Privacy Policy

COCO ROOM Privacy Policy
Established: September 26, 2026
Last revised: October 4, 2026
Operator: Ritoa Co., Ltd.

1. Information we handle and why
We use identifiers and email addresses obtained through Google sign-in for authentication and management of the shared COCO account. We use profiles, friend and block information, and ROOM hosting and participation information for online features. We use reports, optional attached images, the reporter's ID and receipt time to review and respond to problems. When you join or host from a web browser, we use the connection information (network information including your IP address) only to establish that connection.
For ROOM groups, we store the group name, the first ROOM's URL, the members (accounts and player names), join requests, whether a room is open now, and the order people entered a room (to choose who is asked to take over as host), in order to run groups and hand over hosting.

2. Sharing with other participants
For visit counts on public posts, we send a hash of the URL when a ROOM loads successfully and store only a count for each post. We do not use visitors' accounts or device identifiers for this count. Repeat visits, reloads and visits by the creator are included. Deleting a post also deletes its visit count.

Depending on the feature, player names, avatars, ROOM data, chat, positions and actions may be sent to other participants. Do not include personal information you do not wish to share. When you host from a web browser, the ROOM file and guests' player names, avatars, chat and positions are relayed to the other participants through the host's browser (we do not store them on our servers). The report form does not automatically send chat history.
A group's name, first ROOM URL, members and their player names, and the player names of people who have asked to join are shown to the group's members. Anyone who knows the invitation QR or URL can see the group's name and member count.

3. External services
We use Google for authentication and Epic Online Services for online communication. Opening a ROOM URL connects to its file host, which may collect access information such as your IP address. The policies of those external services also apply.

When you join or host from a web browser, the browser, the host (the app or another web browser) and the guests communicate directly using WebRTC. A direct connection can reveal each side's IP address and other network information to the other; a host learns every guest's. To establish the connection, they also contact Google's public STUN servers (stun.l.google.com and stun1.l.google.com); this sends IP addresses and similar information to Google. Connection information is passed through our account server and deleted once the connection is established or the ROOM ends; if a connection cannot be established, it is deleted after a short time. Send invitations only to people you trust.

4. Information on your device
We save your sign-in state, settings, and downloaded ROOMs and avatars on your device. For image attachments, we send only the image you select. The camera is used to scan QR codes. In a web browser, we keep your sign-in state in the browser until you sign out (on a shared computer, please sign out when you are done), and save settings such as language, control layout, whether the chat panel is open, and the ROOMs you opened in the browser. When a web browser scans an invitation QR code, the camera image is processed on your device only and is neither sent nor saved.

5. Retention and security
We retain information for as long as needed to provide the service, respond to inquiries or reports, and maintain security, then delete or anonymize it when no longer needed. We may retain records required for legal compliance or responses to misuse. Backup data is deleted as backups are updated. We restrict access and protect communications.
A group is deleted when its last member leaves. When an account is deleted, the account is also removed from groups' members and join requests.

6. Requests about your information
You can delete your shared account and posts from the account screen. Contact us below to request access to or correction of your information. We respond after verifying your identity. Deleting the shared COCO account affects both COCO ROOM and COCO CHARA, but does not delete your Google account.

7. Contact and changes
Changes to our handling of information will be posted in this policy and announced when appropriate.
Contact: support@cocochara.ritoa.jp