Privacy policy
BestJapanBuy (bestjapanbuy.com, "we") respects your privacy. Browsing the site, checking prices and using the public API, CLI and local MCP require no registration or sign-in. We store the account information listed in section 1 only if you choose to sign in (currently used for the remote MCP service).
1. Accounts and sign-in
You can sign in with a Google or X (Twitter) account. We only request permission to read your basic profile; we never post on your behalf or read your contacts or other content.
Note: when you sign in with X, X's API requires the consent screen to also list the tweet.read permission. We do not read or store your posts; we only use the user ID, display name and avatar (and email, if you allow it) returned by users.read.
| What we store | Source | Purpose |
|---|---|---|
| Third-party account ID (Google account ID, X user ID) | Google / X | Recognizing you as the same person |
| Email address and whether it is verified | Google; X only if you allow it | Account identification and linking sign-in methods with the same email; never used for marketing |
| Display name and avatar URL | Google / X | Shown in the header and on the "My account" page |
| Sign-in session: IP address, browser type, sign-in and expiry times | Your browser | Keeping you signed in and security (detecting unusual sign-ins) |
| Authorized AI tools: tool name, scope, authorization time, refresh credentials | Your actions on the consent page | Letting the AI tools you authorize call the MCP; you can review and revoke them on the "My account" page |
- Access tokens returned by Google / X are stored encrypted and we do not use them to call Google or X APIs. Refresh credentials for AI tools are stored only as hashes.
- Account data is kept on our own servers. We do not sell or rent it or share it with advertisers, and we do not give it to third parties except where required by law.
- Sessions expire after 30 days of inactivity; account information is kept until you delete your account.
- The MCP server counts calls for rate limiting but does not record which queries belong to which account.
Deleting your account
Sign in, open the My account page and choose "Delete my account" to permanently delete, immediately, your account, sessions, linked Google / X sign-ins and all AI tool authorizations. To confirm it is you, you must have signed in within the last 24 hours; otherwise sign in again first. Copies in database backups are removed within 14 days as backups rotate.
You can also remove us under third-party connections in your Google account or connected apps on X. If you cannot sign in, contact us via [email protected] to delete it.
2. Analytics (Umami, when enabled)
Current status: enabled. When enabled, we use the self-hosted open-source tool Umami to understand page views, referrers (search engines, AI assistants, social networks), device types and feature usage (such as guides completed, comparisons, map directions and outbound link clicks). Umami uses no cookies, does not track you across sites and collects no personally identifiable information; IP addresses are used only for rough regional statistics and are not stored in identifiable form.
Google Analytics (when enabled)
Current status: enabled. When enabled, we also use Google Analytics 4 to measure page views, referrers, approximate region and device type. Google Analytics sets cookies in your browser (such as _ga) and the data is processed by Google; see how Google uses information from sites that use its services. We do not use Google Analytics data for advertising, keep advertising features turned off, and never send your account, email or other personal details to Google.
- Visitors from the EEA, the UK and Switzerland: analytics cookies are off by default and are only set after you choose "Allow".
- You can opt out at any time with the Google Analytics opt-out add-on, or change your choice with the button below.
3. Advertising (Google AdSense, when enabled)
Current status: not enabled (no ad script is loaded). When enabled, we may show ads through Google AdSense and the following applies. Google and its partners may use cookies or similar technologies to serve ads based on your visits to this and other sites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
- You can opt out of personalized advertising in Google Ads Settings, or opt out of third-party vendors' cookies at www.aboutads.info.
- How Google uses data: Google Privacy & Terms.
- For visitors from the EEA, the UK and Switzerland, we show a cookie consent prompt as Google requires and do not serve personalized ads without consent.
When you click a Rakuten affiliate link, Rakuten uses cookies on its own site to record where the visit came from in order to calculate commissions; we do not receive your Rakuten account or purchase details. See the Rakuten privacy policy.
4. Location
The store map asks your browser for your location only after you tap "Use my location". Your location is used only on your device to calculate distances to stores and is never sent to our servers or saved. You can decline and pick a station instead.
5. Local storage
Models in the compare tray, your wish list, checklist ticks, your language choice (bjb-lang) and your destination choice (bjb-dest) are kept in your browser's localStorage, only on your device; we cannot read them. Clearing your browser data deletes them. When you are signed in, the page caches your display name and avatar in sessionStorage for 1 minute (cleared when you close the tab).
Sign-in cookies
Set only when you sign in: bjb.session_token (keeps you signed in, HttpOnly so scripts cannot read it, 30 days), plus short-lived anti-forgery cookies during sign-in (expire after about 10 minutes). These cookies are required for sign-in and are not used for ads or cross-site tracking. Signing out deletes them.
6. Third-party services
- Map tiles come from OpenStreetMap; when the map loads, your browser requests images from its tile servers.
- Product images are not stored on our site: Rakuten Ichiba images load directly from Rakuten's image server (thumbnail.image.rakuten.co.jp), and some images link directly to manufacturer sites. Those servers receive standard request information such as your IP address and browser type; we send no Referer.
- External links such as Google Maps directions are opened only when you click them and are covered by those sites' privacy policies.
7. Server logs
Like any website, our servers and CDN may keep standard access logs (IP address, browser type, time) for security and rate limiting, and delete them regularly.
8. Japan's Act on the Protection of Personal Information
We handle personal information in accordance with Japan's Act on the Protection of Personal Information. We collect no personally identifying information from visitors who are not signed in; signed-in users' information is used for the purposes in section 1, and you can view it (on the "My account" page) and delete it at any time.
9. Contact and changes
If you have questions about this policy, contact us via [email protected]. When the policy changes we update the effective date on this page. This English page is translated with AI; the Chinese version prevails.