Privacy Policy
First published: August 23, 2016 Last updated: October 15, 2026 (effective date)
REBLUE INC. ("we", "us") sets out how we handle information about users of NobodySurf in this Privacy Policy.
1. Services covered
This Privacy Policy applies to the following (the "Services"):
- The NobodySurf app for iPhone and iPad
- The NobodySurf app for Apple TV
- The NobodySurf app for Android TV (once released)
- Our website (https://nobodysurf.com)
Purchases at NobodySurf Shop (https://shop.nobodysurf.com) are covered by the privacy policy published on that shop.
2. Who we are and how to contact us
- Business name: REBLUE INC.
- Contact: info@nobodysurf.com
We will provide our address and the name of our representative without delay upon request to the contact above.
3. Information we collect and why
| Information | How we collect it | Why we use it |
|---|---|---|
| Device identifier (an ID created by the app) | Created when you first open the app and stored on your device and in your Apple Account's iCloud | To connect you to the Services, prevent abuse, and analyze usage and crashes |
| Account information (name, email address, Apple or Google account ID) | Received from Apple or Google when you sign in with them | To provide your account, sync your playlists and saved videos across devices, and respond to your inquiries |
| Subscription information (App Store transaction ID, product, period, renewal status) | Received from the App Store when you join or renew Supporters Club | To verify your subscription and provide its benefits. We do not receive your credit card or other payment details |
| Content you create (playlist name, description, display name, cover image; saved videos) | When you enter or choose it | To provide playlists and saving. Public playlists can be viewed by anyone |
| Viewing history (videos played, time played, etc.) | When you play videos in the app | To improve the Services and create statistics |
| Reports (the reporting user's number and the reported playlist) | When you report a playlist | To handle reports |
| Usage information (screens viewed, interactions, app version, OS version, device model, approximate country or region) | Collected through Google's Firebase and Google Analytics when you use the apps and website | To improve the Services |
| Crash logs (records of app crashes and device state) | Collected through Google's Firebase Crashlytics when the app crashes | To investigate and fix bugs |
| Notification information (notification registration) | When you allow notifications | To send announcements |
| Server records (date and time, feature accessed, result, processing time, app and OS version, country) | When you access our servers | To investigate outages and prevent unauthorized access. We do not record IP addresses or the content you send |
The following stays on your device and is not sent to us:
- The contents of your clipboard, read only when you tap the paste button the first time you open the app (used only to open a video you chose on our website)
- On-device translation (using Apple's translation features)
- Your photo library (only the image you choose as a cover is sent)
4. Users in the EU, the European Economic Area, the UK and Switzerland
- We collect usage information and send crash logs only with your consent. The app asks for your consent the first time you open it, and only people aged 16 or older can consent. You can withdraw your consent at any time in the app's Settings. On our website, you can choose in the cookie consent banner and change your choice from "Cookie settings" at the bottom of the page
- The Apple TV app does not collect usage information or send crash logs
- Our legal bases for processing personal data are:
- Performance of a contract: providing your account, subscription, playlists and saving
- Legitimate interests: operating the Services securely, preventing abuse, investigating outages and creating viewing statistics
- Consent: usage analytics, crash reporting and website cookies
5. Disclosure to third parties
We do not provide your personal information to third parties except in the following cases. We do not sell your personal information.
- With your consent
- When required by law
- When necessary to protect a person's life, body or property and it is difficult to obtain your consent
- When we entrust the handling of personal information to service providers to the extent necessary for the purposes above (including the companies in the next section)
6. Information sent to other companies
The Services send your information to the following companies. This section also serves as our public notice on external transmission under Japan's Telecommunications Business Act.
