Caskey Privacy Policy

This is an English translation of the Japanese Privacy Policy, provided for convenience. If there is any discrepancy between the Japanese and English versions, the Japanese version prevails.

1. Introduction

TANOSYS LLC (合同会社TANOSYS; "we", "us" or "our") sets out this Privacy Policy (this "Policy") for how we handle users' personal information in the whisky search and recommendation service "Caskey" and the bar management service "Caskey for Bar" (together, the "Services").

This Policy applies to both Caskey (for general users) and Caskey for Bar (for bar operators).

2. Information We Collect

2.1 Information collected from general users (Caskey)

Information you provide directly

Information	Details
Account information	Email address, password (stored encrypted), display name
Profile information	Avatar image
Authentication information	Google account linking information, Apple ID linking information (Sign in with Apple), two-factor authentication settings
Age confirmation and consent records	Your declaration that you meet the age requirements in the Terms of Service (20 or older in Japan; outside Japan, at or above the legal drinking age in your country or region of residence), and the date and time you agreed to the Terms of Service and this Policy
Temporary information before registration	Information we hold temporarily when you first sign in with a Google account or Apple ID, until you complete the consent step (email address, the identifier of each service, display name, avatar image). If you do not complete the consent step, it becomes invalid after 24 hours and is deleted by the next daily process (about 48 hours at most).
Tasting feedback	Your impressions and comments on how a whisky tastes
Drinking records	Records of the bottles you drank, where and when you drank them, your impressions, how much is left in the bottle, and similar
Image data	Photos uploaded to identify whisky bottles
Chat messages	The content of your conversations with the AI assistant

Information collected automatically

Information	Details
Location information	Your device's latitude and longitude (only if you allow it)
Device information	Device token (for delivering push notifications), OS type
Usage	Search history, favorites, bars you follow
Service usage data	Credit balance, monthly usage statistics
App usage, error and performance information	Screens viewed and actions taken, errors and crashes, time taken to launch and to communicate, and similar (see "10. Cookies and Information Sent to Third Parties")
Access logs	IP address, user ID, date and time of access, features used
Device and app integrity information	Results of checks that requests come from our genuine app on a genuine device (Firebase App Check, Apple App Attest / DeviceCheck, Google Play Integrity)

Information generated or analysed by AI

Information	Details
Taste profile	Vector data that quantifies your taste preferences
Flavor preference scores	Intensity scores on eight flavor axes (peaty, malty, fruity, sweet, spicy, smoky, woody, finish)
Preference summary	A natural-language summary of your taste profile written by AI
Search intent classification	The classified intent of your chat messages

2.2 Information collected from bar operators (Caskey for Bar)

Information operators provide directly

Information	Details
Account information	Email address, password (stored encrypted), display name
Authentication information	Google account linking information, Apple ID linking information (Sign in with Apple), two-factor authentication settings
Consent records	The date and time you agreed to the Terms of Service
Temporary information before registration	Information we hold temporarily when you first sign in with a Google account or Apple ID, until you complete the consent step (email address, the identifier of each service, display name). If you do not complete the consent step, it becomes invalid after 24 hours and is deleted by the next daily process (about 48 hours at most).
Store information	Store name, address, phone number, website URL, Instagram URL, X (Twitter) URL
Store images	Store logo image
Business information	Opening hours (by day of the week), regular holidays, special opening days, business status (open, preparing, closed)
Bottle information	Whisky bottle stock, prices (shot prices by volume), availability (available, sold out), visibility settings
Tasting notes	Tasting notes on bottles (text and images)
Bottle images	Bottle photos (up to three: front, back and detail)
Photos transferred from Instagram	Photos a member bar has transferred with Instagram's data transfer feature. They may show things other than bottles, such as people (for how they are handled, see "4.2 External Services", "7.3 Retention Periods" and Article 11 of the Caskey for Bar Terms of Service)
Staff information	Registration information of staff accounts, permission settings (owner, staff)

Information collected automatically

Information	Details
Store location information	Latitude and longitude converted automatically from the address (geocoding)
Device information	Device token (for delivering push notifications), OS type
App usage, error and performance information	Screens viewed and actions taken, errors and crashes, time taken to launch and to communicate, and similar (see "10. Cookies and Information Sent to Third Parties")
Access logs	IP address, user ID, date and time of access, features used
Device and app integrity information	Results of checks that requests come from our genuine app on a genuine device (Firebase App Check, Apple App Attest / DeviceCheck, Google Play Integrity)

3. How We Use Information

We use the information we collect for the following purposes.

