Privacy Policy

We may collect the following information through our website (a web app / PWA) and on site:

• Name, email, and phone number when making reservations
• Account information when you sign in (Supabase Auth)
• Payment transaction data processed by Stripe and PayPay (we do not store card numbers)
• Nickname when using chat or guestbook features
• Messages and images you send to the AI chat (“Kenji”), used to generate responses
• IP address for spam prevention
• LINE User ID when using LINE integration
• Access logs, page views, and performance metrics
• Crash logs and diagnostic data (Sentry)
• CCTV footage of shared areas on site (see “CCTV Cameras” below)
• Speech recorded by the entrance microphone when the door opens while the owner is away, and its transcript (see “Entrance microphone” below)
• Identifiers and connection records of devices that join the on-site Wi-Fi (see “On-site Wi-Fi” below)
• Your email address and booking details when you book a shower online (erased 90 days after the booking date)
• When you book through a booking site such as なっぷ (nap-camp.com): the booking notice that site sends us (lead guest name, contact details, dates, party size, plan, and any question or request). In our booking records, contact details and questions/requests are erased 90 days after check-out (operator notifications in Discord never carry contact details or the text of a question or request)

• Providing and processing lodging/camping reservations and payments
• Managing stay-pass bookings and guest accounts
• Responding to inquiries
• Preventing fraud and maintaining security (including on-site safety and crime prevention)
• Analytics to improve our services
• App stability and crash diagnostics
• Crime prevention (including the entrance microphone's recording), answering a question spoken at the entrance, and telling the owner when someone asks for a person

We use the following processors to operate our services:

• Supabase — authentication, database, storage
• Amazon Web Services (AWS) — website hosting and delivery (Amazon S3, CloudFront)
• Resend — booking email and consented email delivery (USA)
• Stripe — payment processing
• PayPay — PayPay payment processing
• Anthropic — AI chat (“Kenji”) response generation and AI trip plans (USA)
• OpenRouter — relays speech-to-text and spoken replies for the entrance microphone and the doorstep kiosk to ElevenLabs (USA)
• ElevenLabs — speech-to-text (Scribe) and spoken replies for the entrance microphone and the doorstep kiosk, through OpenRouter (USA)
• edge-tts — spoken replies when ElevenLabs does not answer; only the reply text is sent (Microsoft, USA)
• Langfuse — quality monitoring for the AI chat and AI trip plans (USA); for the chat it receives messages and replies, with email addresses, phone numbers, and booking reference codes masked before they are sent; for trip plans it never receives the text of your notes
• Sentry — crash and performance monitoring
• Google Analytics / Google Ads — web analytics and ad measurement (uses cookies)
• Meta (Facebook) — ad measurement (Pixel and Conversions API; the latter receives hashed contact details, plus the IP address, browser user agent and Meta's own cookie ids for matching)
• Google Maps — map display
• LINE — Official Account integration and (web only) conversion tags
• Discord — owner-only operations notifications about bookings, facilities and the network; a booking notice carries the channel, the lead guest's given name or initial, dates, party size, plan, and whether there is a question or request — never its text. When someone at the entrance microphone asks for a person, the words they spoke are included (US)
• Google Calendar and Gmail — receiving booking-site notification emails, and the operator's private booking calendar (channel, booking number, the first word of the name as entered, party size, plan, dates, arrival time and whether a reply is pending — no contact details and no request text) (US)
• Mushi — bug-report and diagnostics tool (built by the operator; processes diagnostic console/network capture)

Each provider's privacy policy applies to their processing. Ad measurement (Meta, LINE, Google Ads) can be switched off any time under “Analytics & Ad Measurement” below.

We do not sell personal information. We share data with processors listed above and when required by law.

We use cookies and local storage for sign-in state, language preferences, and UX. Measurement and advertising may set cookies from Google Analytics (_ga family), Google Ads (_gcl_au), the Meta Pixel (_fbp), and LINE Tag (__lt__ family). Besides your browser settings, the toggle under “Analytics & Ad Measurement” below stops the advertising cookies.

The site runs as a PWA (progressive web app): a service worker caches pages and images on your device for speed and offline viewing. Installing it to your home screen collects nothing beyond what this policy describes. We do not offer native iOS/Android apps.

