Cosmos Privacy Policy

The operator handles users' personal information appropriately in accordance with Japan's Act on the Protection of Personal Information and other applicable laws.

The Japanese version is the authoritative original; if interpretations differ, the Japanese version prevails. This Policy is governed by and interpreted under the laws of Japan.

The Operator

Name: GIFTER OF SUNSHINE (a sole proprietorship) / Representative: Shinei Kazono. We will provide our address without delay upon request.

Purposes of Use and Information We Collect

We use the information we collect only for the following purposes: (1) matching requests with workers and showing each party what the transaction requires; (2) identity verification and the prevention of impersonation and fraud; (3) fee calculation, payment and payouts; (4) safety checks and handling trouble or accidents; (5) contacting and notifying you; (6) complying with the law; and (7) improving the Service.

The information we collect is as follows. Name, date of birth (used to confirm that you are 18 or over and old enough to register as a worker), address, email address, phone number, profile photo, face image, emergency contact (users aged 60 or over), the result of identity verification (the payment provider checks your identity documents), location (distance display and matching while using the app, sharing from when you tap "I'm heading over" on an accepted job until the work is completed, and at in-person start/completion — see "Location Data" below), the address of the destination included in a request (a store to shop at, a medical institution to accompany you to, a cemetery, etc.; we also store the coordinates derived from that address so helpers can judge the estimated travel time), usage history, and payment-related information (card details are held by our payment processor; the operator does not store card numbers). Except where required by law, and except as described in "Sharing With the Other Party to a Transaction" below, we do not provide information to third parties.

Sharing With the Other Party to a Transaction

Once a request is matched, we show the requester and the worker each other's information to the extent the transaction requires.

What the worker sees about the requester's side: the visit address, the content of the request (including the fields the requester filled in), and the destination address. We never show the name or phone number of the requester or of the in-person beneficiary.
What the requester sees about the worker: name (with phonetic reading), face photo, and the worker's current location while en route.

We make this disclosure on the basis of your agreement to this Policy when you use the Service.

Location Data (Helpers)

We collect a helper's location under the "While Using the App" permission you choose in your device settings, in the following situations. We do not collect location continuously in the background, and we never ask for the device's "always-on" location permission.

While you are using the app: used to show the distance to nearby requests, to judge the distance for notifying you, and to confirm your current location at the moment you accept a request. Only your latest position is stored, overwriting the previous one — we do not keep a movement history. We do not collect location while the app is closed (new-request notifications during that time are based on your registered address).
From when you tap "I'm heading over" on an accepted job until the work is completed: we keep sending your current location, even when the app is closed, so the requester can see your progress toward arrival (a session started while using the app continues until the job is done; iOS shows an on-screen indicator and Android shows a notification during this time). Records from this period are retained as job records for safety verification and dispute handling. Sending stops immediately when the job is completed or cancelled.
At in-person start and completion: stored as the face-to-face verification record.

We do not collect location in any other situation (such as while the app is closed with no accepted job), and we do not provide location data to third parties (display to the requester is limited to the en-route sharing above; the exception is disclosure to the police or other investigative authorities when suspicious conduct is being investigated).

Handling of Medical-Related Information

For hospital accompaniment, you enter the address of the medical institution. This is needed so the helper can estimate travel time and reach the location on the day, and we use it solely to carry out the request and for safety verification.

We never ask for your diagnosis, symptoms, or details of your treatment.
The destination address is visible only to the helper who actually accepts the request and to the operator. Before matching, it is shown to the helpers the request was delivered to, as information needed to judge travel time.

Health-Related Information (Special Care-Required Personal Information)

Health-related information — such as the observations about physical condition recorded in a wellness-check report — is collected with the consent of the person concerned at the time of the request, and is used solely to carry out that request and for safety verification.

Analysis of App Usage

To improve the Service, we use an external analytics service to aggregate the types of screens opened in the app and the fact that actions such as creating or accepting a request took place. The information sent does not include your name, contact details, address, location, the content of your requests, or photos, and it is not linked to your account. On the official website, we use an access analysis tool (which uses cookies) to understand how the site is accessed.

