Privacy Policy

1. Introduction

Couch Potato Co., Ltd. (株式会社Couch Potato), operating DocDecay ("we," "our," or "the Service"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our document freshness monitoring service.

2. Information We Collect

Account Information

• Email address
• Organization name
• Name (as provided through OAuth)

Document Metadata

When you connect a platform (Notion, Google Drive, or Confluence), we collect document metadata including:

• Document titles
• Last edited timestamps
• Document URLs
• Access frequency metrics

What We Do NOT Store

We do not store the full content of your documents. Document content is processed transiently for AI-powered change analysis and is not persisted in our database.

OAuth Tokens

OAuth access tokens and refresh tokens required to connect your platforms are encrypted using AES-256-GCM encryption before storage. They are never stored in plaintext.

3. How We Use Your Information

• Calculate document freshness scores
• Send decay alerts and notifications
• Generate freshness reports
• Improve and maintain the Service
• Process payments through Stripe

4. Data Security

We implement the following security measures:

• Encryption: OAuth tokens are encrypted with AES-256-GCM
• Row Level Security: Supabase RLS ensures organizations can only access their own data
• HTTPS: All data in transit is encrypted via TLS
• Access Control: Role-based access within organizations (owner, admin, member)

5. Data Retention

We retain your data for as long as your account is active. Scan history is retained for 12 months. Upon account deletion, all associated data — including document metadata, scan results, alerts, and encrypted tokens — is permanently deleted within 30 days.

6. Your Rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Deletion: Request permanent deletion of your account and all associated data
• Export: Export your document scores and scan history
• Correction: Update or correct your account information
• Portability: Receive your data in a machine-readable format

7. GDPR & CCPA Compliance

For EU residents (GDPR) and California residents (CCPA), you have additional rights including the right to object to processing, the right to restrict processing, and the right not to be subject to automated decision-making. We do not sell your personal data to third parties. To exercise any of these rights, contact us at support@docdecay.app.

8. Cookies

We use essential cookies for authentication and session management. We use Vercel Analytics for aggregated, privacy-friendly usage analytics — this does not use cookies and does not track individual users. We do not use third-party advertising cookies.

9. Third-Party Services

We use the following third-party services:

• Supabase: Database and authentication
• Stripe: Payment processing
• Anthropic (Claude): AI-powered document change analysis
• Vercel: Application hosting and analytics

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related inquiries, contact us at: support@docdecay.app

Couch Potato Co., Ltd. (株式会社Couch Potato)
〒183-0027 東京都府中市本町2丁目31-13 東急ドエル府中ビレジII 105