CHOK Privacy Policy
PLUSUP Inc. (株式会社プラスアップ, the “Company”, “we”, “us” or “our”) processes and protects the personal information of users of the CHOK service (https://chok.market, the “Service”) in accordance with this Privacy Policy. The Company is based in Japan, and the Service is offered without targeting any particular country. If the laws of the country or region where you live give you broader rights or protections than this Policy, those laws apply.
Article 1 (Personal Information We Process and Why)
(1) We process only the minimum personal information needed for the purposes below.
| Category | Purpose | Information processed | Legal basis |
|---|---|---|---|
| Sign-up and log-in | Identifying members, log-in, creating and linking the Service wallet | Email address (if you log in with Google, the email address and account identifier of your Google account), Service wallet address, member ID, nickname, profile image (optional), record of consent to the Terms | Entering into and performing our contract with you |
| Phone verification | Granting free Points, ensuring one account per phone number, preventing duplicate grants within the same Preseason | Mobile phone number, date, time and result of verification | Performance of contract |
| Daily check-in and friend invitations | Granting check-in and invitation Points | Check-in dates, invitation code, link between the inviting and invited members, Point grant history | Performance of contract |
| Predictions and Point management | Granting, using and expiring Points; making and matching predictions; settlement; resolving outcomes and disputes | History of Point grants, use and expiry; prediction and matching history; settlement results; dispute details | Performance of contract |
| Public profiles, activity and rankings | Providing member profile pages, activity feeds and leaderboards | Nickname, profile image, prediction history (question, option, amount, time), Point change, participation volume, number of invited members | Performance of contract |
| Fraud prevention | Detecting multiple accounts, automated tools and off-Service trading; restricting use and handling appeals | Access logs, IP address, device and browser information, automated-access check results, usage records | Performance of contract; our legitimate interests |
| Prize draws | Confirming entries, conducting draws, notifying winners | Member ID, nickname, entry time, draw result | Performance of contract |
| Prize delivery | Verifying winners and shipping merchandise | Name, mobile phone number, shipping address (collected only from winners, after they win) | Performance of contract |
| Launch updates (waitlist) | Sending emails about the Service launch and early access | Email address | Your consent |
| Inquiries and privacy requests | Responding to inquiries and handling requests to exercise privacy rights | Reply contact (such as email), account verification information, content of the inquiry | Performance of contract; legal obligations |
(2) We do not collect government-issued identification numbers, copies of identity documents, or information for tax filing. If the laws of the country or region where a winner lives require additional information for receiving merchandise, we will tell the winner what we need and why before collecting it.
(3) For users who browse the Service without signing up, we process only the access logs needed to provide and secure the Service.
(4) If we carry out processing that requires consent under applicable law (for example, marketing use or sending promotional messages), we will obtain separate consent and process information only within the scope of that consent.
Article 2 (How We Collect Personal Information)
(1) We collect personal information that members enter themselves, that is generated during log-in and phone verification, or that is generated automatically while using the Service. If you sign up through a friend's invitation link, the invitation code is also collected.
(2) We collect shipping information only from members who win a prize draw, after they win. We do not collect shipping information from all members at sign-up.
Article 3 (Retention and Deletion)
(1) We keep personal information only for the periods below and delete it without delay when the period ends or the purpose has been achieved.
| Category | Retention period | Exceptions |
|---|---|---|
| Member information (email address, log-in identifier, nickname, profile image, record of consent to the Terms) | Until account deletion | — |
| Mobile phone number and verification time | Until account deletion | To prevent re-registration and duplicate grants of free Points, kept as an irreversible hash for 1 year from account deletion, then deleted |
| Invitation link information | Until account deletion or 3 months after the end of the Preseason, whichever comes first | — |
| Point, prediction and settlement records | 3 months after the end of the Preseason (period for settlement and disputes); after that, kept only as statistics that do not identify individuals | Information recorded on the blockchain is governed by Article 4 |
| Fraud investigation records | Until any use restriction and appeal process is completed | For members whose contract was terminated, a phone number hash is kept for 1 year from termination to prevent re-registration |
| Prize draw records | 1 year after winner verification, shipping and dispute handling for the relevant event are completed | — |
| Shipping information (name, mobile phone number, address) | 30 days after shipment (period for delivery inquiries) | If a delivery dispute is ongoing, until it is resolved |
| Waitlist email address | Until consent is withdrawn or the Preseason ends | — |
| Inquiry records | 1 year after the inquiry is resolved | — |
| Access logs | 1 year | Longer if the laws of the user's country of residence require |
(2) Electronic files are deleted in a way that cannot be recovered, and backups are deleted in line with the retention periods.