3.1 Providing the Services (all users)

• User authentication and account management
• Age confirmation (general users), and recording and managing agreement to the Terms of Service
• Delivering push notifications

3.2 Providing the Services (general users)

• AI-based whisky search and recommendations
• Building and updating your taste profile
• Notifications recommending bottles that match your preferences
• Searching for nearby bars and delivering notifications based on your location
• Providing favorites, bar following and drinking records

3.3 Providing the Services (bar operators)

• Managing and publishing bottle stock
• Identifying bottles automatically by image recognition
• Analysing photos transferred from Instagram to prepare bottle registration candidates and to improve the accuracy of bottle identification
• Delivering business information to end users
• Sending notifications asking you to confirm whether you stock a bottle, when an end user reports drinking it
• Showing nearby bars to end users based on store location

3.4 Improving the Services

• Improving the accuracy of AI models (statistical analysis of preference data)
• Analysing how the Services are used
• Detecting and fixing errors, and improving performance
• Responding to your questions about notices (when you reach the question limit, our staff review the conversation and contact you at your registered email address)
• Preventing misuse of the chat (detecting instructions that try to change how the AI works), and reviewing feedback and requests sent through the chat
• Developing and improving features

3.5 Providing data to business partners

• We may provide data processed statistically, in a form that does not identify any individual or store, to business partners such as liquor retailers and distilleries
• Examples: regional flavor preference trends, rankings of popular bottles, demand trends

3.6 Communication

• Important notices about the Services (changes to terms, maintenance, etc.)
• Recommendation and new-arrival notifications (if you allow them)
• Notifications asking you to confirm whether you stock a bottle, notifications that image analysis has finished, and notifications about importing photos from Instagram (bar operators)

3.7 Preventing misuse

• Preventing and detecting misuse (use for resale, unauthorised collection of data, unauthorised access, etc.), and responding to breaches of the Terms of Service

4. Providing Information to Third Parties

4.1 Service providers

• Amazon Web Services, Inc. (infrastructure, image storage, sending contact form emails and managing rate limits)
• Google LLC (through Firebase / Google Cloud: authentication, push notification delivery, device and app integrity checks, app usage analysis, error and performance measurement, and website analytics)
• Backblaze, Inc. (receiving photos transferred from Instagram)
• Cloudflare, Inc. (verifying contact form submissions against automated attacks and bots)

4.2 External services

The AI features of the Services use the external services below. General users' chat messages and uploaded images, and bar operators' bottle images and photos transferred from Instagram, may be sent to these providers.

• Anthropic, PBC (Claude)
• OpenAI, L.L.C. (GPT)
• Google LLC (Gemini)

We also use TypeSafe AI, Inc. (Jev) for decisions such as classifying the content of chats. General users' chat messages and the text of their conversation history, and bottle details such as the brand read from bar operators' photos, may be sent to this company. Images are not sent.

Each provider processes the information in accordance with its own privacy policy.

4.3 Payment processing

• Processing and verifying in-app purchases (Apple App Store / Google Play)

4.4 Device and app integrity checks

To prevent misuse, we use the services below to confirm that access to the Services comes from our genuine app on a genuine device. In the process, information about your device and the app is sent to these companies.

• Apple (App Attest / DeviceCheck)
• Google (Play Integrity / Firebase App Check)

4.5 Geocoding

• Converting bar operators' addresses to latitude and longitude (Google Geocoding API)

4.6 Public information

• Store information registered by bar operators (store name, address, opening hours, etc.) and bottle information (where visibility is turned on) is published through the general user app "Caskey"

4.7 Providing statistical data

• We may provide data processed statistically, in a form that does not identify any individual or store, to business partners (liquor retailers, distilleries, etc.)

