Privacy Policy
Version 2026-10-24.4
Effective 24 October 2026. WANG PENG YUAN, an individual business operator in Japan trading as Hibira (formerly Hikibi; "Hibira", "we"), is responsible for the personal data described here: data about our customers and visitors to hibira.io. When our customers send their own end users' data through the Service, we process it for them under the Data Processing Agreement, and the customer's own privacy notice applies to it.
1. What we collect and why
| Data | Source | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| Email, optional name and preferred language | You, at sign-up | Run your account, sign-in, service and billing emails | Contract | While the account is open, then 30 days |
| Password | You | Sign-in. We store only an Argon2id hash, never the password | Contract | While the account is open |
| Google or GitHub account ID, verified email and name (only if you choose to sign in with them) | Google or GitHub, with your permission | Create your account and sign you in | Contract | While the account is open, or until you disconnect the sign-in |
| Two-factor authentication secret and backup codes (only if you turn it on) | You | Protect sign-in. The secret is stored encrypted and backup codes only as hashes | Contract, legitimate interest (security) | Until you turn it off or close the account |
| Session cookie and CSRF token | Set at sign-in | Keep you signed in securely | Contract, legitimate interest (security) | 30 days or until sign-out |
| Signed-in sessions and new sign-in alerts (time, IP address, approximate location, browser and device) | Your browser | Show your active sessions so you can sign them out, and email you when a new device signs in | Legitimate interest (security) | While the session lasts, then 90 days |
| Account activity log (sign-ins, security and billing changes, key changes, with time and IP address) | Your use of the portal | Let you and us review changes to the account and investigate abuse | Legitimate interest (security) | 1 year, or until the account is deleted |
| IP address and email used at sign-in | Your browser | Rate limiting and abuse prevention | Legitimate interest (security) | Short-lived counters, hours at most |
| Where your sign-up came from (first page, referring site, campaign tags) | Your browser, at sign-up | Measure which channels bring customers, in aggregate | Legitimate interest | While the account is open |
| Plan, subscription status, Stripe customer and subscription IDs, renewal date | Stripe and you | Billing and plan limits | Contract, legal obligation | Account life, then as tax law requires (7 years) |
| Card details | You, directly to Stripe | Payment | Contract | Held by Stripe; we never see or store full card numbers |
| Payment event records Stripe sends us about your subscription, invoices, payments, refunds and disputes (they can include your billing email, name and address, and the card brand and last four digits, never the full card number) | Stripe | Check and correct billing, answer disputes, investigate errors | Contract, legitimate interest (handling disputes and errors) | 180 days, or until the account is deleted |
| A one-way hash of the card fingerprint Stripe gives us for the card on a free trial (never the card number) | Stripe, when a trial starts | Allow one free trial per card | Legitimate interest (fraud prevention) | Until the account is deleted, then kept only as the hash, linked to the closed account, so the trial cannot be repeated |
| Apps, keys, connection counts and published-message counts per app and per account per day | Your use of the Service | Run the Service, enforce limits, show usage | Contract | Usage counters 35 days; apps while the account is open |
| AI agent access: names, scopes and last-used times of personal access tokens and OAuth grants, and the names agents register with | You, when you connect an AI agent | Let AI agents use the Service for you. Tokens are stored only as hashes | Contract | Until you revoke them or close the account |
| Server logs (IP address, time, request path, user agent) | Your requests | Security, debugging, capacity planning | Legitimate interest | 90 days |
| Website analytics (pages viewed, device, approximate location) | Google Analytics 4, under the rules for your region in section 2 | Understand how the website is used | Consent; legitimate interest in the regions where section 2 says analytics is on until you turn it off | 14 months in GA4 |
| Page speed figures (page route, device class, language) | Your browser, under the same rules | Keep the website fast | As for website analytics | Daily totals without identifiers, 35 days |
| Google Analytics client and session IDs, and account events such as sign-up, payment and first message | Your browser, under the same rules; our server | Link the events our server sends to Google Analytics with your visit | As for website analytics | Cleared when you turn analytics off; 14 months in GA4 |
| Browser notification subscription (push service address and encryption keys, and the date you turned it on) | Your browser, only if you turn on notifications in the portal | Send you notices about usage, service status, payments and webhooks | Consent | Until you turn notifications off, the browser cancels the subscription, or the account is deleted |
| Messages to support | You | Answer you | Contract, legitimate interest | 2 years after the conversation ends |
If you do not give an email address and password, or sign in with Google or GitHub, we cannot create an account. Everything else listed as optional can be left out.
