Privacy Policy

1. Operator

• Operator: 重吉　哲弥 (independent developer)
• Contact: movie.pingpong@gmail.com

2. Our approach

Event, Schedule and Entry Forms run entirely in your browser. Nothing you read is sent to our servers; everything happens inside your own Google account. the Attendance tool is the exception - we hold that data (see its own section below).

3. How we handle Google user data

With your permission, DROPPER accesses Google services within the following scopes.

• All of this data is processed inside your own Google account. We never receive any of it.
• drive.file is limited to files this app itself creates. It cannot see the rest of your Google Drive.
• Temporary files created for text recognition (OCR) are deleted immediately after the text is read.
• These scopes have been reviewed by Google (OAuth verification) and were approved in July 2026.

4. About the AI feature

• Using AI is opt-in. After you sign in, a dialog asks you to choose "Use AI" or "Do not use AI".
• Only if you choose "Use AI" is the file (images are reduced in size) sent through our relay server (Cloudflare Workers) to OpenAI's API. The API key is provided by us; you do not need to enter one. The relay server stores neither the file nor the AI's answer.
• To keep our costs within a fixed range, we use OpenAI's free allowance, which is given on the condition that OpenAI may use what is sent to improve its AI. This means OpenAI may use the files you send to improve its AI. Please do not use documents that contain personal information.
• Google user data (the text read by Google Drive, and the contents of your Google Calendar or Drive) is never sent to the AI. Only the file you dropped from your own device is sent.
• To prevent overuse, the relay server counts only the amount used that day and the number of requests per mark made from shortened, irreversible connection information, and deletes them the next day (up to 20 event files and 10 schedules per person per day).
• If you choose "Do not use AI", nothing is sent to the AI.

5. Data Sharing and Third-Party Disclosure

Dropper does not sell, share, or transfer your Google user data to us or to any third party. We never receive Google user data in the first place. The data held for the Attendance tool is likewise never sold or shared with third parties.

• The only exception is when you choose "Use AI". Only then is the file you dropped (PDF or image) sent through our relay server to OpenAI's API (section 4). Even then, Google user data is not sent to the AI.
• Data sent to OpenAI is handled in accordance with OpenAI's Privacy Policy.
• Apart from the above, we never disclose Google user data to any advertiser, analytics provider, or other third party.

6. Data Protection

Dropper uses the following mechanisms to protect your data:

• All communication takes place over an encrypted connection (HTTPS).
• For the three tools other than the Attendance tool we store no data, so nothing of yours sits under our control to be breached. The data held for the Attendance tool is protected on Cloudflare's platform.
• Settings (such as whether to use AI) are stored only on your device (in the browser's localStorage). The relay server for the AI feature does not store the files sent or the AI's answers.
• All access to Google services takes place under the authentication and authorization of your own Google account.

7. Data Retention and Deletion

For the three tools other than the Attendance tool we store nothing, so we hold none of your Google user data. Only the following information is stored on your device (in the browser's localStorage), and we cannot access it:

• Whether you chose to use the AI feature
• Information about the destination folder

You can delete this data at any time in the following ways:

• Temporary files created for text recognition (OCR) are deleted immediately after reading.
• Events created in your Google Calendar and event documents or schedules saved to your Google Drive are managed by you and can be deleted from Google at any time (Dropper has no delete function).
• The settings stored on your device can be deleted at any time from your browser settings.
• You can revoke Dropper's access to your Google account at any time from your Google Account security settings.

8. Pricing

DROPPER is provided free of charge, and we do not collect or store any payment information. If this policy changes, it will be revised and the change announced.

9. Compliance with the Google API Services User Data Policy

DROPPER's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

10. Changes to This Policy

Any changes to this policy will be posted on this page. If a change is significant, it will also be announced within the tool.

11. About the LINE official account version

The LINE official account "Dropper" reads images and PDFs sent in the chat and returns the result. For this feature only, the processing goes through our server (Google Apps Script); in the browser version, only the files sent when you use the AI feature go through our server (section 4). The handling is as follows.

• We do not store the images or PDFs you send. They are sent to Google's Gemini API for reading and discarded as soon as processing finishes.
• We do not store the extracted content (event name, dates, venue, etc.) either. It is returned to you in the reply and embedded in the link used to add the event to your calendar.
• The operator's own API key is used for these requests. Because it runs within the free tier, there is a daily limit per person.
• To understand usage, we record only the date and time, the type of item sent, the result, the time taken, and a hashed string derived from your LINE user identifier (first 8 characters only). The original identifier cannot be recovered from this string.
• We do not obtain your LINE profile information (display name, profile image, phone number, etc.).
• Data sent to the Gemini API is handled according to Google's policies. When used within the free tier, the content sent may be used to improve Google's services.

About the Attendance tool (we do hold this data)

Of the tools in this series, only the Attendance tool stores data on our server. Attendance means several people writing from different devices and everyone seeing the same result, which cannot work inside one browser. The other three tools (Event, Schedule, Entry Forms) still run entirely in your browser and we receive nothing.

