Privacy Policy
Effective and last updated: October 9, 2026
Moon Technica Inc. (“we”) sets out how we handle information about users of the TOKOYO.games website and mobile applications (the “Service”).
1. Information we collect
We collect your email address and login identifiers, profile information (account name, display name, image and biography), date of birth for age checks, and consent records. Passwords are managed as hashes by our authentication service. Depending on the features you use, we process creation prompts, voice recordings, uploaded images, video, audio and 3D assets, game source code, creation chats, posts, comments, reviews, proposals, saved game data, multiplayer and leaderboard records. We also process purchase, membership and coin histories, transaction identifiers, reports and blocks, notification device identifiers, IP addresses, device, OS and browser information, access and error records, and inquiries. Payment providers handle payment card numbers; we do not store them.
2. How we use information
We use information to authenticate and manage accounts, apply age restrictions, create, store, validate and deliver games, enable play and multiplayer, provide posts and collaboration, manage purchases, subscriptions, coins and refunds, deliver notifications and respond to inquiries. We also use it to protect safety, prevent abuse and infringement, address violations, meet accounting, tax and legal obligations, and improve the Service. Optional usage analytics is described in section 6.
3. Public and shared information
Profiles, published games, posts, comments, reviews and rankings may be visible to other users and the public according to their visibility settings. Collaboration content is shared with authorized team members and proposal recipients. Do not publish private information or personal information about others without permission. Beyond processing and integrations needed to provide the Service, we disclose personal data with your consent, where required by law, to protect life, health or property, or as otherwise permitted by law. Information may be transferred as part of a business succession.
4. Information sent to AI services
Game creation sends prompts, creation chats, game source code and relevant assets to OpenAI. For image, audio and 3D asset generation, fal and the selected model providers process the instructions and necessary assets. Voice input sends a recording to OpenAI for transcription. In-game AI sends conversations and relevant game context to OpenAI. We may send text, images and game screenshots for AI safety checks. Providers process information needed for these functions and identifiers used to prevent abuse. Do not include names, contact details, health information, confidential information or other personal information unnecessary for your request.
5. External services and international processing
We use the following services depending on the feature and configuration. We limit the information sent to what is needed for that function. Providers and their subprocessors may process information outside Japan, including in the United States. Their linked policies explain their handling of information.
- Supabase — Authentication, account and game databases, and file storage.
- Vercel — Web and API delivery, creation, validation and multiplayer environments, access and error information.
- OpenAI — Game creation, transcription, in-game AI and content safety checks.
- fal — Image, audio and 3D asset generation.
- Stripe — Web purchases, subscriptions, refunds and payment information.
- Adapty — In-app purchases and membership entitlements, user identifiers and purchase information.
- Apple — Apple sign-in, iOS purchases, distribution and notifications.
- Google — Google sign-in, Android purchases, distribution and notifications, and inquiry forms.
- Discord — Discord sign-in and account information you authorize.
- OneSignal — Push notifications, device and subscription identifiers, and user identifiers.
- PostHog — Consented usage analytics, page views, actions, device information and user identifiers.
- Cloudflare — Turnstile bot and abuse prevention, including device and browser information.
6. Cookies, device storage and analytics
We use cookies and device storage for authentication, display preferences, consent records, game saves and downloads. You can remove or restrict them through your browser or OS settings, although this may affect sign-in and saved data. Optional PostHog analytics runs when configured and you have consented. On the web, you can decline through the consent banner. To choose again, clear this site's data in your browser and make a new choice when the banner appears. We do not sell personal information.
7. Microphone, photos and notification permissions
We request permissions when required for a feature you choose, such as microphone access for voice input or photo and camera access for importing assets. Recordings and uploads are sent to the services that process that feature. Push notifications are delivered to devices that allow them; permissions can be changed in OS or browser settings. Individual games use device capabilities according to the environment and permitted access. Declining optional permissions does not prevent use of features that do not need them.
8. Retention and deletion
We retain information for as long as necessary to provide the Service, respond to inquiries, maintain safety and meet legal obligations, and delete or de-identify information no longer needed. Deleted published games may have a recovery period. After account deletion, we retain transaction, accounting, tax and abuse-prevention records only as necessary. Backups and information held by external providers follow their retention and deletion procedures. We cannot necessarily delete copies of published content saved by others.
9. Security
We use measures such as encrypted communications, access controls, authentication safeguards and operational records to help prevent unauthorized access, disclosure, loss or damage. We manage access by staff and service providers and respond as required by law.
10. Your rights and account deletion
You can request information about our purposes, access, correction, addition, deletion, restriction of use or disclosure, and other rights available under applicable law through the inquiry form in section 13. We may need to verify your identity. You can edit your profile and delete your account in account settings on the web or in the app. Account deletion may not cancel a store subscription. Check your subscriptions with the store where you purchased them.
Open account deletion11. Children and minors
The Service is not available to children under 13. Users under 18 must obtain consent from their legal guardian. We use date of birth for age checks and restrictions; it is not shown on public profiles.
12. Changes to this policy
We may update this policy as the Service or applicable laws change. We publish the updated policy and date here. We communicate significant changes through suitable channels, including Service notices, and request consent where legally required.
13. Operator and contact
Moon Technica Inc. (株式会社Moon Technica) Representative Director: Takanori Itabashi Address: 1-21-1-608 Shimocho, Omiya-ku, Saitama, Saitama 330-0844, Japan For privacy questions or requests to exercise your rights, use our inquiry form. Information entered in the form is transmitted to us through Google.
Open the inquiry form