Retention and Display of Request Records

Once a request is completed or ended, the requester's detailed address is no longer shown on the worker's screen.
For safety verification and dispute handling, the operator retains and manages records from the start to the end of each job (location, face-to-face records, and status history).
The history of your enquiries to the operator is retained as a record of our response and of any trouble, and is deleted 30 days after withdrawal (there is no user-to-user chat feature).

Authentication Method (Passwordless)

The Service uses passwordless authentication with your Apple or Google account, or a link sent to your email. Users set no password and the operator stores no password.

Face Verification and Biometric Data (Workers)

To work as a worker, you must register a selfie taken with the front camera for impersonation prevention and safety. Identity verification is carried out by the payment provider as part of opening your payout account: it checks your identity document and matches it against the name and date of birth you registered. The operator does not receive or store images of your identity document. The registered photo is kept for the period set out in "Retention Periods".

Face data we collect: only the face images taken with the front camera. We do not create or store any numerical representation of facial features (face templates or face embeddings).
How we use it: (1) at registration, to check that the photo clearly shows your own face; (2) during in-work re-verification, to check that an on-the-spot selfie and your registered photo show the same person; and (3) to show your photo, as the worker who will visit, to the requester of a request that has been matched with you. We do not use it for any other purpose (such as advertising, analytics, or providing it to other services).
AI analysis and our service provider: for (1) and (2) we use a cloud image-analysis (AI) service operated by a provider under contract with us. Each image is sent over an encrypted connection at the time of the check, and the operator receives only the result. The provider does not store the images it receives and does not use them to improve or train its own services.
Sharing with third parties: your face photo is shown only to the requester of a request that has been matched with you (including, for a request made on someone's behalf, the family member registered in the app), and only while that request is in progress. We do not provide or sell it to any other third party (except where required by law).
Where it is stored: your registered face photo is stored on this Service's servers (in a data centre in Japan). Only you, the other party to the request as described above, and operator staff who need it for their work can view it.
In-work re-verification: for safety, a worker who is ready to work may be asked to retake an on-the-spot selfie at random intervals. That selfie is compared with the registered face, and if it does not match, work is suspended. The suspension is lifted only after review and clearance by the operator. The selfie used for the comparison is deleted immediately after the comparison.
Retention: your registered face photo is deleted at the time of the withdrawal procedure. Images taken for the registration review are deleted as soon as the review is finished.

Handling of Wellness-Check Report Photos

For wellness-check requests, the worker attaches photos of the visit to the report. These images are analysed by AI solely to check whether a person appears in them. The analysis yields only that yes/no verdict, and the images are not stored anywhere else for this analysis. The photos themselves are stored only on this Service's servers and are viewable by the requester, the assigned worker, the person being checked on, and the operator. They are kept for the period set out in "Retention Periods".

This check exists to prevent reports that were not actually made in person (for example, submitting only photos of scenery) and to keep reports trustworthy. It only detects whether a person is present; it does not identify who that person is.

Retention Periods

Account information and identity-verification results: retained until you leave the Service, then deleted or put into a form that cannot identify you 30 days after withdrawal (restoration is possible within those 30 days)
Face photo: deleted at the time of the withdrawal procedure (we do not wait 30 days)
Transaction and payment records (amounts, dates, content): retained for 7 years from the transaction as required by law; information that identifies you is severed 30 days after withdrawal
En-route location and location information at the face-to-face meetings: retained as the record of that request, and deleted 30 days after withdrawal if the requester or the worker withdraws
Wellness-check report photos and written observations, information about the family member on whose behalf a request was made, and free-text entries written in a request: deleted 30 days after the requester's withdrawal
Records of enquiries to the operator and of requests for compensation: deleted 30 days after withdrawal

Where a dispute is being resolved or the law requires it, we retain the data for as long as necessary.

Security Measures

We encrypt communications, restrict access rights (to you and to the operator staff whose work requires it), use an authentication method with no passwords, select and supervise subcontractors by contract, monitor for unauthorized access and failures, and manage the devices used to handle the data.

Requests for Disclosure, Correction, Suspension of Use, or Deletion

To request disclosure, correction, suspension of use, or deletion of your personal information, contact the operator support window in the app or the contact listed on the official website. After confirming your identity, we respond within two weeks as a rule, free of charge. You can delete your account (withdraw) at any time from the app's settings screen.

Contact and Amendment

For questions about this Policy, contact the operator support window in the app. For material amendments, re-consent is requested within the app.