• What we hold: the group name, the roster (names and gender), event details (title, dates, venue), the replies, and a random id used to recognise a device.
• What we do not hold: email addresses, phone numbers, postal addresses. People replying never log in or create an account.
• Where: Cloudflare D1. Servers may be located outside Japan, so data may be transferred abroad.
• Deletion: the organiser can delete the group, roster, events and replies at any time from "Delete this group" in the admin screen. Deletion cannot be undone.
• Retention: data for groups with no activity for a long period may be deleted after notice.
• Who can see what: anyone with the shared URL (the group id) can see the roster names and the counts. Who has not replied is shown only on the organiser’s screen.

About the Entry Form Dropper (it handles your roster)

The Entry Form Dropper handles a tournament entry form and your club roster, which is personal data. Both are processed only inside your browser and are never sent to our server (we have no server, so we cannot receive them). No login is required.

• What it handles: the entry form (an Excel file) and the roster (names, readings, dates of birth, postcodes, addresses, phone numbers). The filled-in file is also produced on your own device.
• Nothing is stored: the roster is not saved in your browser. It disappears when you close the page. Please keep the roster as a file of your own.
• No AI is used: which value goes in which column is decided from the wording of the form’s own headings (“Date of birth”, “Address” and so on).
• There are only three network requests, and none of them send the names, addresses or phone numbers you entered.
• (1) Postcode to address and (2) address to postcode: the tool loads postcode data files hosted on this site (Japan Post’s public data). It loads a file; it does not send the postcode or address you typed.
• (3) Importing the group name, names and sex from the attendance system: only the group ID is sent to the attendance system. The contents of your roster are never sent. What is imported is then handled inside your browser only, as above.

About the Playground (The Lantern Museum)

The Lantern Museum in the Playground (dropper-tools.com/en/play/spirit.html; renamed from "Monster Dropper" and "Spirit Dropper" in October 2026) is a game that turns museum artworks into spirit cards. Your own photos and files are not used. The artworks were chosen by us from works that The Met, the Art Institute of Chicago, the Cleveland Museum of Art and the Rijksmuseum (Amsterdam) release for anyone to use freely (CC0 or public domain), and are hosted on this site. Works showing people's faces or figures, clear writing or logos were left out. The only images you can add yourself are the key photo for door 3 of the Night Museum and the image or photo you put in the last room's video (see "What it handles" and item 7 below). No sign-in is needed.

