Privacy
We collect only the data listed on this page. This page covers people with an account, visitors without one (see Who else handles data and Cookies), and people named in public filings.
Who is responsible
An individual business operator runs the service. The operator's name and address are given without delay on request, through the contact below.
Account holders: what we keep and why
- Your email address, to sign you in with one-time links and to contact you about your account.
- A one-way hash of your API key and of your session token, never the values themselves, to authenticate you.
- A monthly count of your API requests, to apply your plan's limit.
- For webhooks: the URL you register, its signing secret and a delivery status, to deliver what you asked for.
People named in filings
Our source documents are public filings on EDINET. Some name individuals. We use them to provide structured data about listed companies and their ownership.
- Not shown: individuals who file 5% reports or appear as holders in them, and major shareholders not recognisably organisations. They appear as
individual filerorindividual holder. Their holdings are not searchable by person, and a link to the source filing remains. - Not shown: the names of officers, representatives and meeting candidates. Officers appear by title only, and voting results by proposal, without the candidate's name.
- Issuer names on 5% filings are replaced with the listed-company master name before publication, so a representative's title or name appended to that field is not shown.
- Not collected or published as data: birth dates, home addresses and phone numbers. If one appears in a quoted sentence, tell us.
- Names in short quotes are removed where we can recognise them. If one gets through, tell us.
You can ask us to correct this or stop showing it: Corrections and removal.
Your requests
You can ask us to disclose, correct, delete or stop using personal data we hold about you, or to stop providing it to third parties. Write to the contact below, saying what the request concerns. We may ask for just enough to confirm it is you, reply by email without delay and charge nothing.
Who else handles data
We do not sell data. There are no advertising or tracking cookies and no analytics scripts. These providers process data for us, some outside Japan, under their own safeguards:
- Cloudflare, Inc. (United States): hosting and database.
- Resend (United States): sends sign-in emails, so it receives your email address.
- Google Fonts (United States): pages load fonts from Google, so your browser sends its IP address and user agent.
- Paddle.com Market Limited (United Kingdom): would handle payment if paid plans open. It receives nothing while billing is off.
Those countries' laws can differ from Japan's. Ask us for more about a provider's safeguards.
Security
Keys and session tokens are stored only as hashes, traffic uses HTTPS, secrets are kept outside the code, and access to the systems is limited to the operator.
Keeping and deleting
Account data stays while your account exists. Ask us to delete the account and we remove its email, keys, usage and webhooks. Sign-in links expire in 20 minutes. Requests sent through the contact form (what you wrote, the page and your email address) are kept for one year to answer and track them, then deleted; your network address is stored only as a hash that changes every day, to limit abuse.
Cookies
One cookie, jf_session, keeps you signed in for up to 30 days. It is removed when you sign out.
EU and UK
We have not yet reviewed this policy against the GDPR or UK GDPR, and the service is not aimed at people in those regions until we have. You can still make any request above.
Contact
Use the contact form.