Privacy Policy

Effective September 19, 2026

1. Who we are

Stockless is operated by GROW&PEACE K.K. (“we”, “us”). This policy explains what data we collect, how we use it, and the choices you have. It applies to the Stockless app and website. Our contact details are set out in Section 12.

2. Data we collect

  • Account data. When you sign in with X (OAuth, read-only), we receive your X account identifier and basic profile details needed to create and identify your account.
  • Content you submit. The X posts you share to Stockless, including the post URL and its text, which we retrieve and process to generate an Action and a Prompt. Shared posts may contain information about other people; we process such content only to provide the Service.
  • Bookmarked posts. With your permission (the bookmark.read scope you grant when signing in with X), we access your X bookmarks. We import your 3 most recent bookmarks when you sign up and check for new bookmarks every 12 hours, and we store each post’s URL and text to generate an Action and a Prompt. Bookmark Sync is on by default; you can turn it off at any time in Settings, after which we stop accessing your bookmarks.
  • Subscription status. Whether you are on Free, Standard, or Pro, derived from Apple’s App Store. We do not receive your full payment card details.
  • Device and notification data. If you enable push notifications, a device token so we can notify you when an action is ready.
  • Usage data. Basic logs and diagnostics needed to operate, secure, and improve the Service.

Special-category / sensitive information. We do not intentionally collect sensitive personal information (“yo-hairyo” personal information under Japanese law, or special-category data under the GDPR). Because shared posts may contain such information about you or others, you should use the Service only where you have the necessary rights or consent, and we process any such content solely to the extent necessary to provide the Service.

3. How we use your data

We use your data to: provide the core Service (turning posts — including bookmarks you choose to sync — into Actions and Prompts); authenticate you; enforce plan quotas and process subscriptions; send notifications you have enabled; secure the Service and prevent abuse; and comply with legal obligations. We do not sell or share (as those terms are defined under applicable law) your personal data, and we do not use your personal data for cross-context behavioral advertising.

4. Service providers we share data with

We share data only with providers that help us run the Service, under contractual safeguards:
  • Supabase — authentication and database.
  • xAI (Grok) — retrieves and processes shared post content to generate Actions and Prompts. xAI processes this content on our behalf solely for that purpose and does not use it to train its models.
  • Apple — subscription purchases and status via the App Store.
  • Vercel — application hosting and delivery.
  • X — we access your X account and, if enabled, your bookmarks through the X API under X’s developer terms; X receives our API requests, including your X account identifier.
The AI tools you choose to run a Prompt in (e.g., ChatGPT, Claude, Gemini) receive the content you send them and are governed by their own privacy policies.

5. Data retention

We retain your account data and submitted content for as long as your account is active. When you delete your account, we delete your actions and disconnect your X connection, and we delete the associated personal data within 30 days, except for limited data we are required to keep for legal, security, or backup purposes. Residual copies held in encrypted backups are overwritten on our regular backup cycle, within 90 days.

Bookmarked posts are retained like other content. When you turn Bookmark Sync off, we stop accessing your bookmarks and delete any imported posts that have not yet been processed. If a post is deleted on X, we delete our stored copy upon request within 24 hours.

6. Your rights and choices

You can delete individual actions at any time from within the app, and you can ask us to delete your account and all associated data by contacting us using the details in Section 13. You can turn Bookmark Sync off at any time in Settings, and you can revoke Stockless’s access entirely from your X account settings (Connected apps). Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to restrict or object to certain processing. To exercise these rights, contact us using the details in Section 13. Before acting on a request, we will verify your identity (for example, by confirming control of the X account or email associated with your account), and we will respond within the period required by applicable law. We do not charge a fee for reasonable requests.

7. International transfers

We transfer and process personal data in the United States, where our service providers (Supabase, xAI, Apple, and Vercel) operate.

