Privacy Policy

Who is responsible

ChainBow Co., Ltd. (株式会社ChainBow), 2-6-6-404 Taito, Taito-ku, Tokyo, Japan. Representative: Li Long.

Privacy and account requests: [email protected].

Information we process

• Account and sign-in data: email address, display name, profile image, verified-email status, Apple or Google account identifiers, session tokens, IP address, and user agent.
• Private strategy content: situations, facts, goals, actors, resources, constraints, questions, conversation titles, AI responses, strategy cards, missions, simulation operations and results, action commitments, and debriefs.
• Learning data: onboarding answers, study plan, chapter progress, mastery evidence, and quiz attempts.
• Service and purchase data: subscription product, transaction identifiers, entitlement status, AI model and token usage, job status, rate-limit counters, and reports you submit about an answer.
• App analytics: event names and limited metadata such as screen, chapter, feature, duration, source, app version, device or operating-system information, Firebase app instance identifiers, and, after sign-in, our internal user ID so we can measure use of the same account across devices. Analytics events do not include your situation, question, card, action, or debrief text.
• Crash diagnostics: stack traces, exception details, app and device information, and a Firebase installation identifier. We do not attach your question text, card content, or our account user ID to Crashlytics.
• Website and security data: ordinary server logs and request data needed to deliver the site, keep sessions secure, limit abuse, and diagnose failures. The public website does not run private AI requests. The website also uses Google Firebase Analytics to count page views and download-link clicks; these events contain no personal data and no text you type.

Why we use it

• Provide authentication, synchronize your account, and recognize sign-ins that return the same verified email address.
• Build and save your private strategy workflow, generate AI responses, preserve progress, and restore purchases.
• Enforce subscription, usage, safety, and anti-abuse controls.
• Review reported answers, support users, prevent fraud, fix crashes, and understand whether product features work as intended.
• Meet legal obligations and protect users, ChainBow, and the service.

Server storage and cross-device access

Account data, profile details, private strategy content, AI conversations and responses, strategy cards, missions, simulations and debriefs, learning progress, and subscription entitlements are stored on our servers and linked to the signed-in account.

When you sign in to the same account in an iOS or Android app that supports the relevant feature, it can retrieve data saved on our servers. Device settings such as theme, language, notification schedules, local caches, and unsubmitted drafts may remain only on the current device and are not guaranteed to sync.

AI processing

To generate an AI strategy response, Ask Sun Tzu sends the text you enter, relevant conversation history, and other strategy or profile context needed to answer the request from ChainBow Co., Ltd. servers through ChainBow's AI gateway to a third-party Cloud AI service. The Cloud AI services we use include OpenAI and Anthropic (Claude). The Cloud AI service that receives the request processes this information to generate the AI response.

By continuing after you sign in, you agree to this processing. When you use AI features, your questions and related context may be sent to these Cloud AI services. You can review this notice in Profile > Privacy & AI. This does not delete your account.

Do not include passwords, payment-card numbers, government identifiers, trade secrets, or another person's sensitive information unless it is truly necessary. AI output can be inaccurate and should be checked before you act on it.

We do not send your private strategy text to Firebase Analytics or Crashlytics, and we do not use advertising identifiers or cross-app tracking. We require service providers that process personal data on our behalf to provide appropriate privacy and security protections consistent with our contractual, legal, and platform obligations. OpenAI and Anthropic process request data under their API terms and the data-processing arrangements with ChainBow.

If a request uses optional public-web lookup, a derived public search query—not the full conversation—may also be sent to Exa.

Service providers and disclosures

• OpenAI, which may receive the request content needed to generate an AI response, via ChainBow servers and ChainBow's AI gateway.
• Anthropic (Claude), which may receive the request content needed to generate an AI response, via ChainBow servers and ChainBow's AI gateway.
• Exa, only when optional public-web lookup is used for a request, which receives a derived public search query.
• Apple and Google, for sign-in and the platform information they return to us.
• Apple App Store and Google Play, for purchases, subscription management, and transaction verification. We do not receive your full payment-card details.
• Google Firebase Analytics and Crashlytics, for the limited analytics and diagnostic data described above.
• Hosting, database, network, and email-delivery providers that process data only to operate the service.
• Authorities, advisers, or transaction counterparties when disclosure is legally required or reasonably necessary to protect rights, safety, and service integrity.

International processing

Our providers may process data outside your country. Where required, we use contractual or other lawful safeguards for international transfers. Contact us if you need more information about a particular transfer.

Retention and account deletion

• Account and private strategy data remain while your account is active unless a shorter period is needed for a specific record.
• Deleting your account in the app removes the account and linked user data from the primary production database. Database backups rotate on a schedule and may retain a deleted record for up to 14 days before it disappears from backup copies.
• Daily AI usage rows are routinely pruned after up to 60 days and are deleted with the account when the account is deleted first.
• Verification and authentication rate-limit records expire or become inactive according to their security window. Anti-abuse records are separate from the user profile and may remain after account deletion where needed to prevent repeated abuse.
• Some records may be retained longer when required for legal obligations, payment disputes, security investigations, or the establishment or defense of legal claims.

Your choices and rights

• Ask Sun Tzu sends your questions and related context to Cloud AI services, including OpenAI and Anthropic (Claude), when you use AI features. Signing in agrees to the Terms of Use and Privacy Policy, including this AI processing. You can review the details in Profile > Privacy & AI.
• Delete your account from the bottom of the Profile page. This does not cancel a store subscription; manage or cancel that separately in the store account used for purchase.
• Email [email protected] to request access, correction, deletion, restriction, portability, or an explanation of how your information is handled. We may need to verify your identity.
• Depending on where you live, you may also have a right to complain to a data-protection authority or to object to certain processing.

Children

The service is designed for adults and is not directed to children under 13. If you believe a child has provided personal information, contact us so we can review and delete it where appropriate.

Changes and contact

We may update this policy as the product or law changes. The date above shows the current version. Questions and requests can be sent to [email protected].