• Run by: Tsumagoi Work&Camp (Kensaurus LLC). Security cameras cover the entrance, the shared areas and the car park. There are no cameras in private spaces such as showers or toilets.
• Purposes: (1) guest safety and crime prevention; (2) counting the people, vehicles and animals the cameras detect, to see how busy the entrance and car park are and when wild animals appear. A count records only the kind (person, vehicle, animal), the camera, the time and the zone: no image, no face and no number plate, and no one is identified. The counts are shown on the operator's on-site monitor and in the morning operations report.
• Sound: the cameras in the Kotatsu Lounge and at the entrance record sound along with the picture. The sound is kept and deleted with the footage.
• We do not use face recognition (matching a person by their face) and do not read number plates.
• Retention: footage (with its sound) is recorded on the on-site computer and backed up to Amazon Web Services (Tokyo region). Recordings are kept for at most 180 days and then deleted automatically.
• Operator notices: when a camera detects a person or similar, a still image may be sent to the operator's notification channel (Discord, in the USA). The morning operations report there carries a still from each camera and the previous day's counts. These notices are kept as the operating record.
• Footage is used only for those purposes and is not shared with third parties except as required by law (including lawful police inquiries).
• Questions about the cameras: LINE @012pteqb (or the contact details under “Contact” below).

• For crime prevention, there is a microphone and a speaker at the entrance, inside the front door. When the owner is away (away mode) and the door opens, a short chime plays and what is said is recorded (up to 8 seconds a phrase, up to four phrases a visit). During quiet hours (22:00–08:00 Japan time) there is no chime and no spoken reply: it only records. When the owner is here, during an event, or when it is switched off, opening the door records nothing. Pressing the doorbell never records.
• The on-site computer transcribes the recording (Whisper). The audio may also go to speech-to-text (ElevenLabs Scribe, through OpenRouter, in the USA). Outside quiet hours, a question is answered briefly by an AI (Anthropic's Claude, in the USA), and the answer is spoken (ElevenLabs, through OpenRouter). When ElevenLabs does not answer, only the reply text goes to a read-aloud service (edge-tts, Microsoft, in the USA).
• What is kept: the audio file is deleted as soon as it has been transcribed. The transcript is kept with the AI-chat history, so a later question in the same visit can be answered, and is deleted automatically after 30 days. Operations logs and quality monitoring (Langfuse) record only how many characters were said, never the words.
• Who can see it: only we, the operator, can read that history. If you ask for a person, your words are sent to the owner's operations channel (Discord, in the USA). The speaker does not say that the owner was notified; a person is reached from the LINE QR on the wall.
• The owner's talk page opens the entrance microphone only while Talk is held, and sends that audio live to the device that opened the page. That call is not sent to speech-to-text.

• For devices that join the on-site Wi-Fi, we record the device identifier (MAC address), device name, the access point used, and connection and disconnection times. We do not record the content of your traffic (such as sites visited or messages).
• These records are used only for network security, detecting unauthorised connections, and troubleshooting, and are not shared with third parties except as required by law (including lawful police inquiries).
• A new device joining may be reported to our operator-only notification channel (Discord). The notice shows the device name, MAC address, its IP address on the site network, the access point it joined and its signal strength.
• If you use the Wi-Fi sign-in page (portal), we record the access period confirmed by your booking number or access code, the device identifier (MAC address), the device type (browser information), its IP address on the site network, when it first and last connected, and how much data each device used (bytes received and sent, nothing more). We do not record the content of your traffic or where it goes. These records are deleted within 90 days after your access period ends.
• The sign-in page shows you your access period, your registered devices and the data each has used, plus a support code that lets us find your device if you contact us.
• For the free short session for guests without a code (once per device per day), we record the device identifier (MAC address) and the date so it can be used only once a day, kept up to 90 days like the other Wi-Fi records.
• If you send the 4-digit code from the free session's screen to our LINE Official Account, the session is extended. We receive that message and your LINE display name, and ask LINE whether you have added us as a friend. To allow it once a day, we keep a one-way converted value (a hash) of your LINE user ID, never the ID itself, and delete it within three days. The code is deleted by the morning after it stops working (the end of that day, or of the extended session).
• Unusual use, such as more devices than a code allows, devices swapped in and out quickly, or many entries in a short time, is reported to our operator-only notification channel (Discord). That notice carries only the last four digits of the MAC address, the support code, the type of access (for a stay, the site name) and what happened, such as the device count, the data used or why a connection step failed; never your name or contact details.
• Records are kept only as long as those purposes require and are then deleted.

We plan to introduce a self-checkout step where guests upload photos of their site's condition. When it launches, photos will be kept for a limited period solely for condition verification and damage settlement, and this policy will be updated accordingly. We do not collect these photos today.

