VisaRenew is designed so that we never receive the personal information you enter. This policy explains how that works, in line with Japan's Act on the Protection of Personal Information (APPI, 個人情報の保護に関する法律).
What stays on your device
- Your answers (name, date of birth, passport and residence card numbers, address, family details, photo) — stored in your browser's local storage, or session storage if you turn "Remember my details" off.
- Generated PDFs, checklist ticks and your language choice.
- Residence card and passport photos you scan — read on your device by the OCR engine and never uploaded.
You can delete all of it at any time from My details → Delete all my data, or by clearing your browser's site data.
Your account (Google or email code)
You log in before filling a form with Google or your email address, and every sign-in is confirmed with a 6-digit code we email you. Firebase Authentication (a Google Cloud service we use) stores your account's email address, name and profile photo URL (Google only) and sign-in timestamps so we can recognise your account. We use this only to operate sign-in and protect the service from abuse. Your form answers are not linked to or stored with your account. To delete your account, contact us (see About). Our operators can see aggregated account statistics (counts, sign-up and last-sign-in dates) with email addresses partly masked; every such access is logged.
Email codes: when you ask for a code, your email address is sent to our server, which emails the code through Gmail. We keep only keyed hashes (not the address or the code itself) in Google Cloud Firestore: the code hash for up to 10 minutes, and send counts per email and per IP address for up to an hour (a daily total for two days) to stop abuse. The code works once.
The only things sent over the network
- Sign-in: requests to Google / Firebase Authentication to sign you in and keep you signed in, and — if you choose an email code — your email address to our server so it can send the code.
- Postal code lookup: when you tap "Find address", only the 7-digit postal code is sent to the zipcloud service (ibsnet.co.jp) to get the Japanese address.
- OCR model files: the first scan downloads language data files from cdn.jsdelivr.net. Nothing about you is sent with the request.
- Page views: we use Vercel Web Analytics, which counts page views without cookies and without the content of any form.
- Hosting logs: our host (Vercel) processes standard request data such as IP address for security and delivery.
Our Content-Security-Policy technically blocks the page from sending data to any other destination.
Encrypted backups
Backups are encrypted in your browser with a password only you know (AES-GCM, PBKDF2). We cannot read or recover them.
Children
If you are under 18, please complete forms together with a parent or legal guardian.
Your rights
Because we do not hold your personal information, requests for disclosure, correction or deletion are fulfilled by the controls on your own device. Questions about this policy: open an issue on GitHub (see About). We will update this page if our practices change.