When you sign in with Google, we ask only for the openid, email and profile permissions. We use the account ID, verified email and name Google returns only to create your account and sign you in. We do not keep Google access tokens, do not read any other Google data, and do not sell, share or use this information for advertising. Hibira's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. GitHub sign-in works the same way with the read:user and user:email permissions.
We do not sell personal data, use it for targeted advertising, or make automated decisions with legal or similarly significant effects.
2. Cookies
| Cookie | Type | Purpose | Lifetime |
|---|---|---|---|
pusher_portal | Strictly necessary | Keeps you signed in to the portal | 30 days |
| Consent choice | Strictly necessary | Remembers your cookie choice, or that you have seen the cookie notice | 12 months |
_ga, _ga_* | Analytics | Google Analytics 4 | Up to 14 months |
How we ask about analytics cookies (and the page speed figures that go with them) depends on the country your IP address is in:
- European Economic Area, United Kingdom, Switzerland, mainland China, Korea, Thailand and Vietnam, or when we cannot tell the country: analytics cookies are set only after you accept them in the banner, which lets you refuse just as easily.
- United States: analytics is on unless you opt out in the banner or from "Your privacy choices" in the footer. We treat a Global Privacy Control signal from your browser as an opt-out.
- Everywhere else, including Japan, Taiwan, Hong Kong and Singapore: analytics is on, a notice says so on your first visit, and you can turn it off from that notice or from "Cookie settings" in the footer. A Global Privacy Control signal turns it off too.
You can change your choice at any time from the footer link. Turning analytics off stops Google Analytics, deletes its cookies from your browser and clears the Google Analytics IDs kept with your account.
3. Who we share data with
We share personal data only with the service providers below, who act on our instructions, and with authorities where the law requires.
| Recipient | Role | Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, storage | All data held by the Service | Hong Kong (AWS ap-east-1) |
| Neon | Database hosting | Account, app, billing and push device records | Singapore (AWS ap-southeast-1) |
| Cloudflare | DNS, CDN, DDoS protection; cookieless page analytics (Web Analytics) | IP address, request metadata; pages viewed and page speed, without cookies or identifiers | Global edge network |
| Stripe | Payments, invoices, tax | Email, name, billing address, card details, plan | United States and other Stripe locations |
| Google (GA4) | Website analytics, only with consent | Pseudonymous identifiers, page views, device data | United States |
| Google Workspace (Gmail) | Transactional email | Email address, message content | United States and other Google locations |
| Your browser's push service (for example Google, Mozilla, Apple or Microsoft) | Delivering browser notifications, only if you turn them on | Push subscription address, encrypted notification content | Where the browser maker runs it, usually the United States |
If we are involved in a merger or acquisition, data may pass to the successor, which must honour this policy.
4. International transfers
We are based in Japan, our servers run in Hong Kong (AWS ap-east-1) and our database in Singapore (Neon, on AWS ap-southeast-1), so your data may be processed outside the country you live in. We protect transfers with contracts that bind recipients to an equivalent level of protection, such as the EU Standard Contractual Clauses, and by choosing providers with recognised certifications (for example ISO 27001 or SOC 2).
5. Security
We encrypt traffic with TLS, hash passwords with Argon2id, keep app secrets out of logs, limit staff access to what their job needs, rate-limit sign-in, and keep backups encrypted. You can turn on two-factor authentication, see and sign out your active sessions, and review your account activity in the portal. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the relevant regulator within the time the law requires.
6. Your rights
You can ask us to tell you what data we hold about you, give you a copy, correct it, delete it, stop or restrict using it, or move it to another provider. You can withdraw consent at any time without affecting earlier processing. Email [email protected] from your account address. We answer within 30 days, or sooner where local law requires. We may need to confirm your identity and may keep data the law requires us to keep, such as invoices.
If you are unhappy with our answer, you can complain to the data protection authority where you live.
7. Country-specific information
Taiwan (Personal Data Protection Act). We collect identification data, including online account, IP address and cookie identifiers (C001), and financial identification data (C002) for the purposes of contract and similar legal relationships (069), consumer and customer management and service (090), online shopping and other e-commerce services (148), information, communications and database management (136), and survey, statistics and research analysis (157). We use it during the account's life and the retention periods above, in the regions listed in section 3, by the recipients listed there. Under Article 3 you may request access, copies, correction, stopping collection or use, and deletion.