4.8 Disclosure required by law

• When disclosure is required by law
• When it is necessary to protect the life, body or property of a person and it is difficult to obtain the person's consent

5. Location Information

5.1 General users

1. We obtain location information only if you explicitly allow it in your device's OS settings.
2. We use location information for the following purposes:
   • Searching for nearby bars
   • Deciding whether to deliver a recommendation notification (notifying you when you are near a bar)
3. Your most recent location (latitude, longitude and time of update) is stored on our servers.
4. You can withdraw permission to use location information at any time in your device's settings.

5.2 Bar operators

1. We calculate latitude and longitude automatically from the store's address using the Google Geocoding API.
2. The calculated location is used for end users' nearby bar searches and for distance checks for recommendation notifications.

6. Push Notifications

6.1 General users

1. Push notifications are delivered using Firebase Cloud Messaging (FCM).
2. Types of notification:
   • Recommendation notifications: when a bottle that matches your preferences arrives at a bar
   • Favorite bottle arrival notifications: when a bottle you added to your favorites arrives at a bar
   • New arrival notifications: when a bar you follow adds a new bottle
3. Recommendation notifications for bottles that match your preferences are limited to a set number per day. Favorite bottle arrival notifications are not subject to this limit.
4. You can turn notifications off at any time in your device's settings and in the app's settings.

6.2 Bar operators

1. Push notifications are delivered using Firebase Cloud Messaging (FCM).
2. Types of notification:
   • Notifications asking you to confirm a bottle: when an end user reports drinking a particular whisky at your store and the bottle is not registered in your stock
   • Image analysis completion notifications: when analysis of bottle images you sent for registration has finished
   • Notifications about importing photos from Instagram: when analysis of transferred photos has finished and registration candidates are ready to review, or when the import settings need your attention
3. You can turn notifications off in your device's settings.

7. Data Storage and Security

7.1 Security measures

• Passwords are stored hashed with bcrypt
• Communications are encrypted with TLS/SSL
• Authentication with JWT (JSON Web Token) (access tokens valid for 24 hours, refresh tokens for 30 days)
• Two-factor authentication with confirmation codes sent by email

7.2 Where data is stored

• Servers: stored on the AWS cloud
• Images: stored in AWS S3
• Photos transferred from Instagram: received on Backblaze B2, and deleted from that service after being retrieved for analysis

7.3 Retention periods

• General users' data, such as account information, conversation history, taste profile, drinking records, favorites and uploaded images: until the account is deleted. After deletion, we keep it for 30 days and then delete it physically (except for the payment and similar records below).
• Bar operators' data, such as store information, business information, bottle stock, prices and settings: until the account is deleted. After deletion, we keep it for 30 days and then delete it physically. However, for bottles registered by a bar operator, we continue to keep the information about the bottle itself (name, distillery, specifications, etc.) and the flavor elements and their intensity extracted from tasting notes, as part of our whisky information. Bottle images uploaded by the bar operator and the text of tasting notes are deleted after the 30 days.
• Reviews of bars: 30 days after the account is deleted, we delete the text of the review and keep only the rating, bar, bottle and date, with the link to the user removed.
• Payment and similar records (purchase and subscription history, records of credit increases and decreases, monthly usage): 30 days after the account is deleted, we remove the link to the user so that they no longer directly identify you, and keep them for as long as necessary to retain accounting and tax records and to respond to enquiries from the app stores. These records include transaction information from the app stores (such as receipts that prove a purchase).
• Records of the cost of using AI features: only the amount used, the cost and the AI model used are kept, in the same way as the payment and similar records above. The content of AI responses is deleted.
• Temporary information before registration: until the consent step is completed. If it is not completed, it becomes invalid after 24 hours and is deleted by the next daily process (about 48 hours at most)
• Photos transferred from Instagram: deleted promptly once analysis has finished. Photos that show only one bottle are kept until the member bar has finished reviewing them and closes the import (at most 30 days after the import), and if the member bar registers one as a bottle image, it is kept as that image (Article 11 of the Caskey for Bar Terms of Service).
• Chat messages recorded to prevent misuse or to review feedback and requests: kept until the account is deleted, even if the conversation is deleted, then for 30 days after account deletion, after which they are physically deleted.
• Location information (general users): only the most recent location is kept (no history is stored)
• Access logs: 90 days
• Identifying information of users whose registration was cancelled for breaching the Terms of Service (hashed email address, social sign-in identifiers, etc.): for as long as necessary to refuse re-registration
• Statistically processed data: kept in a form that does not identify any individual or store, and used to improve the Services

8. Transfer of Personal Data Outside Japan

To provide, operate, maintain and improve the Services, generate AI responses, analyse images, deliver notifications, store data and for related purposes, we may provide user information to, or store it on servers managed by, the cloud service, AI service and external tool providers we use.