• What it handles: artwork images are loaded from this site (no connection is made to the museums; a museum's page opens only when you press an artwork's name). Behind the picture on the card, the artwork it came from is drawn darkened, and part of the artwork image is added with light noise; this is saved together with the card. The only images you can drop yourself are the key photo for door 3 in Light the Night Museum (item 7 below; a photo you take of a light near you) and the image or photo you put in the last room's video. An image that does not fit the key is recognised by its brightness on your device and turned away without anything being saved. These images are not sent to any AI. (On 1 November 2026 we stopped using life-record images from "1 in 8 billion" as the key to the last door.)
• What is stored: the cards you make (form, radiance, a small picture and the name of the artwork they came from) and a per-device number are stored only on your device (in your browser's IndexedDB). A mark showing whether you have seen the opening film is also kept only on your device (in localStorage), so that it does not play again. Images you drop are not stored. We cannot see any of this.
• How to delete: open a card and press the button that removes it to delete that one card, press the button that clears the catalogue to delete them all, or delete this site's data in your browser settings.
• About AI: neither your images nor the contents of your cards are sent to any AI (on 25 October 2026 we removed the option that let the AI read the text on a life record, and the feature where the AI wrote a name and story when spirits were bound). AI is used only once a night, when you have lit all four galleries and enter the last corridor in Light the Night Museum (item 7 below), so the story for the last room's video is ready before you pass through the door. At that moment, the numbers (file names) of the artworks of that night's spirits, the spirits' names and the page language are sent to our relay server (Cloudflare Workers). The relay server adds the artwork titles and backgrounds we prepared and the artwork images (CC0 works released by the museums and hosted on our site), sends them to the API of OpenAI (USA), and the AI writes that night's story (a title and captions) and a plan for the music. Key images and the image or photo you put in the last room are never sent. The API key is provided by us; you do not need to enter one. The relay server stores neither what is sent to the AI nor its answer. To keep our costs within a fixed range, we use OpenAI's free allowance, which is given on the condition that OpenAI may use what is sent to improve its AI. This means OpenAI may use what is sent (including the spirits' names) to improve its AI. To prevent overuse, the relay server counts only the amount used that day and the number of requests per mark made from shortened, irreversible connection information, and deletes them the next day.
• Analytics: as on other pages, page views are counted with Google Analytics (section 12). In addition, only the counts of opening films started, skipped or watched to the end (on the first visit), museums chosen to lay out artworks, spins of the “Let the wheel pick” roulette, spirits awakened and bindings are sent. Images, names and card contents are never sent.
• Light the Night Museum (dropper-tools.com/en/play/night.html; it replaced Battle in October 2026): it only reads the cards in your catalogue on your device (it does not change them). Card contents are not sent anywhere, except the spirits' names and artwork numbers sent to the AI when you enter the last corridor ("About AI" above). The last door (the Door of Light) opens without a key. The light you kindle gathers in a Lantern Vessel, and on a night when it is full, the spirit you choose from those you brought becomes tonight's guardian (from 1 November 2026). The key image for door 3 (a photo of a light) is only recognised on your device by its brightness, and shown on the walls of that room for that night only (on screen only); it is not sent to any AI or to us, and is not saved. The number of nights you played (how many times you reached Dawn or a Quiet Morning), the lights in your Lantern Vessel and how many times it filled, the spirit you last chose as guardian (to show it first next time) and how many nights each spirit served as guardian, how many nights each spirit has come with you to the Night Museum (shown on catalogue cards as “nights spent together”, from 8 November 2026), the frames you received by lighting galleries, and a copy of the spirit in each frame (its name, rarity, small card picture, description, and the title and story of the museum artwork it was born from, so it stays in the last corridor even if you empty your catalogue), and tonight's progress (the spirits you brought, the galleries you lit and the frames you received, so you can continue later the same day; it is cleared when morning comes) are kept only on your device (in your browser's localStorage). The catalogue page only reads which spirits are framed or have served as guardian, the nights spent together, and the Lantern Vessel, to show marks and the vessel. Deleting this site's data in your browser settings removes them. The 55-second video of the last room is made on your device from that night's artwork images, the small pictures of your spirit cards, the small picture and name of tonight's guardian (on nights with one), footage we prepared in advance and music synthesised on the spot. The video is not sent anywhere; it is saved to your device only when you press "Save the video". An image you drop after choosing "My image on the walls" in the last room (one image) is only shown on the walls of that video, on your device. It is not sent to any AI or to us, and is not saved (it does appear in the video if you press "Save the video"). The same goes for the photo you take or choose with "Your photo in the light" in the last room (one photo; a selfie or one you already have): it is only shown in the middle of the pillar of light in that video, on your device. It is not sent to any AI or to us, and is not saved (it does appear in the video if you press "Save the video"). You can also take the photo of a light for the third door and "Your photo in the light" with the camera, using "📷 Take one now" on the page (from November 2026). The camera picture is only shown on screen on your device; apart from the one photo you take, nothing is kept, and nothing is sent anywhere. The camera is used only while the photo screen is open and stops as soon as you close it (your browser asks you before the camera is used, and you can withdraw this at any time in your browser settings). For analytics, only the counts of nights started, of last doors opened, of Dawns and Quiet Mornings reached of frames received and of taps on “Share tonight's record” or on sharing the video are sent. “Share tonight's record” on the morning screen (from November 2026) makes one image of the night (spirit names, rooms lit, the works in your frames, the tale's title, the guardian, a picture of the Lantern Vessel) on your device. You decide whether and where to share it (on phones through your device's share screen, on PCs by saving the image and opening the X post screen). It is not sent to us or kept. “Morning souvenir” on the morning screen (from November 2026) picks one of tonight's spirits' works with a roulette and makes a postcard image (the spirit's name, the work, the museum's name and the date) on your device. You decide whether to save it and where to share it; it is not sent to us or kept (only the number of spins and share presses goes to analytics). “Tonight's Gift” at the start of a night (from November 2026; a roulette, once a day) keeps which gift you received that day only in your browser on your device, with the other records (it is not used the next day); it is not sent to us, and only the number of times a gift was received goes to analytics. Door key images, last-room wall images and your photo are never included in this image. The video made in the last room can also be passed on: on phones to your device's share screen from “Share to Instagram or X”, on PCs by saving the video and opening the X post screen from “Share on X” (you decide where it goes; it is not sent to us).

12. Analytics

Dropper uses the following tools to understand site usage for the purpose of improving the service. These handle statistical information about site browsing and are unrelated to the contents of your Google Calendar or Drive (Google user data).

• Google Analytics: collects statistics such as page views and referrers using cookies. The information collected is anonymized usage statistics and does not identify individuals. Data is handled in accordance with Google's Privacy Policy.
• Visitor counter (hits.sh): counts and displays the number of page views. It does not use cookies.
• If you do not wish to allow cookies, you can disable them in your browser settings or use the Google Analytics Opt-out Add-on.

Embedded videos (YouTube)

Some guide pages embed a YouTube video. The video loads from YouTube (Google) in privacy-enhanced mode (youtube-nocookie.com) only when you press the play button; nothing is sent to YouTube before that. After you press it, Google's privacy policy applies.

13. Contact