Privacy policy

Last updated: 21 October 2026

This page explains what personal information this site collects, why, and what you can do about it. It covers Japan's Act on the Protection of Personal Information (APPI) and the EU and UK GDPR.

Who runs this site

Hafu Games is run by Thomas Ishikawa, an independent developer in Japan. Our postal address is available on request at hello@hafugames.com. Hafu Games is responsible for your personal information here. The same address handles every privacy question, request and complaint.

What we collect and why

• Newsletter signups. When you sign up, we store your email address, the time you signed up, which version of the signup form you saw, the page you signed up on, your language setting, and (if you came from one of our links) a short tag saying which link. We use your address only to send you news about Ocha Kai: development updates and release and store announcements. The other details let us prove you asked to hear from us.
• Contact messages. When you email us or use the contact form, we receive your email address, your message, and your name if you give it. We use them only to reply to you. The contact form does not store your message on this site; it is delivered to our mailbox.

We do not ask for anything else, and we do not collect information from other sources about you.

Our legal basis

• Newsletter: your consent, given when you press the signup button. You can withdraw it any time.
• Contact messages: our legitimate interest in answering people who write to us (GDPR Art. 6(1)(f)), or taking steps you asked for (Art. 6(1)(b)).

Who helps us run the site

We use a few service providers. They handle data only on our instructions.

• Cloudflare, Inc. (United States, with servers worldwide): hosts the site and runs its code (Workers), stores newsletter signups (D1), checks forms for bots (Turnstile), and counts visits (Web Analytics). Like any web host, Cloudflare processes your IP address to deliver pages and to protect the site from attacks.
• Zoho Corporation (Zoho Mail; United States): hosts our mailbox, so your emails and contact messages are stored there.
• Brevo (Sendinblue SAS; France): sends our newsletter. When you sign up, we pass it your email address, and it sends you a welcome email, the newsletters and an unsubscribe link in each one.

YouTube (Google LLC, United States) is not one of our providers. It receives data from you only if you click to play a video, and then under Google's own privacy policy. See Cookies and embeds.

Transfers outside Japan and the EU/UK

Cloudflare and Zoho store or process data in the United States and other countries. The United States has no single national privacy law like the APPI or the GDPR. We protect transfers through contracts: each provider's data processing agreement, which includes the European Commission's Standard Contractual Clauses and commits the provider to protection equivalent to the APPI. Ask us if you want details.

How we keep it safe

• Only the operator can see newsletter signups and the mailbox.
• Accounts with our providers are protected with two-factor authentication.
• We chose providers with strong security records, and the site is served over HTTPS only.
• We delete data when it is no longer needed (see below).

If a leak ever happens, we will tell the authorities and affected people as the law requires.

How long we keep it

• Newsletter signups: until you unsubscribe or ask us to delete them. After you unsubscribe, we keep only what we need to prove you had agreed, for as long as the law requires, and never mail you again.
• Contact messages: deleted 12 months after we receive them.

Your rights

You can ask us to:

• tell you what we hold about you, and give you a copy (in a portable format if you like);
• correct it;
• delete it, or stop or limit using it;
• stop sending you the newsletter, which withdraws your consent.

These cover your rights under the APPI (disclosure, correction and suspension of use) and the GDPR (access, rectification, erasure, restriction, portability and objection). Email hello@hafugames.com; we reply within one month.

If you are not happy with our answer, you can complain to Japan's Personal Information Protection Commission (PPC), to the data protection authority in your EU country, or to the UK Information Commissioner's Office (ICO).

How to unsubscribe

Every email we send, starting with the welcome email, has an unsubscribe link at the bottom. You can also email hello@hafugames.com and we will remove you by hand.

Children

The newsletter is for readers aged 16 and over. This site is not aimed at children. If we learn that an address belongs to a child, we delete it.

Cookies and embeds

• No cookies. This site does not set cookies, so there is no cookie banner.
• Turnstile. Our forms use Cloudflare Turnstile to tell people from bots. It looks at signals from your browser only to detect bots, and we use it without its clearance cookie.
• Web Analytics. Cloudflare Web Analytics counts page visits without cookies and without identifying you.
• YouTube. Videos stay off until you click them. Nothing loads from YouTube before that click. After it, Google's own privacy policy applies to what YouTube collects.

What we never do

We do not sell or share your data, show ads, build profiles of you, or make automated decisions about you.

Changes

If this policy changes, we will update this page and the date at the top.