Privacy
dinonavi-web-2026-10-13-v3 · 2026-10-13
Analytics supplement (collection is currently disabled)
First-party analytics is not currently running. The following policy applies to future collection after valid consent.
Purpose
We aggregate encyclopedia/map usage, popular pages and referrals from Android promotions to Google Play. Clicks and QR impressions are not purchases.
Collected information
After consent: page views, short sessions, navigation/language changes, search actions (not search terms), map/promotion interactions, Play clicks, categorized referrers/allowlisted UTM, country codes, coarse browser/OS/device and reference rendering metrics. No email, member/payment identifiers, raw IP, full User-Agent, raw URLs or queries are stored in visitor analytics events.
Consent and withdrawal
Both the existing analytics choice and the additional first-party notice must be accepted. Refusal/withdrawal clears pending events and the identifier, and stops sending; renewed consent creates a new identifier. DNT/GPC are honored. Refusal counts/the consent-rate denominator are not collected, so the rate is unknown.
Visit estimates
Visits and estimated uniques are reference values based on daily rotating short sessions, not counts of actual people. Device/browser changes and day boundaries can produce duplicates. Bot classification is not exhaustive detection.
Retention periods
Approved policy: detailed events30days; daily rotating session references for up to30days; daily/hourly aggregates365days; administrative/operational audit logs365days. No event-specific retention exceptions are currently configured. Monthly aggregates are retained for three years under the approved policy and are captured from hourly aggregates before expiry. Expired historic data is not recreated; only observed aggregates are retained. Separate weekly storage is not adopted. Expiry of raw events does not erase aggregates still within their independent retention.
Country estimates
Only signed country codes from an approved proxy are accepted; unavailable results remain UNKNOWN. VPNs/proxies may differ from actual location. Raw IP is not sent to external GeoIP APIs. No local GeoIP database is currently installed.
External transmission
First-party analytics sends to our same-site API; no external analytics SaaS is used. Google Play links navigate to another service. Ordinary shared-proxy access logs are separately managed from the analytics database and require their own operational approval.
Administrator access and ZIP
Administrators require a server-side role and valid session. Dashboard/report/ZIP/CSV operations are audited with the administrator internal member ID, timestamp, action, period and output size; initial registration also records issuer and hashed subject/audience/approval references. Role changes/revocations record the target internal member ID and executing DB role; retention and backup operations record only non-secret operational metadata, separately from visitor events. ZIPs contain only scoped aggregates, not event/session/member identifiers, IPs or tokens. Aggregation is designed to reduce identification, but zero inference risk for small groups is not guaranteed.
Deletion and restoration
Expiry runs only under approved operations; encrypted-backup retention/deletion needs separate approval. Daily rotation and aggregation prevent linking historic aggregates to an individual, so we cannot identify an individual's historic aggregate contribution for selective deletion. After restoration, review an approved retention dry-run before applying expiry. Failures/gaps are recorded, not filled with invented data.
Contact
The existing Privacy v2 contact policy remains. This draft does not activate our inquiry service or SMTP.
Backup retention conditions
The approved basic backup policy retains seven encrypted daily generations and four weekly generations. No indefinite additional-retention exception is allowed. Daily copies cover seven UTC calendar days including today, and weekly copies cover four UTC calendar weeks including the current week; a backup outage does not extend these windows. The backup destination, encryption-key custody, and deletion procedures will be finalized before production activation. No exception allowing indefinite extension of backup retention will be permitted. External backup storage is not connected. Backups contain data as captured, so information deleted from the source DB can remain encrypted until its backup generation expires. Expired-data deletion is reviewed and applied after restoration before analytics collection resumes.
Operator and review status
DinoNavi is operated by Sekimosoft LLC. This notice is a draft reflecting the current implementation. Final legal and privacy review is pending. Retention periods and regional requirements will be finalized before membership, payment or advertising services are opened.
Google sign-in and essential cookies
A Google sign-in foundation exists, but external configuration and real-account testing are incomplete. When enabled, the Google subject identifier (sub), internal user ID and session expiry/revocation state will be used for membership. Essential session cookies are separate from optional analytics/advertising consent. Sessions expire after seven days and login transaction cookies after ten minutes.
Stored information
When authentication is enabled, the server stores the Google-subject/internal-user mapping, hashed session identifiers, and temporary state, nonce and PKCE transaction information. Google access, refresh and ID tokens are not retained. Accounts and purchases are not automatically merged by email. Purchase, entitlement and audit-record models exist, but real payments have not begun. Cleanup schedules for expired records and user-data retention periods require review before release.
Optional analytics, advertising and consent
No analytics or advertising provider is currently integrated. This browser stores only your selected preferences in local storage. Change or withdraw optional consent in the footer; failed saving disables optional use. Future integrations require consent and regional review, and must not generate or transmit custom tracking identifiers without consent.
Account deletion and contact
An automated account-deletion feature is not yet available. Use the official form for deletion or stored-data questions. Identity verification, deletion procedures, legally retained records and retention periods will be finalized before membership is opened.
Android integration
The Android and Web encyclopedia share content IDs and source material. User history, favorites and purchase rights are not automatically synchronized. Android purchase linking, pricing and benefits remain undecided.
Scope and inquiry information
This policy applies to DinoNavi Web. The dedicated form currently supports local mock operation only and sends no external mail. Before public activation, the design records category, name, reply email, optional subject, message, locale, tracking code, policy version and consent time, creation time, and acceptance/delivery status. Attachments are not accepted. A tracking code alone cannot retrieve content.
Acceptance, notifications and safeguards
Inquiry records, the delivery queue and delivery outcomes are separate. Idempotency, persistent limits using HMAC-derived IP/email keys and bot checks protect submissions. Routine logs exclude input, email addresses and secret settings. Acceptance remains unavailable without the external transport, authenticated sender and release gates; no live delivery or successful acceptance is falsely claimed. Operator notices and sender receipts are planned for live operation; response times are not guaranteed.
Purposes, processors, disclosure and international handling
Information is used to handle inquiries, identity-verified requests and abuse prevention. No external mail provider is selected or connected. Processors, disclosed fields, processing countries and safeguards must be documented before release. Unrelated third-party disclosure is not a purpose; legally required handling may occur. Google and other services also apply their own processing terms when used.
Retention, access, correction and deletion
Retention periods and deletion/anonymization procedures for inquiries, queues, delivery records and abuse-prevention HMAC keys are pending review. Dry-run selection and hold exclusion exist; production auto-deletion is disabled. No invented retention deadline is stated; operations and policy must be agreed before public acceptance. Use the contact form for access, correction or deletion requests, subject to appropriate identity verification.
Proposed retention periods
Retention periods are unapproved proposals: ordinary inquiries for 365 days after final closure, terminal delivery metadata for 90 days, and temporary diagnostic records for no more than 30 days. Open inquiries are retained as needed and long-running cases reviewed. Legal/dispute holds block deletion. Production auto-deletion is off by default. Erasure requests require identity verification and review of legal/contractual retention needs. Version: dinonavi-inquiry-retention-proposal-v1
Mail delivery readiness
An SMTP adapter exists, but accounts/processors, sender-domain authentication and approval gates are unconfigured. Live SMTP connections/sending remain disabled. SMTP does not guarantee exactly-once delivery; ambiguous outcomes require review rather than automatic resend.
Inquiry consent
I have read the Privacy Policy and consent to processing my input for handling this inquiry, its tracking code, operator notifications and a receipt email.