(3) The expiry of Points at the end of the Preseason is separate from the deletion of personal information, which follows the periods above.
(4) Information that must be kept under applicable law is stored separately from other personal information and only for the required period.
Article 4 (Information Recorded on the Blockchain)
(1) A Service wallet is created for each member at sign-up. The fact that a prediction has been matched, including the wallet address used, is recorded on the GIWA chain (the GIWA Sepolia testnet during the Preseason). Point grants and movements are not recorded on the blockchain. These records remain on a public distributed ledger that anyone can view, and once recorded, no one, including the Company, can modify or delete them.
(2) We do not record information that directly identifies members, such as names, phone numbers or email addresses, on the blockchain. The link between a wallet address and a member account is kept only on the Company's servers, with access controls.
(3) When a member deletes their account or the retention period ends, we delete the personal information and the wallet-to-member link stored on our servers and remove the nickname from the public profile, so that the records remaining on the blockchain alone cannot identify a specific individual. Wallet addresses and matching records already written to the blockchain remain as they are.
(4) Members cannot request deletion or correction of information recorded on the blockchain. We respond to such requests by deleting the link information stored on our servers and hiding the information on the Service. We explain this on the sign-up screen.
Article 5 (Public Information and Use of Statistics)
(1) Profile pages, activity feeds and leaderboards on the Service show members' nicknames, profile images, prediction history (question, option, amount, time), Point change, participation volume and number of invited members. Anyone, including users who have not signed up, can view them.
(2) We do not display members' email addresses or phone numbers on the Service, and we do not display nicknames linked to wallet addresses. Members who have not set a nickname are shown with a partially masked identifier.
(3) Public prediction history may be linked to a wallet address by comparing it with public blockchain records. We recommend that you do not use your real name, contact details or other identifying information as your nickname or profile image.
(4) We may publish on the Service, use for analysis, or provide to third parties statistics that aggregate members' predictions so that no individual can be identified (such as the distribution of predictions by option and changes in prediction probabilities).
(5) When announcing prize winners, we display only partially masked nicknames.
Article 6 (Disclosure to Third Parties)
(1) We do not provide members' personal information to third parties, except with the member's consent or where specifically required by law.
(2) We do not provide winners' personal information to sponsors of prize draws. We share with sponsors only results that do not identify individuals, such as the number of prizes awarded.
(3) Members who invite friends are shown only the number of people who joined through their invitation, not the invited people's contact details.
Article 7 (Service Providers)
(1) We entrust the processing of personal information to the following service providers to operate the Service. They process personal information only on our instructions and do not use it for their own purposes.
| Service provider | Location | Services | Information processed |
|---|---|---|---|
| Amazon Web Services, Inc. (Asia Pacific (Seoul) Region) | Republic of Korea (storage location) | Data storage and server operation | All personal information stored by the Service |
| Vercel Inc. | United States | Website hosting and delivery | Access logs (IP address, browser information) |
| Magic Labs, Inc. | United States | Email and Google log-in; creation and management of Service wallets | Email address, Google account identifier, wallet address |
| Google LLC (Firebase Authentication, reCAPTCHA Enterprise) | United States | Sending phone verification messages; blocking automated access | Mobile phone number, device and browser information, IP address |
| [Delivery provider: to be determined] | [To be determined] | Shipping merchandise | Winners' names, mobile phone numbers and shipping addresses |
(2) Our contracts with service providers prohibit processing for other purposes and require technical and organizational safeguards, restrictions on sub-processing, our supervision, defined access rights that are revoked when the contract ends, and liability for damages. We supervise whether service providers handle personal information securely.
(3) If our service providers or the services they perform change, we will update this Policy without delay.
