This Privacy Policy explains how GomiMate (“we”, “our”, “us”) collects, uses, and protects your personal information when you use the GomiMate mobile app or website. It complies with the Japanese Act on the Protection of Personal Information (個人情報保護法, APPI) and, where applicable, the EU General Data Protection Regulation (GDPR).
1. Information We Collect
Location data — When you set up your garbage collection schedule, you select your ward, city, or neighbourhood. We store this as a plain text location label on your device. We do not collect GPS coordinates or precise real-time location.
Push notification token — To send you collection-day reminders, your device generates an anonymous push token (provided by Apple APNs or Google FCM). This token is used solely for delivering your reminders and is not linked to your identity.
Account data (optional) — If you create a GomiMate Plus account, we collect your email address and a hashed password. Your name is optional.
Usage analytics — We collect anonymous, aggregated usage data (e.g., which features are used most, crash reports) to improve the app. This data cannot be used to identify you.
Device information — We collect your device type, operating system version, and app version for diagnostic purposes only.
We do not collect: your real name (unless you provide it), financial information, contacts, photos, or any data unrelated to the service.
2. How We Use Your Information
- To deliver your garbage collection reminders on the correct day and time
- To sync your ward’s official collection schedule
- To manage your GomiMate Plus subscription (if applicable)
- To respond to your support requests
- To improve the app through anonymised usage analytics
- To comply with legal obligations
We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising.
3. Legal Basis for Processing (GDPR)
For users in the European Economic Area, our legal bases are:
- Contract — Processing necessary to provide the core service (schedule sync, reminder delivery)
- Consent — Push notifications (you can withdraw consent at any time in your device Settings)
- Legitimate interests — Anonymous crash reporting and analytics to maintain service quality
- Legal obligation — Compliance with applicable laws
4. Third-Party Services
GomiMate uses the following trusted third-party services, each with their own privacy policies:
- Apple APNs — iOS push notifications (apple.com/legal/privacy)
- Google Firebase Cloud Messaging (FCM) — Android push notifications (policies.google.com/privacy)
- Stripe — GomiMate Plus subscription payments. GomiMate does not store card numbers; Stripe handles all payment data (stripe.com/privacy)
- Japanese municipal open data — Official garbage collection schedules are sourced from publicly available ward and city datasets. No personal data is shared with municipalities.
5. Data Retention
We retain your data only as long as necessary:
- Schedule data — Stored locally on your device. Deleted when you uninstall the app or remove the location.
- Account data — Retained while your account is active, plus 30 days after deletion to enable recovery.
- Push tokens — Invalidated and removed when you unsubscribe from notifications or delete your account.
- Analytics data — Anonymised; retained for up to 26 months for trend analysis.
- Support correspondence — Retained for 2 years to handle follow-up issues.
6. Your Rights
Depending on your location, you have the following rights:
- Access — Request a copy of the personal data we hold about you
- Correction — Request correction of inaccurate data
- Deletion — Request deletion of your account and associated data
- Portability — Receive your data in a machine-readable format (GDPR)
- Withdraw consent — Disable push notifications at any time in your device Settings → Notifications
- Object — Object to processing based on legitimate interests
To exercise any right, email privacy@gomimate.com. We will respond within 30 days.
Under the Japanese APPI, you may also contact the Personal Information Protection Commission of Japan.
7. Children's Privacy
GomiMate is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@gomimate.com and we will delete it promptly.
8. Data Security
We protect your data using:
- TLS encryption for all data in transit
- AES-256 encryption for data at rest
- Hashed and salted passwords (bcrypt)
- Access controls: only staff who need data to perform their job can access it
- Regular security audits
No system is 100% secure. In the unlikely event of a data breach affecting your rights, we will notify you within 72 hours as required by GDPR and as soon as practicable under APPI.
9. International Data Transfers
GomiMate primarily stores and processes data in Japan. If data is transferred outside Japan (e.g., to Apple or Google servers for push notifications), we ensure appropriate safeguards are in place, including Standard Contractual Clauses where required under GDPR.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification or email (if you have an account). The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the app after changes constitutes acceptance.
11. Contact Us
For privacy-related questions or to exercise your rights:
- Email: privacy@gomimate.com
- Response time: Within 30 days
- Available in: English, Japanese (日本語)
Or use our Contact page to send us a message directly.