For users in Japan: we make this cross-border transfer with your consent. Before you consent, we provide (in the Appendix at the end of this policy): (i) the name of the destination country (the United States); (ii) information, obtained by appropriate and reasonable means, on that country’s personal-data protection regime; and (iii) the measures each recipient takes to protect personal data — in accordance with Article 28 of the Act on the Protection of Personal Information (APPI). Where a recipient maintains a system conforming to APPI standards, we may instead rely on that basis and provide information on the measures taken on request.

For users in the EEA/UK: where we transfer personal data outside the EEA/UK, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or the EU-U.S. / UK Data Privacy Framework where applicable. You may request a copy of the relevant safeguards using the details in Section 13.

8. Security

We use industry-standard measures, including encryption in transit, to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Where we store or process personal data outside Japan (in the United States), we take account of that country’s data-protection regime (“understanding of the external environment”) and implement contractual safeguards, access controls, and encryption accordingly. Further information on our security measures is available on request.

9. Additional information for EEA/UK users (GDPR)

Legal bases. We process your personal data to perform our contract with you (providing the Service), for our legitimate interests (securing and improving the Service, preventing abuse), to comply with legal obligations, and, where required, on the basis of your consent (for example, for push notifications and cross-border transfers). You may withdraw consent at any time.

Your GDPR rights include access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. If we offer the Service to individuals in the EU/UK, our EU/UK representative under Article 27 GDPR is: GROW&PEACE Article 27 Representative (to be appointed), contactable at corp@grow-peace.jp.

10. Your California privacy rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it, to access and delete your personal information, to correct inaccurate personal information, and to opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information, and we do not use or disclose sensitive personal information beyond the purposes permitted under the CCPA. We will not discriminate against you for exercising your rights.

The categories of personal information we collect are: identifiers (e.g., X account identifier, device token); internet or other electronic network activity (usage logs and diagnostics); commercial information (subscription tier); and the user content you submit. To exercise your rights, contact us using the details in Section 13.

11. Children

The Service is not directed to, and we do not knowingly collect personal data from, children under 13 (or the higher minimum age of digital consent that applies in your country — for example, 16 in parts of the EU). In addition, our Terms of Use require users to be at least the age of majority (18 in Japan) or to use the Service with the consent of a person with parental authority. If you believe a child has provided us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will reflect changes by updating the effective date above, and for material changes we will provide notice within the app before the changes take effect and, where required by law, obtain your consent.

13. Contact

GROW&PEACE K.K.
Wind Ebisu Building 8F, 2-4-8 Ebisu-nishi, Shibuya-ku, Tokyo 150-0021, Japan
Representative Director: Ko Toguchi
Email: corp@grow-peace.jp

For data-protection inquiries, disclosure requests, or complaints, please contact us at the email address above.

Appendix — Cross-border transfer information (Japan / APPI Article 28)

This Appendix provides the information required under Article 28 of the Act on the Protection of Personal Information (APPI) for users in Japan, before you consent to the transfer of your personal data outside Japan.

(i) Destination country. The United States, where our service providers (Supabase, xAI, Apple, and Vercel) store and process personal data on our behalf.

(ii) The destination country’s personal-data protection regime. Based on information obtained by appropriate and reasonable means (including publicly available resources such as the guidance published by the Personal Information Protection Commission of Japan), the United States has no single comprehensive federal data-protection law equivalent to the APPI or the GDPR. Protection is provided through a combination of sector- and state-specific laws (for example, the California Consumer Privacy Act as amended by the CPRA) enforced by authorities such as the Federal Trade Commission and state attorneys general, rather than by a single national data-protection authority. The United States participates in the EU-U.S. / UK / Swiss Data Privacy Framework. There is no APPI adequacy designation for the United States as a whole.

(iii) Measures taken by the recipients. Each recipient processes personal data under a written data-processing agreement that restricts use to providing the Service on our behalf, and implements safeguards including encryption in transit, access controls, and organizational security measures. Where a recipient maintains a personal-information-handling system that conforms to APPI standards, we may rely on that basis instead, and we will provide information on the measures taken on request.

To request further information about any recipient or the safeguards in place, contact us using the details in Section 13.