Nagi.mdThe Japanese version is authoritative if translations differ. However, wording in another language does not adversely alter explanations presented to you or rights under consumer protection laws.
1. Scope and operator
This policy applies to the Nagi.md website, web app, VS Code extension, desktop app, and checkout and subscription management pages and API, operated by a sole proprietor in Japan ("we"). Our legal name, address, and telephone number are disclosed without delay on request to support@nagi-md.com. See our commerce disclosure.
2. Information we do not collect
- The product has no feature that sends document contents, file names, folder structures, or document input to us. Information you choose to send in a support request is used to answer it.
- We do not collect usage telemetry or use analytics or advertising IDs.
- We do not receive card numbers. Paddle handles payment information.
See Your data for connections made when loading external images, videos, or web fonts or opening external links. To check whether free use is still in effect, the Windows app reads a configuration file (plan.json) from the official website when it can connect. This connection does not send device identifiers or documents. While the app is free, it makes no trial registration or subscription checks.
3. Information we receive
The desktop app is currently free, and trial registration and purchases are not offered. The following information is handled if we offer a paid plan and for authentication and subscription management of existing subscribers.
- A product-specific hash derived from Windows device identification information, and the trial start and end timestamps. The original device information and user name are not transmitted or stored. The trial lasts 14 days per device, requires an internet connection for initial registration, and is not extended by reinstalling.
- Device hash, PC display name entered by the user, and registration time for managing registered PCs and issuing signed offline entitlements bound to the account, device, and deadline. The OS computer name is not sent automatically.
- Purchase email address, language, checkout identifiers, creation and expiry times, and completion status.
- Paddle customer, transaction, subscription, and price IDs; subscription status, amount and currency, period end, paid-through date, and scheduled changes such as cancellation.
- A hash for verifying the 12-character authentication code and an encrypted value for resending it; Firebase Auth user ID and authentication tokens.
- Hashes derived from IP addresses or user IDs, attempt counts, window start times, and expiry dates for rate limiting. The API receives your IP address during communication but does not store it in plain form in rate-limit records.
- Email recipient and language, pending or accepted status, attempt counts, creation and acceptance times, and SES message ID. Acceptance does not guarantee delivery.
- Your support email address, request, and information you choose to provide, such as your environment.
Firebase and other providers may process connection information such as IP addresses and access or error logs when serving pages, APIs, and authentication.
4. Purposes of use
- Checking each device’s trial deadline and preventing repeated trials through reinstalling.
- Processing purchases, authenticating you, checking payment and subscription status, and providing subscription management.
- Sending or resending authentication codes, answering requests, and handling refunds or billing errors.
- Preventing duplicate subscriptions and abuse, rate limiting, investigating failures, and operating securely.
- Legal compliance, accounting, and handling disputes.
5. Information stored on your device
See Your data for the basics of document and settings storage. Main storage locations and removal methods are:
| Context | Information and location | How to remove |
|---|---|---|
| Website | Language selection in browser localStorage | Clear browser site data. |
| Web app | Drafts and access handles for opened files in IndexedDB; appearance and other preferences and sidebar state in localStorage. Drafts use localStorage when IndexedDB is unavailable. | Save needed documents as files before clearing site data. |
| Checkout and subscription management | Purchase email, checkout token and creation time; authentication tokens and expiry in sessionStorage | Close the tab or clear site data. Signing out removes authentication data. |
| Windows app | WebView2 data, themes, image save preferences under %LOCALAPPDATA%\Nagi (the Microsoft Store version keeps them in a location Windows reserves for the app and removes them on uninstall); purchase email, authentication refresh token, last subscription check, PC registration status and display name, and signed offline entitlement and trial information in Windows Credential Manager | Close the app, back up needed data, and remove the folder. Remove custom themes at their chosen locations. Signing out removes subscription credentials and signed offline entitlements. Remove server-side PC registrations from the account page. Trial information can be removed in Credential Manager, but the server trial deadline remains unchanged. |
| VS Code extension | Appearance preferences, sidebar state, and image save preferences in VS Code settings and extension storage | Remove them in VS Code settings and storage. With Settings Sync enabled, supported appearance preferences are synced through VS Code. |
Our website, web app, and subscription management implementation do not use cookies. We do not use cookies for analytics or advertising. Paddle policies apply to its checkout and customer portal.
6. Providers and international processing
| Provider | Purpose and information |
|---|---|
| Paddle | Seller (Merchant of Record) handling sales, payments, invoice issuance, tax reporting and remittance, and subscription management. Purchase email and customer, transaction, and subscription data. Paddle handles card information. |
| Google Firebase | Hosting for delivery, Functions for APIs, Firestore for device hashes, trial deadlines, purchase, subscription, rate-limit and email records, and Auth for authentication. |
| AWS SES | Authentication emails: recipient, message content, and sending results. |
| Google (Gmail) and Cloudflare | Receiving and storing support emails (Gmail) and forwarding them (Cloudflare): sender addresses, message content, attachments, and related information. |
Paddle entities are based in the United Kingdom, United States, Ireland, and other countries. Google LLC, Amazon Web Services, Inc., and Cloudflare, Inc. are based in the United States. Information may be processed outside Japan. Firebase Auth processes data in the United States. Functions use the Japanese region asia-northeast1 and SES defaults to Tokyo; this does not mean all information stays in Japan.
See the Paddle Privacy Policy, Firebase privacy and security information, and AWS Privacy Notice. Beyond sharing needed for service provision and sales, we share personal information only with your consent or as permitted by law. We do not sell personal information.
7. Security measures
We use HTTPS, store authentication codes as verification hashes and encrypted values for resending, and prevent direct browser access to Firestore billing records. APIs verify authentication and subscription ownership. We limit checkout, authentication, and resend attempts and manage secrets. API error responses and application error logs are implemented to avoid exposing email addresses, authentication codes, or tokens.
8. Retention
Device hashes and trial start and end timestamps are retained while the trial feature is provided to prevent repeat trials, and deleted when the feature is discontinued. Original device identification information is not stored. Registered PC hashes, display names, and registration times are retained while registered and deleted when the registration is removed from the account page. Trial records are kept separately and are not deleted by removing a PC.
Support requests are retained for one year after our response. Purchase and subscription information is retained after the subscription ends for as long as needed for support, refunds, fraud prevention, and accounting, then deleted. Access logs follow Firebase policies.
Deleting authentication or other records may affect subscription verification or support. Legally required records are retained as required.
9. Access, correction, deletion, and other requests
Contact support@nagi-md.com to request access, correction, deletion, or restriction of use of your information. We verify your identity and respond under applicable law. If we cannot comply, for example due to retention obligations, we explain why. Do not send card numbers, authentication codes, or tokens by email.
10. Changes and contact
We update this page when features or information handling change. New external transmissions will be described in advance. Material changes and their effective dates will be announced on the website. Contact support@nagi-md.com. Adopted October 11, 2026; last updated October 17, 2026.
Nagi.mdBack to top ↑