Privacy policy
Last updated: 2026-07-27
Article 1 (Purpose and Scope of this Policy)
- Piece Agency Co., Ltd. (株式会社ピースエージェンシー; hereinafter “we”, “us” or “our”) establishes this Privacy Policy (hereinafter this “Policy”) with respect to the handling of personal information and information relating to users on the website “sitekits.dev” that we operate (hereinafter the “Site”).
- This Policy applies to all information that we collect in connection with the use of the Site. The handling of information on third-party websites or services linked from the Site shall be governed by the terms established by those third parties, and we bear no responsibility for it.
- We comply with the Act on the Protection of Personal Information (個人情報保護法, Act No. 57 of 2003; hereinafter the “APPI”) and other related laws, regulations and guidelines. For users located in the European Economic Area (EEA), the United Kingdom or Switzerland, the provisions of Articles 11 to 14 shall also apply.
Article 2 (Definitions)
The terms used in this Policy are defined in the following items.
- Personal Information — personal information as defined in Article 2, paragraph 1 of the APPI and, where the GDPR applies, including personal data as defined in Article 4(1) of that Regulation.
- the Tools — the various technical utilities that we provide on the Site.
- Local-only Tools — Tools that process the user’s input solely within the user’s device (browser) and transmit it neither to us nor to any other party.
- Our-API Tools — Tools that transmit the minimum values necessary for processing to our API server (
api.sitekits.dev). - External-Communication Tools — Tools that communicate directly from the user’s browser to a destination specified by the user, without passing through our servers.
- Cookies, etc. — cookies, local storage and other technologies that store information on a device, or access information on a device.
Article 3 (Information We Collect)
We collect the information set out in the following items.
1. Information entered into the Tools
The Tools are classified into the following three categories according to the handling of input data, and we shall display that category at all times on the page of each Tool.
| Category | Number of tools | Handling |
|---|---|---|
| Local-only Tools | 68 | We do not collect the content of the input. |
| Our-API Tools | 7 | We collect only the values necessary for processing, process them in memory, and discard them upon completion of the response. They are not recorded in any database or log. |
| External-Communication Tools | 1 | We are unable to obtain the content of the communication. |
The information collected by Our-API Tools is as follows.
| Tool | Information collected | How it is used |
|---|---|---|
| DNS lookup tool | The domain name entered by the user | Performing name resolution |
| IP address checker | The source IP address (not entered by the user) | Returning that address and network information |
| HTTP header checker | The URL entered by the user | Making a server-side request and returning the response headers (the page body is not collected) |
| Open Graph preview tool | The URL entered by the user | Making a server-side request and returning only the <head> metadata (title, canonical URL and Open Graph / Twitter Card tags). The page body is not collected. |
| HTTP security header checker | The URL entered by the user | Making a server-side request and grading the response headers. Only headers are read; the page body is not collected. |
| Heading and link extractor | The URL entered by the user | Making a server-side request and returning the heading hierarchy and the links found in the HTML. The page body is parsed in memory to produce that report and is not retained. |
| Email address checker | The domain part of the address entered by the user | Resolving MX, A/AAAA, SPF and DMARC records for that domain. The local part (before the @) is not sent to a resolver, and no mail is sent. |
2. Information collected automatically upon access
IP address, user agent, referrer, date and time of access, pages viewed, general information about the browser and device, and rendering performance metrics.
3. Information collected through Cookies, etc.
As set out in Article 5.
4. Information provided when making an inquiry
Where a user contacts us by email to [email protected], the name, email address, message body and other information contained in that email.
Article 4 (Purposes of Use)
- We use the information collected under the preceding Article within the scope of the purposes set out in the following items.
| Item | Purpose of use | Information concerned |
|---|---|---|
| (1) | Providing the functionality of the Tools and returning results | Information under Article 3(1) (limited to Our-API Tools) |
| (2) | Analyzing use of the Site and improving and prioritizing the Tools | Information under Article 3(2) and 3(3) |
| (3) | Delivering advertising and measuring its effectiveness | Information under Article 3(3) (limited to users who have consented) |
| (4) | Responding to and recording inquiries | Information under Article 3(4) |
| (5) | Preventing unauthorized access, automated bulk access and other misuse | IP address, user agent |
| (6) | Ensuring stable operation of the Site, responding to failures and maintaining security | Information under Article 3(2) |
- We do not use content entered into the Tools for advertising targeting, profiling or sale to third parties.
- Where we change a purpose of use, we shall do so only within a scope that may reasonably be deemed relevant to the purpose before the change, and we shall announce the changed purpose on the Site.