These providers may include companies located outside Japan or companies that use servers located outside Japan.

Examples of the main external providers we use:

• OpenAI, L.L.C.
• Anthropic, PBC
• Google LLC
• Apple Inc.
• Amazon Web Services, Inc.
• Backblaze, Inc.
• Cloudflare, Inc.
• Slack Technologies, LLC
• TypeSafe AI, Inc.

When selecting these providers, we check their published information, contract terms, security arrangements and other necessary matters, and endeavour to ensure that appropriate security measures are in place.

If you would like details about provision to third parties outside Japan or storage on servers outside Japan, please contact us using the details at the end of this Policy.

9. Your Rights

In accordance with applicable laws, you may request disclosure (including disclosure of records of provision to third parties), correction, addition, deletion, suspension of use, erasure, or cessation of provision to third parties of your personal information that we hold.

If you wish to make such a request, please contact us using the details at the end of this Policy. We will verify your identity and respond without delay in accordance with applicable laws.

Depending on the request, we may be unable to comply with all or part of it because of legal requirements or the proper conduct of our business. In that case, we will endeavour to explain the reason.

When you make a request for disclosure or similar, we may ask you to submit identification documents or to verify your identity by other methods we specify.

9.1 General users

• Stopping notifications: you can turn push notifications off
• Stopping location: you can withdraw permission to use location information
• Editing your profile: you can edit your profile information in the app

9.2 Bar operators

• Stopping notifications: you can turn push notifications off
• Editing store and bottle information: you can edit store and bottle information in the app
• Changing visibility settings: you can change the visibility settings of each bottle (price display, appearance in search)

10. Cookies and Information Sent to Third Parties

10.1 Mobile apps

Our mobile apps (Caskey / Caskey for Bar) do not use browser cookies. On your device, they store the authentication tokens needed to keep you signed in, the device token needed to deliver push notifications, app settings and similar.

The mobile apps also send information from your device to the external companies below.

Recipient	Service and app	Information sent	Purpose
Google LLC	Firebase Analytics (iOS and Android versions of Caskey / Caskey for Bar)	App usage such as screens viewed and actions taken; app version, environment and language settings; your plan and subscription status (Caskey only); the user ID we assign; app instance ID; device model and OS; approximate region estimated from the IP address	Analysing usage and improving the Services
Google LLC	Firebase Crashlytics (iOS and Android versions of Caskey / Caskey for Bar)	Crashes and errors (details of the error, the screen where it occurred, a record of the preceding actions); device model, OS and state; app version; the user ID we assign	Detecting and fixing errors
Google LLC	Firebase Performance Monitoring (iOS and Android versions of Caskey / Caskey for Bar)	Time taken to launch the app and display screens; duration, data volume and response status of network requests (including the URLs requested); device model, OS and network conditions	Measuring and improving performance
Google LLC	Firebase Cloud Messaging (Caskey / Caskey for Bar)	Device token, app instance ID	Delivering push notifications
Google LLC / Apple Inc.	Firebase App Check, Google Play Integrity, Apple App Attest / DeviceCheck (Caskey / Caskey for Bar)	Information about your device and the app	Confirming that requests come from our genuine app on a genuine device (preventing misuse)
Google LLC	ML Kit Text Recognition (Android versions of Caskey / Caskey for Bar)	Information about the use and performance of ML Kit features (device model and OS, app information, etc.). Photos you take are processed on your device and are not sent through ML Kit.	Providing the feature that reads text on bottle labels, and Google's provision and improvement of that feature
Google LLC	Google Maps SDK (iOS and Android versions of Caskey for Bar)	The map area displayed, information about your device and the app, IP address	Displaying a map on the screen for setting the store's location

Google LLC handles information in accordance with its privacy policy (https://policies.google.com/privacy).