Japan (Act on the Protection of Personal Information). Japan's Act is our home law. The business operator handling personal information is WANG PENG YUAN (trading as Hibira, formerly Hikibi), who is also the person responsible for it; our address is given without delay on request. We use personal information only for the purposes in section 1. We provide it to third parties only as section 3 describes or as the law permits. Our servers are in Hong Kong and our database is in Singapore, and some recipients are in the United States; we take security measures with the personal data protection systems of those countries in mind. Information on those systems is available from the Personal Information Protection Commission website, and each recipient is bound by contract to protect the data. Our security measures are in section 5. Requests for notice of purposes, disclosure (including records of provision to third parties), correction, suspension of use, deletion or stopping provision to third parties go to [email protected]; we do not charge a fee. Complaints go to the same address, and you may also contact the Personal Information Protection Commission (ppc.go.jp).
Korea (Personal Information Protection Act). Items collected: email, name (optional), service usage records, access logs, IP address, payment records. Retention follows section 1; on expiry we destroy electronic files so they cannot be recovered. Overseas transfers: the recipients, countries, items and purposes are in section 3; data is transferred over the network when the Service is used, and kept for the periods in section 1. You may refuse the transfer, but then we cannot provide the Service. Personal information protection officer: WANG PENG YUAN, [email protected]. You can also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118).
Hong Kong (Personal Data (Privacy) Ordinance). Our servers are in Hong Kong. For Hong Kong residents this policy is our Personal Information Collection Statement, and the regulator is the Office of the Privacy Commissioner for Personal Data (pcpd.org.hk). Supplying data is voluntary except where marked required. You may request access to and correction of your data at [email protected]; we may charge a reasonable fee for access where the Ordinance allows. We do not use your data for direct marketing without your consent.
Singapore (Personal Data Protection Act). Our Data Protection Officer is reachable at [email protected]. You may withdraw consent by notice, and we will tell you the likely consequences before acting on it.
Thailand (Personal Data Protection Act B.E. 2562 (2019)). We process your data on the bases in section 1: contract, legitimate interests, legal obligations and, for analytics cookies and browser notifications, your consent. Your data is transferred to Hong Kong, Singapore, Japan and the United States (sections 3 and 4) under contracts that require an adequate level of protection, as sections 28 and 29 of the Act allow. You may request access, a copy, data portability, correction, deletion, restriction or objection, and withdraw consent, at [email protected]. If a breach is likely to put your rights at risk, we notify the Office of the Personal Data Protection Committee within 72 hours of learning of it, and tell you without delay where the risk is high. You may complain to the Office of the Personal Data Protection Committee (pdpc.or.th).
Vietnam (Law on Personal Data Protection No. 91/2025/QH15). We process your data for the purposes in section 1; consent to analytics cookies and browser notifications is asked for separately and can be withdrawn at any time. Your data is transferred abroad to Hong Kong, Singapore, Japan and the United States (sections 3 and 4) for those purposes. You may request access, a copy, correction, deletion, restriction or objection, and withdraw consent, at [email protected]; we answer within the time the law requires. If a breach occurs, we notify the competent authority within 72 hours of learning of it. You may complain to the personal data protection authority of the Ministry of Public Security (Department of Cybersecurity and High-Tech Crime Prevention, A05).
European Economic Area and United Kingdom (GDPR). The legal bases are in section 1. You may complain to your local supervisory authority.
United States (California Consumer Privacy Act and other state privacy laws). We do not sell personal information or share it for cross-context behavioural advertising; we use Google Analytics only to measure how the website is used. You can opt out of analytics from "Your privacy choices" in the footer or with a Global Privacy Control signal. You may ask to know, correct or delete your personal information at [email protected], and we will not treat you differently for doing so.
Mainland China. We do not offer CNY pricing or host data in mainland China. If you are in mainland China, using the Service means your data is processed outside it as described in section 4.
8. Children
The Service is for businesses and developers and is not directed at children under 16. We delete data we learn was collected from a child.
9. Changes
We will post changes here with a new effective date and email account holders about material changes at least 30 days before they apply.
10. Contact
[email protected] · WANG PENG YUAN (Hibira), Japan. Our address is given without delay on request.