| Recipient | Information sent | Purpose | Their policy |
|---|---|---|---|
| Google LLC (Firebase Analytics, Google Analytics, Google Tag Manager) | Usage information, device identifier, app instance ID, cookie IDs (website) | Usage analytics | Google Privacy Policy, How Google uses information from sites or apps that use its services |
| Google LLC (Firebase Crashlytics) | Crash logs, device state, device identifier | Investigating and fixing bugs | Same as above |
| Google LLC (Firebase Cloud Messaging, Remote Config) | App instance ID, notification registration | Sending notifications and app settings | Same as above |
| Google LLC (Google Sign-In) | Sign-in requests | Signing in with a Google account | Same as above |
| Google LLC (YouTube) | IP address, device and playback information, YouTube cookies | Playing YouTube videos. The Services use YouTube API Services, and the YouTube Terms of Service apply | YouTube Terms of Service, Google Privacy Policy |
| Apple Inc. (Sign in with Apple, App Store, notifications) | Sign-in requests, subscription transactions, notification registration | Signing in, verifying subscriptions, sending notifications | Apple Privacy Policy |
| Vimeo, Inc. | IP address, device and playback information | Playing Vimeo videos | Vimeo Privacy Policy |
| Cloudflare, Inc. | IP address, device information | Delivering videos in the Apple TV app | Cloudflare Privacy Policy |
| Amazon Web Services, Inc. | Information handled by the Services (operating servers and databases, sending report emails) | Operating the Services (service provider) | AWS Privacy Notice |
| Google LLC (Google Cloud) | Database backups (stored in Tokyo) | Backups for recovery (service provider) | Google Cloud Privacy Notice |
| Slack Technologies, LLC | Transaction IDs when a subscription check fails | Investigating subscription issues (service provider) | Slack Privacy Policy |
YouTube videos on our website are shown in YouTube's privacy-enhanced mode (youtube-nocookie.com).
7. International transfers
Many of the companies above are located in, or store information in, the United States. Our servers and databases are in the United States (Oregon; playlist images in Northern California), and our backups are stored in Japan (Tokyo).
The United States has no comprehensive federal law equivalent to Japan's Act on the Protection of Personal Information; personal information is protected by state laws and other rules. For information on the U.S. system, see the Personal Information Protection Commission of Japan (in Japanese). Each company handles personal information under its own privacy policy. When we transfer personal data from the EU and similar regions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. How long we keep information
| Information | Retention |
|---|---|
| Account, playlists, saved videos, cover images, subscription information | Until you delete your account (deleted immediately when you do) |
| Viewing history | Unlinked from you when you delete your account and kept only as statistics |
| Database backups | Automatically deleted within 30 days |
| Server records | 3 days |
| Usage information (Google Analytics, Firebase Analytics) | 14 months from your last use |
| Crash logs | 90 days |
| Report emails | As long as needed to handle the report |
9. Deleting your account
You can delete your account at any time from Settings → Account → Delete Account in the app. We immediately delete your account, the playlists you created (including cover images), your saved videos and your subscription information, and revoke Sign in with Apple. Your viewing history is unlinked from you and kept only as statistics. It is deleted from backups within 30 days.
To cancel a subscription, use the subscription settings of the App Store. Deleting your account does not cancel your subscription automatically.
10. Your rights and how to make a request
You may request disclosure, correction, addition, deletion, suspension of use, or suspension of provision to third parties of the personal information we hold about you. If you are in the EU or a similar region, you also have the rights to data portability, to object to processing and to withdraw consent, and you may lodge a complaint with the supervisory authority in your country.
Please contact info@nobodysurf.com. After confirming your identity, we will respond without delay in accordance with applicable law.
11. Tracking and advertising
The Services do not track you across other companies' apps or websites, and do not collect the advertising identifier (IDFA). We do not show our own ads in the Services (YouTube may show its own ads in YouTube videos).
Our website does not respond to browser Do Not Track signals. If you are in the EU or a similar region, you can stop analytics with the cookie consent described above.
12. Turning off notifications and analytics
- You can turn off notifications at any time in the notification settings of your device's Settings app
- You can turn off usage analytics and crash reporting in the iPhone and iPad app at any time with "Analytics & Crash Reports" in the app's Settings
13. Children
The Services are not directed to children under 13. If we learn that we have collected personal information from a child under 13, we will delete it promptly.
14. Security
We take the following measures to prevent leakage, loss or damage of personal information:
- Encryption in transit (TLS)
- Managing access to our servers and databases, and managing credentials
- Verifying identity at sign-in (validating Apple and Google ID tokens)
- Designing our server records so that they do not contain IP addresses or the content you send
- Selecting service providers and checking their security measures
15. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in laws or the Services. We will notify you in the Services of significant changes. The updated Privacy Policy takes effect when it is posted on this page.