Privacy Policy

1. Who we are, and what this covers

D24 is an independent software studio based in Tokyo, Japan, and is the controller of the personal data described here. This policy covers the website d24.tokyo and our macOS applications Custom Mouse and Focus Clock. Any other product we release in future will say which policy applies to it.

For anything in this policy, write to hello@d24.tokyo.

2. At a glance

What	Why we have it, and for how long
Nothing from the apps	Custom Mouse and Focus Clock collect no personal data at all: no account, no telemetry, no crash reports, no network connections. There is nothing for us to keep.
Website request data IP address, user agent, URL, timestamp	Processed by our host, Cloudflare, to deliver pages and block abuse. Legal basis: our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)). We do not receive an identifiable copy and do not build profiles. Retained by Cloudflare for its own short operational periods.
Order data name, email, billing country, tax data, payment token	Collected by Lemon Squeezy at checkout to sell and deliver your licence. Legal basis: performance of a contract (Art. 6(1)(b)) and our legal obligations for tax and accounting (Art. 6(1)(c)). We see the order record and your email address — never your card number. Kept for 7 years, the period Japanese tax and accounting law requires.
Support correspondence your email address and whatever you write to us	Used to answer you and to keep a history so we can help you again later. Legal basis: performance of a contract, or our legitimate interest in providing support. Deleted 3 years after our last exchange, unless it relates to an order we must keep for tax purposes.

3. This website

https://d24.tokyo is a static website. It sets no cookies, runs no analytics, tag managers or tracking pixels, and loads no third-party fonts, embeds, videos or beacons. It stores nothing in your browser. There is no advertising, no fingerprinting and no cross-site tracking, so there is nothing here for a “Do Not Track” signal or a cookie banner to act on.

The site is hosted on Cloudflare Pages. As with any web host, Cloudflare processes technical request data — your IP address, browser user agent, the URL requested and the time — in order to serve the page and to protect the service from attack. Cloudflare acts as our processor for hosting, under its own security and data-protection commitments. We do not use that data to identify you, and we do not combine it with anything else.

4. Our apps

Custom Mouse

Custom Mouse, as of version 2.0, makes no network connections. It has no account system, no telemetry, no analytics, no crash reporting and no update check. No personal data leaves your Mac, because none is sent anywhere.

The app needs macOS Accessibility permission, which you grant in System Settings. It uses that permission for exactly two things: to read multi-touch data from your Magic Mouse, and to post click and gesture events to macOS on your behalf. Touch data is processed in memory to recognise a tap, a right-side tap or a pinch, and is then discarded — it is never written to disk and never transmitted. The app does not log keystrokes, read window contents, capture the screen or monitor which applications you use.

Your preferences (sensitivity, zones, launch-at-login and so on) are stored locally on your Mac in the app’s own settings, under your user account. Deleting the app and its preferences removes them.

Focus Clock

Focus Clock, as of version 1.0, makes no network connections. It has no account system, no telemetry, no analytics, no crash reporting and no update check, so no personal data leaves your Mac. It asks for no special macOS permission — not Accessibility, Screen Recording or Input Monitoring.

To notice when an app is full screen, or when you are presenting, Focus Clock reads the list of on-screen windows that macOS offers to every app: each window’s position and size, its stacking order and which application it belongs to. This happens on your Mac, in memory, as the screen changes. It never reads window titles or contents, does not capture the screen, does not record or keep a history of which applications you use, and stores or sends none of it. Its global shortcut (⌃⌥T) is a standard system hot key: the app is told only when that one combination is pressed, and it does not see any other keystrokes.

Your preferences (displays, appearance, sound, shortcut, launch at login, the last timer length and so on) are stored locally on your Mac in the app’s own settings, under your user account. Deleting the app and its preferences removes them.

Future versions

If a future version of either app ever adds a networked feature — an online licence check, an update check, or anything else — we will describe it in this policy and in the release notes before that version ships.

5. Buying a licence

Our apps are sold by Lemon Squeezy, LLC, which acts as the Merchant of Record. That means Lemon Squeezy is the seller in your transaction: it collects your name, email address, billing country, any tax identifiers and your payment details, and it is an independent controller for that processing. We never see or store your card number.

What Lemon Squeezy passes on to us is the order record: your name, email address, the product and order reference, and the country used for tax. We use it to deliver your licence, to answer support requests, and to keep the accounting records Japanese law requires. See the Lemon Squeezy privacy policy for what they do with your data.

6. Email

Mail sent to an @d24.tokyo address is forwarded by Cloudflare Email Routing to a mailbox we operate with Google (Gmail). Both companies therefore process your message in transit and at rest. Email is not a secure channel: please don’t send us passwords, payment details or anything confidential — we will never ask for them.

7. Who else receives your data

• Cloudflare, Inc. — website hosting and email forwarding.
• Lemon Squeezy, LLC — Merchant of Record for purchases.
• Google LLC — the mailbox in which we read and answer support email.

That is the complete list. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not carry out profiling or automated decision-making that produces legal effects for you. We may disclose data if a law, a court or a regulator validly requires it, or to establish or defend a legal claim.

8. International transfers

We are in Japan. The providers above are established in the United States and process data in facilities outside Japan and outside the EEA. Where we or they transfer personal data out of the EEA or the UK, that transfer relies on the safeguards in Chapter V of the GDPR — principally the European Commission’s Standard Contractual Clauses within the providers’ own data-processing terms, and the Commission’s adequacy decision for Japan. Under Japan’s Act on the Protection of Personal Information this is a provision of personal data to third parties in foreign countries, made on the basis of those providers’ equivalent-standard commitments; we will give you information about the countries and safeguards involved on request.

9. How long we keep things

As set out in the table above: order and accounting records for 7 years, as Japanese tax law requires; support correspondence for 3 years after our last exchange; nothing at all from the apps. When a retention period ends, we delete the data or anonymise it.

10. Security

The site is served only over HTTPS and is entirely static, so there is no customer database of ours to breach. The accounts we use for hosting, payments and email are protected with strong, unique credentials and two-factor authentication. No system is perfect; if a breach ever affected your data, we would notify you and the relevant authority where the law requires it.

11. Your rights

If the GDPR or the UK GDPR applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict or object to our processing (including processing based on legitimate interests), and to data portability. If you are in Japan, the Act on the Protection of Personal Information gives you the right to request disclosure, correction, addition, deletion, suspension of use or erasure of your retained personal data, and disclosure of our records of third-party provision.

To exercise any of these, email hello@d24.tokyo. We may need to ask a question or two to be sure the request is really yours. We do not charge for this, and we will reply without undue delay and in any event within one month. For data held by Lemon Squeezy as Merchant of Record, we will either pass your request on or tell you how to make it directly.

You also have the right to complain to a supervisory authority — in the EEA or UK, the authority where you live or work; in Japan, the Personal Information Protection Commission. We would appreciate the chance to sort the problem out first.

12. Children

Our products are not directed at children, and we do not knowingly collect personal data from anyone under 16 (or under 13, where that is the applicable threshold). If you believe a child has sent us personal data, write to us and we will delete it.

13. Changes to this policy

If this policy changes, we will update the page and the “last updated” date at the top. If a change materially affects how we handle your data — for example if a future version of one of our apps starts talking to a server — we will say so prominently at the top of this page, and in that app’s release notes, before the change takes effect.

14. Contact

hello@d24.tokyo · See also our Terms and our business information.