad-related consent | Advertising, analytics, ad-related consent management, fraud prevention, maintenance and security by Google Mobile Ads and UMP. Google’s privacy policy and related terms apply |
| Expo | App startup and update checks, including before consent: a per-installation identifier (EAS Client ID), OS/app/runtime versions, update information and connection information. Fatal error information may be sent in circumstances such as recovery from an update | Delivering updates, recovering from update failures, and analyzing defects | Providing the update infrastructure, diagnostics, maintenance and security |
| GitHub (GitHub Pages) | Legal document/update metadata retrieval and public page access, including before consent: IP address, requested URL and browser/connection information | Providing legal information and public pages | Hosting, access processing, maintenance and security |
The Operator exports purchase and subscription transaction records from RevenueCat, together with customer IDs and records relating to consent to automatic renewal, to private storage controlled by the Operator (Cloudflare R2) (for retention, see Article 6(4)).
RevenueCat’s customer ID (which RevenueCat calls an “anonymous ID”) is issued without entering a name, but it is an identifier linked to purchase information and is not anonymized information.
When audio listings are retrieved and when a code is applied, the Operator’s server sends the customer ID to RevenueCat to check entitlement status and, when a code is applied, requests a time-limited Premium grant. Entitlement results are cached briefly by the delivery infrastructure. The ledger used to validate codes stores a matching value, code conditions and redemption counts, but not the codes themselves or customer IDs. The Operator and providers such as Cloudflare may keep access and operational records, including source IP addresses, for delivery and security purposes; their retention is described in Article 6.
The Service does not use personal data for recommendations or profiling. Word Shuffle uses random selection without personal data as input.
Emails to contact@toapps.dev include the sender’s address, any name voluntarily supplied, message/attachments and information needed to match purchases. Delivery and storage use Cloudflare Email Routing and the destination email service. This information is used to respond to inquiries and rights requests and retain necessary handling records. Do not send diagnoses, detailed health information, passwords, full payment-card numbers or unnecessary identity documents.
The app has no features collecting GPS location, microphone recordings, camera images, contacts, photo libraries or biometric measurements such as HealthKit data. There is no profile registration for names, addresses, dates of birth or email addresses. Inquiries and voluntary text input are addressed above.
No external services for analytics or crash reporting are used (the advertising SDK’s own measurement and diagnostics and the update-recovery communications described in Section 1.2 do occur). Push tokens are not obtained for local notifications. Session-interruption notifications may not be scheduled depending on age-signal results (Article 9).
Information is handled to provide features, save settings, deliver operational settings (minimum supported version, download suspension and notices), verify purchases/restores/delivery entitlements, validate codes and provide time-limited Premium, deliver updates, maintain security, handle inquiries and rights requests, manage consent, keep records of consent to automatic renewal, serve and measure non-personalized advertising, and meet legal obligations. New purposes will be subject to required notice, consent and other procedures.
Personal data is not disclosed to third parties without consent except where permitted or required by law. Necessary service providers and overseas handling are addressed in Articles 4 and 5. If information is taken over as part of a business succession, such as a business transfer or merger, the Operator will take the measures required by law and the information will be handled within the existing purposes of use.
RevenueCat, Cloudflare, Expo, GitHub, Google LLC and its affiliates (Google Mobile Ads and UMP) and inquiry email delivery/storage providers are used for subscription management, delivery, keeping records of consent to automatic renewal, updates, public pages, non-personalized advertising delivery and measurement, ad-related consent management, and email handling. Information and purposes are listed in Article 1. This does not mean that all processing, including Google’s advertising services, is performed on the Operator’s behalf; roles depend on each service’s terms, settings and applicable law. Where handling is entrusted to service providers, it is limited to what is necessary and managed by reviewing contract terms and handling practices.
Apple and Google independently handle store accounts, payment and their own purchase records. Not all store activities are performed on the Operator’s behalf. OS cloud backups likewise depend on the User’s OS account and settings.
External providers include businesses based in the United States. Delivery infrastructure and CDNs, such as Cloudflare’s, process data in multiple countries and regions, including Japan; destinations are not limited to the United States. Google’s advertising services may also process information in multiple countries and regions, including outside the User’s country of residence. This Article also applies to RevenueCat’s processing and Cloudflare R2’s storage of records relating to consent to automatic renewal.
Where handling constitutes an international provision of personal data, applicable legal requirements include reviewing protections and relevant systems and providing information, obtaining consent or following other necessary procedures. Questions about countries and safeguards may be sent to the contact in Article 14.