Article 5 (Use of Cookies, etc. and Consent)
- We do not set cookies on the Site. The information that we store on the user’s device is as set out in the table below; all of it is stored in local storage or session storage and is never transmitted to our servers.
| Name | Purpose | Retention period |
|---|---|---|
sk-theme | Retaining the display theme setting | Until deleted by the user |
sk-lang | Retaining the display language setting | Until deleted by the user |
sk-consent | Recording the consent given under this Article | Until deleted by the user |
sk-auto | A temporary marker to limit automatic language detection to a single occurrence | Until the browser session ends |
- Only where the user has given the consent set out in paragraph 3 will Google LLC set the cookies listed in the table below.
| Name | Set by | Purpose | Retention period |
|---|---|---|---|
_ga | Google LLC | Identifying users (access analytics) | 2 years |
_ga_<measurement ID> | Google LLC | Retaining session state | 2 years |
- We display a consent request on first access and provide the opportunity to choose whether or not to consent separately for the “analytics” and “advertising” categories. Unless the user consents, no Google script is loaded and no communication with Google occurs whatsoever.
- The user may at any time withdraw consent or change its scope through “Cookie settings”, which is permanently available on this page and in the footer. Withdrawal takes effect prospectively only and does not affect the lawfulness of processing carried out before the withdrawal.
- Even where the user does not consent, there is no difference whatsoever in the functionality of the Tools.
Article 6 (Access Analytics)
- Cloudflare Web Analytics — We use Cloudflare Web Analytics, provided by Cloudflare, Inc. That service does not use Cookies, etc., does not generate device identifiers, and does not carry out cross-site tracking. The information collected is limited to aggregate values relating to pages viewed, referrer, country, browser and device type, and rendering speed, and cannot identify any specific individual. Because it neither stores information on a device nor accesses information on a device, we operate it outside the scope of the consent under paragraph 3 of the preceding Article (Article 5(3)).
- Google Analytics 4 — Only where the user has given the consent under paragraph 3 of the preceding Article (Article 5(3)) do we use Google Analytics 4, provided by Google LLC, through Google Tag Manager. Before consent is given, the script itself is not loaded. For the handling of information transmitted to Google by that service, please refer to Google’s Privacy Policy.
Article 7 (Advertising)
- As of the effective date of this Policy, no advertising is displayed on the Site.
- We may display advertising in the future in order to cover the operating costs of the Site. In that case, we shall revise and publish this Policy before introducing any advertising-related technology, and shall obtain consent anew where required by law. The consent mechanism under Article 5(3) already provides an “advertising” category.
- The handling of information by advertising providers shall be governed by the terms established by those providers, and we shall specify this in the revised Policy.
Article 8 (Provision to Third Parties and Entrustment)
- We do not provide personal information to third parties without obtaining the user’s prior consent, except where any of the following items applies.
- Where based on laws and regulations
- Where necessary for the protection of the life, body or property of a person and it is difficult to obtain the consent of the individual concerned
- Where it is necessary to cooperate with a national government organ, a local government, or a party entrusted by either of them, in performing affairs prescribed by laws and regulations, and obtaining the consent of the individual concerned is likely to impede the performance of those affairs
- Within the scope necessary to achieve the purposes of use, we entrust the handling of information to the following providers. We exercise necessary and appropriate supervision over these providers.
| Entrusted party | Entrusted services | Information handled |
|---|---|---|
| Cloudflare, Inc. (United States) | Provision of hosting, CDN and API infrastructure; access analytics; prevention of misuse | Information under Article 3(1) (Our-API Tools), Article 3(2) and Article 3(3) |
| Google LLC (United States) | Access analytics and tag management (advertising delivery in the future) | Information under Article 3(3) (limited to users who have consented) |
| Sendinblue SAS (Brevo / France) | Provision of email delivery infrastructure | Information under Article 3(4) |
- We do not sell personal information to third parties.
Article 9 (Retention Periods)
We retain the information we collect for the following periods, and erase it without delay after the period has elapsed.
| Information | Retention period |
|---|---|
| Input to the Tools (Our-API Tools) | Not retained (processed in memory and discarded upon completion of the response) |
| IP addresses used to prevent misuse | Counting the number of accesses: the rate-limit window (tens of seconds to several minutes) / Record of violations: four times the rate-limit window / Record of blocked targets: 24 hours |
| Aggregate values from Cloudflare Web Analytics | The retention period determined by Cloudflare, Inc. |
| Information from Google Analytics 4 (where consent has been given) | The retention period we have configured in the Google Analytics administration console |
| Emails relating to inquiries | Five years after completion of our response (records whose retention period has elapsed are deleted collectively through an annual review) |
| Access logs recorded by the hosting provider | The retention period determined by Cloudflare, Inc. |
Article 10 (Procedure for Requests for Disclosure, etc.)
- Under Articles 33 to 35 of the APPI, the user may request us to notify the purpose of use of retained personal data, and to disclose, correct, add to, delete, suspend the use of, erase, or suspend the provision to third parties of such data (hereinafter “Disclosure, etc.”).
- A request for Disclosure, etc. shall be made by email to the contact details set out in Article 18.
- In order to verify that the requester is the individual concerned, we may request the provision of information specified by us. Where we are unable to verify that the requester is the individual concerned, we may decline to comply with the request.
- We shall endeavor to respond to a request for Disclosure, etc. within 30 days of receipt. However, where the content of the request is complex or other unavoidable circumstances exist, we may extend that period after giving notice to that effect.
- No fee is charged for a request for Disclosure, etc.