10.2 Websites

Our websites (caskey.jp, bar.caskey.jp) use "Google Analytics", an analytics tool provided by Google LLC, to improve the Services and understand how they are used. Google Analytics uses cookies and similar identifiers to collect traffic data in a form that does not identify visitors as individuals. The information collected includes the pages viewed, the referring site, the browser and OS used, and the approximate region (estimated from the IP address); IP addresses are anonymised by Google before being handled.

The data obtained is managed in accordance with Google LLC's privacy policy (https://policies.google.com/privacy). If you wish to opt out of collection by Google Analytics, please use the browser add-on "Google Analytics Opt-out Browser Add-on" (https://tools.google.com/dlpage/gaoptout).

Google Analytics measurement is not performed in the WebViews inside the mobile apps (used to display this Policy, the Terms of Service and similar).

11. Protection of Minors

Because the Services relate to drinking alcohol, they are not intended for use by persons under 20 in Japan, or, outside Japan, by persons below the legal drinking age in their country or region of residence. If we find that such a person has registered for the Services, we may delete the account.

12. Contact Form

12.1 Information we collect

We collect the following information through the contact forms on our websites (caskey.jp, bar.caskey.jp).

• Type of enquiry
• Your name or store name
• Email address
• Subject
• Message
• The language of the page the form was sent from
• Sender IP address (collected to prevent automated attacks and spam and to apply rate limits; for rate limiting it is stored hashed)

12.2 Purposes of use

We use the information collected only for the following purposes.

• Responding to your enquiry and verifying your identity
• Managing and recording our handling of enquiries
• Improving the quality of the Services by analysing enquiries
• Classifying enquiries and drafting replies automatically using AI (artificial intelligence) (final replies are checked and sent by our staff)
• Referring to your account information (registration status, usage, etc.) to the extent necessary to handle your enquiry
• Preventing automated attacks and spam, and applying rate limits

12.3 Provision to third parties

We do not provide information collected through the contact form to third parties without your consent. However, to operate the form, we use the service providers and external services below.

• Amazon Web Services, Inc.: sending form submissions by email (Amazon SES), and storing hashed IP addresses for rate limiting
• Cloudflare, Inc.: verifying submissions against automated attacks and bots. When you open a page with the form, your browser sends Cloudflare your IP address, TLS fingerprint, User-Agent, the site key and the page origin. When you submit the form, we also send Cloudflare a verification token and the sender IP address. Cloudflare uses this information to detect and block bots and to improve that capability (Cloudflare's explanation).
• Anthropic, PBC: to classify enquiries and draft replies automatically using AI, the content of the enquiry (including your name or store name, email address, subject and message) is sent. When needed to handle the enquiry, the account information we refer to is also sent (registration status, subscription, credit and payment history, taste profile, drinking records with bar names, and notification settings and delivery history; for bar operators, store, inventory and activity information). Under Anthropic's published terms, the data sent is in principle deleted within 30 days of receipt or generation (with exceptions such as enforcing its Usage Policy or complying with the law). By default, Anthropic does not use it to train AI models.
• Slack Technologies, LLC: to manage the handling of enquiries within our company, the content of the enquiry and the reply drafted by AI are forwarded to our internal communication tool (Slack).

12.4 Retention periods

• Content of enquiries: kept for a reasonable period after handling is complete, and deleted appropriately once no longer needed for handling.
• Hashed IP addresses: expire automatically after the rate limiting period (at most 1 hour).

12.5 Optional nature

Entering information in the contact form is optional. However, if required fields are not filled in, we may be unable to respond to your enquiry.

13. Changes to This Policy

1. We may change this Policy as necessary.
2. If there are important changes, we will notify you through an in-app notification or by email.
3. If you use the Services after a change, you will be deemed to have agreed to the changed Policy.

14. Contact

For enquiries about the handling of personal information, please contact us at the details below.

Business name	TANOSYS LLC (合同会社TANOSYS)
Email	support@caskey.app
Address	1-4-5-201 Kusagae, Chuo-ku, Fukuoka-shi, Fukuoka 810-0045, Japan

Established: April 1, 2026
TANOSYS LLC

Last updated: November 6, 2026