The app uses an advertising SDK after the Terms and this Policy have been accepted to serve non-personalized ads. Non-personalized ads are not selected based on past behavior, but identifiers and connection information may still be processed for frequency capping, aggregate reporting and fraud prevention. The app does not use a separate analytics SDK. Subscription and update identifiers, and the information and purposes associated with the advertising SDK, are described in Articles 1, 2 and 4. External store or support pages follow their providers’ cookie policies.
The app does not respond to browser “Do Not Track” signals or similar mechanisms. The Operator itself does not collect information about Users’ online activities over time and across different websites or online services. However, even with non-personalized settings, Google Mobile Ads may process advertising identifiers and connection information over time for purposes such as frequency capping, aggregate reporting and fraud prevention, and may associate them with ad serving in other apps and websites.
The Service is not directed to children under 13, and persons under 13 may not use it. If the Operator learns that personal information of a child under 13 has been collected, it will stop relevant processing, make necessary checks, delete information and take other steps required by applicable law. Parents may contact the address in Article 14. Minors must obtain the consent of a legal representative as required by law.
In the Android app, to comply with U.S. state laws, when the storefront country of the Google Play account is the United States (including when the storefront country cannot be determined), the app obtains age signals from Google Play (age range, the type of method by which that age information was established, age verification status, and the status of parental approval of significant changes to the app) after the User agrees to the Terms and this Policy. The app does not obtain age signals when the storefront country is known to be outside the United States. If the signals indicate that the User is under 13, that the User is aged 13 to 17 based solely on self-declaration (excluding age information obtained through parental supervision or age verification), that age verification is required, or that parental approval has not been given, the app displays a screen that stops use of the Service. Age signals are handled only in the device’s memory, are not stored, and are not sent to the Operator’s servers or to advertising or subscription management providers. Other information in the response from Google Play (the date of a significant change approved by a parent, and an identifier assigned to installations by supervised users) is processed on the device by the Google library built into the app; the app’s own code does not read, store or send it.
On launches that retrieve age signals, until the first result is available, and while the result indicates that the User is under 18, that age verification is required or that parental approval has not been given, or if retrieval fails, the app does not perform ad-related processing (consent checks, advertising SDK initialization, and ad requests and display) and does not schedule session-interruption notifications. If a later retrieval returns a result indicating none of these, ad-related processing starts from that point. However, the app cannot necessarily stop communications for measurement, diagnostics, security or similar purposes by an advertising SDK initialized earlier. Age-signal contents are never provided to advertising providers.
Users aged 13 to 17 and their parents or guardians may also make the requests described in Article 7. Age-signal information can be reviewed in Google Account settings. Questions or objections about the decision (including requests for re-review) are accepted at the contact in Article 14.
Even before an age signal is obtained, communications involving the customer ID and similar information take place after consent to initialize subscription management and determine the storefront country. Because age signals are not stored in association with the customer ID, age signals alone cannot identify the Operator’s records. When an inquiry or request is received, the Operator matches the relevant records using the minimum necessary information and responds under Article 7 and applicable law.
If the Operator becomes aware of a data breach or other security incident, such as unauthorized disclosure, loss or damage of personal data, it will investigate the incident, contain it and take measures to prevent recurrence. The Operator will report to supervisory authorities and notify affected individuals as required by law, using appropriate methods such as public pages, notices accessible in the app and email to known contact addresses.
Changes and their effective date will be announced at the public URL or through other appropriate channels. Legally required consent will be requested for material changes, such as changes in collected information or purposes. The app may also ask Users to accept revised documents.
The Operator does not sell personal information for monetary or other valuable consideration and does not share it for cross-context behavioral advertising. Information is sent to Google LLC and its affiliates for non-personalized advertising (Section 1.2). Ad requests specify Google’s Restricted Data Processing, requesting that Google handle the information as a service provider and processor under U.S. state privacy laws, subject to Google’s terms. However, non-personalized settings do not necessarily mean that no processing falls within legal definitions of sale or sharing. Requests to exercise rights under the laws of the User’s place of residence are accepted through the contact in Article 7. The individual proprietor is responsible for personal information protection.
| Item | Content |
|---|---|
| Name (individual name / trade name) | TO Apps (sole proprietor; the operator’s name and telephone number will be provided without delay by email upon request sent to the contact address in Article 14) |
| Address | Konotora Bldg 7F, 1-1-14 Shimomeguro, Meguro-ku, Tokyo 153-0064, Japan |
| Representative | The same individual as the name above |
For inquiries regarding this Policy, please contact the following.