- Because data entered into the Tools is not retained by us, as set out in Article 3(1), in principle no record exists that is subject to Disclosure, etc.
Article 11 (Special Provisions for Users Located in the EEA, the United Kingdom or Switzerland — Controller and Legal Bases)
- We are the controller as defined in Article 4(7) of the GDPR. The name and contact details of the controller are as set out in Article 18.
- We rely on the following legal bases for the processing of personal data.
| Processing | Legal basis |
|---|---|
| Providing the functionality of the Tools; responding to inquiries | Performance of a contract or steps prior to entering into a contract (Article 6(1)(b) of the GDPR) |
| Preventing misuse; ensuring security; aggregation by Cloudflare Web Analytics | Our legitimate interests (Article 6(1)(f) of the GDPR). We carry out this processing having balanced its impact against the rights and freedoms of users |
| Google Analytics 4 and future advertising | The user’s consent (Article 6(1)(a) of the GDPR). Consent may be withdrawn at any time (Article 5(4)) |
Article 12 (Rights of Users Located in the EEA, the United Kingdom or Switzerland)
- Under Articles 15 to 22 of the GDPR, the user may exercise the following rights. Article 10 applies mutatis mutandis to the procedure for exercising them.
- Right of access to personal data (Article 15 of the GDPR)
- Right to rectification (Article 16 of the GDPR)
- Right to erasure (Article 17 of the GDPR)
- Right to restriction of processing (Article 18 of the GDPR)
- Right to data portability (Article 20 of the GDPR)
- Right to object to processing based on legitimate interests (Article 21 of the GDPR)
- Right to withdraw consent (Article 7(3) of the GDPR)
- The user has the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR). Users in Japan may submit a complaint to Japan’s Personal Information Protection Commission (PPC, 個人情報保護委員会).
Article 13 (Transfers of Data Outside Japan)
- Through the entrusted parties set out in Article 8(2) above, we may handle personal information outside Japan. The countries in which the entrusted parties are located are the United States and France.
- Relationship with Article 28 of the APPI — In providing personal information to third parties in foreign countries, we confirm that those third parties have established the systems necessary to continuously take measures for the protection of personal information. Users may request, through the contact details set out in Article 18, the provision of information regarding the systems of those foreign countries and the measures taken.
- Relationship with Article 44 et seq. of the GDPR — Transfers to Cloudflare, Inc. and Google LLC, located in the United States, rely on the EU-US Data Privacy Framework (an adequacy decision under Article 45 of the GDPR) or on standard contractual clauses (Article 46(2)(c) of the GDPR). Transfers to Sendinblue SAS, located in France, constitute handling within the EEA and do not amount to a transfer to a third country.
Article 14 (Children’s Privacy)
The Site is a technical service for developers and is not intended for use by persons under 16 years of age (under 15 years of age for users located in Japan). Where it comes to our attention that we have unintentionally collected the personal information of such a person, we shall erase it without delay.
Article 15 (Security Control Measures)
In order to prevent the leakage, loss or damage of personal information and otherwise to ensure its security, we take the following measures.
- Encryption of all communications (HTTPS; registered on the HSTS preload list)
- Restriction of the execution of external scripts by Content-Security-Policy (only the origins of the analytics providers set out in Article 6 are permitted)
- SSRF countermeasures in our API (rejection of requests addressed to internal networks and private addresses), limits on the number of accesses, and blocking of automated access
- Adoption of a design under which credentials and other sensitive information are not stored on our servers
- Appropriate supervision in the selection of entrusted parties
Article 16 (Revisions to this Policy)
- We may revise this Policy in response to amendments to laws and regulations or changes to the functionality of the Site.
- The revised Policy takes effect from the time it is posted on the Site. However, with respect to the introduction of new analytics means or advertising, the addition of purposes of use, or any other change that materially affects the rights of users, we shall give notice on the Site before the change and shall obtain consent anew where required by law.
- The history of revisions is also published in the changelog.
Article 17 (Governing Law and Jurisdiction)
- The interpretation and application of this Policy shall be governed by the laws of Japan. This does not preclude the application of mandatory provisions of law applicable to users located in the EEA, the United Kingdom or Switzerland.
- In the event of a dispute concerning this Policy, the Osaka District Court shall be the exclusive court of first instance by agreement.
- The Japanese text of this Policy is the authentic text. Translations into other languages are provided for reference only, and in the event of any discrepancy in content, the Japanese version shall prevail.
Article 18 (Business Operator Information and Contact Details)
| Item | Details |
|---|---|
| Business operator | 株式会社ピースエージェンシー (Piece Agency Co., Ltd.) |
| Address | 〒541-0057 大阪府大阪市中央区北久宝寺町3-6-1 本町南ガーデンシティ 7階 (Honmachi Minami Garden City 7F, 3-6-1 Kitakyuhoji-cho, Chuo-ku, Osaka-shi, Osaka 541-0057, Japan) |
| Representative | 藤岡 弘 (Hiroshi Fujioka), Representative Director |
| Personal Information Protection Manager | 藤岡 弘 (Hiroshi Fujioka), Representative Director |
| Contact | [email protected] |