Article 8 (Processing Outside Your Country)
(1) The Company is based in Japan and operates the Service from Japan. Members' personal information is processed in several countries as follows.
| Location | Recipient (contact) | When and how | Information | Purpose | Retention |
|---|---|---|---|---|---|
| Republic of Korea | Amazon Web Services (Seoul Region); | Stored and processed over the network when the Service is used | All personal information stored by the Service | Storage, server operation, development and operations | Periods in Article 3 |
| Japan | The Company (PLUSUP Inc., bd@chok.market) | Accessed over the network when Company staff view the admin console | Member information, inquiries, Point and prediction records | Operating and managing the Service | Periods in Article 3 |
| United States | Vercel Inc. (privacy contact listed at https://vercel.com/legal/privacy-notice) | Transmitted over the network when you access the Service | Access logs (IP address, browser information) | Website hosting and delivery | As long as needed for delivery; access logs are kept briefly under Vercel's security and incident-response retention policy and then deleted |
| United States | Magic Labs, Inc. (privacy contact listed at https://magic.link) | Transmitted over the network when you log in | Email address, Google account identifier, wallet address | Log-in and Service wallet management | Until account deletion |
| United States | Google LLC (privacy contact listed at https://firebase.google.com/support/privacy) | Transmitted over the network when you request phone verification | Mobile phone number, device and browser information, IP address | Sending verification messages; blocking automated access | As long as needed for verification; records after verification are deleted under Google's retention policy, and we request deletion when a member deletes their account |
(2) Under the laws of your country of residence, the processing above may be a cross-border transfer. We maintain the safeguards those laws require and disclose the transfers in the table above. You may refuse a cross-border transfer. However, log-in and phone verification are required to use the Service, so if you refuse, you cannot sign up or receive free Points. You can refuse by not signing up, not completing phone verification, or deleting your account, and you may contact us with any questions.
Article 9 (Your Rights and How to Exercise Them)
(1) You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, or withdraw your consent. If the laws of your country of residence give you additional rights, you may exercise them in the same way.
(2) You can send requests by email to bd@chok.market. We will handle requests and notify you of the result within 10 days of receipt, or within any shorter period required by the laws of your country of residence.
(3) A legal representative or a person you authorize may also make requests on your behalf. In that case, we will verify the authorization.
(4) If a request is restricted by law, or concerns blockchain records described in Article 4, we will tell you the reason and how to object.
Article 10 (Children's Personal Information)
The Service is not directed at children. Children who, under the laws of their country or region, need a parent's or guardian's consent for the processing of their personal information should not sign up. If we learn that we have collected personal information from such a child, we will delete it without delay.
Article 11 (Automated Processing and Fraud Decisions)
(1) We may automatically analyze usage records to detect fraud such as multiple accounts, and may use tools that block automated access during phone verification. However, we do not restrict use or terminate contracts based solely on automated analysis. Staff review the usage records together with the member's explanation before deciding.
(2) Prediction settlements are calculated by the automated matching system according to criteria published in advance, and members may dispute the results.
Article 12 (Browser Storage and Similar Technologies)
(1) The Service uses your browser's storage (such as local storage) to keep you logged in and maintain your wallet connection. We do not currently use third-party analytics tools or advertising cookies.
(2) You can delete stored information in your browser settings. If you do, you may need to log in again.
(3) We do not process behavioral information for targeted advertising. If we introduce analytics tools or targeted advertising, we will update this Policy and obtain any required consent.
Article 13 (Security Measures)
We take the following measures to protect personal information.
1. Organizational measures: establishing and implementing an internal management plan, minimizing and regularly training staff who handle personal information, confidentiality agreements, and supervision of service providers
2. Technical measures: individual accounts for staff with least-privilege access, retaining and reviewing access logs, encrypting important information such as mobile phone numbers, and operating security software
3. Physical measures: storing Service data in the AWS Seoul Region and preventing personal information from being stored on the personal devices of Company and service provider staff
Article 14 (Privacy Officer and Contact)
(1) We have designated the following privacy officer to oversee the processing of personal information and to handle users' complaints and requests for remedies.
| Item | Details |
|---|---|
| Controller | PLUSUP Inc. (株式会社プラスアップ), EcoPlace Komagome B-211, 3-1-3 Komagome, Toshima-ku, Tokyo 170-0003, Japan |
| Privacy officer | Jihyun Kong (孔智賢), Representative Director |
| Contact | bd@chok.market |
(2) You may send inquiries, complaints and requests for remedies about the processing of personal information to the contact above. You may also file a complaint or seek mediation with the data protection authority or dispute resolution body in your country of residence, without first going through our internal process.
Article 15 (Changes to This Policy)
If we change this Policy, we will post a notice on the Service at least 7 days before the change takes effect. For changes that significantly affect your rights, we will post the notice at least 30 days in advance and obtain consent where required by law. Previous versions of this Policy are available on the Service.
Supplementary Provision
This Policy takes effect on November 10, 2026.