We measure page views and the reservation funnel with Google Analytics 4, and ad performance with the Google Ads conversion tag, the Meta Pixel, and LINE Tag. For enhanced conversion measurement on completed bookings, your email address and phone number are SHA-256-hashed in your browser before being sent to Google — raw values are never transmitted. Meta's Conversions API, on a completed booking and when you send a charter enquiry, likewise receives hashed contact details, plus the IP address, browser user agent and Meta's cookie ids (_fbp, _fbc) for matching (for enquiries, only if you allow ad measurement).

When you arrive from an ad, we store the ad click identifier (Google Ads gclid, gbraid or wbraid; Meta fbclid) and the campaign tags (utm) with your enquiry or booking record to measure our advertising (bookings keep the gclid and utm only; an enquiry keeps click identifiers only if you allow ad measurement). They are kept for the same period as that record (see “Data Retention” below). If you allow ad measurement, the click identifier is also kept in your browser for up to 90 days, so a booking made on a later day can still be measured; switching ad measurement off deletes that browser copy on your next page load. Only if you allow analytics, we also store your GA4 client ID (the value of the _ga cookie) with the payment record so the purchase is measured correctly.

For visitors from the EEA, UK and Switzerland, ad-measurement tags do not load until you accept the consent banner (Google measurement runs storage-less under Google Consent Mode until then). We also honor your browser's Global Privacy Control (GPC) signal by disabling ad measurement. Everywhere else you can switch it off below at any time (by design, LINE Tag stops from your next page load).

For diagnostics we use Sentry (crashes/performance) and Mushi (bug reports). We do not send personally identifying data to Sentry — it is scrubbed automatically before transmission.

When using our LINE Official Account (@012pteqb), LINE's Terms of Service and Privacy Policy also apply.

Our AI chat (“Kenji”) sends the messages and images you submit to an AI provider (Anthropic, in the USA) to generate responses. Message text and replies are also sent to an LLM monitoring service (Langfuse, in the USA) so we can review answer quality. Email addresses, phone numbers, and booking reference codes are automatically masked before this happens; the rest of the message text is sent as written. Neither we nor Anthropic use data submitted through the API to train AI models. Some conversation data may be retained for a limited period for quality improvement and abuse prevention. Please avoid entering sensitive personal data or another person's personal information. See this policy and each provider's policy for details.

“Plan your trip with AI” on the Access page sends the travel notes you type to an AI provider (Anthropic, in the USA) to write the plan. Before they are sent, names, phone numbers, email addresses, booking codes, addresses, social handles and links carrying a token are removed automatically (a name written on its own in a sentence may not be caught, so please leave names out). If you are not signed in, we do not save your notes or the plan in our database (if you choose to sign in, the plan waits in this browser tab and is saved once you are signed in). When you are signed in, we save the notes, with personal details removed, and the plan to your account automatically (the newest 20 automatic saves are kept; a plan you Keep is never cleared automatically). A saved plan is never public unless you make a share link. Anyone with that link sees the title, dates, party size, the day-by-day plan and the three priced ways to stay, never your notes, your questions or your account. Before the link exists you see exactly what it will show, with names in the plan replaced by [name]. You can turn a link off and delete any plan at any time under “My trip plans” in your account. Our quality monitoring (Langfuse, in the USA) never receives the text of your notes: it gets their length, how many details were removed, the plan's title and a booking summary such as party size, arrival date and nights (and your account ID if you are signed in).

To operate the Service, your personal data may be processed or stored by third parties located outside Japan (cloud, payment, AI, and monitoring providers). Destination countries include the United States (e.g., Anthropic [AI chat and trip plans], Langfuse [quality monitoring for both], OpenRouter [speech relay], ElevenLabs [speech-to-text and spoken replies], Microsoft [edge-tts], Stripe [payments], Sentry [monitoring], Discord [owner notifications], Google [booking calendar]; some, such as Supabase, vary by region setting). We apply appropriate safeguards through our contracts with these providers in accordance with applicable law. On request, we will give you information about the measures we take to ensure these overseas recipients keep applying safeguards equivalent to those Japanese law requires (ask through “Your Rights” below).

Contact details, tags, service notes, and interaction history in our guest-management system are kept for seven years after the latest stay or interaction, then deleted or anonymized unless a longer period is required by law. Booking and payment records may be retained separately for the period required by tax, accounting, and other legal obligations.

To prevent leakage, loss, or damage of personal data, we maintain safeguards including TLS encryption in transit, row-level access control on our database, least-privilege permissions, secure credential management, and contractual supervision of our processors. Given our size, data handling is limited to the operating representative.

You may request notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use or erasure, and suspension of third-party provision of your retained personal data. To make a request, contact us below (LINE, or email kensaurus@gmail.com). After verifying your identity, we will respond in accordance with law. We also handle complaints about our handling of personal data through the same contact.