Mokutori1. Who is responsible
Mokutori is a product of チェックス株式会社 (chekusu Inc.) (“chekusu”, “we”, “us”). This policy covers the Mokutori iPad app, our product website, our support services and the Mokutori software used to connect your scans to an agent.
Contact us at contact@mokutori.com, or use the chekusu contact form. Our published business address is KC Building, 6F, Room 19, 2-35-1 Higashiazabu, Minato-ku, Tokyo 106-0044, Japan. Our representative director is Guo Yu (郭 宇). The company identification number is 2010401169258.
We are responsible for personal information that we handle. If you or another operator hosts an agent or connector, that operator also determines how its host, accounts, logs and backups are managed. AI services, Apple and other recipients you choose have their own privacy terms. This policy does not make promises on their behalf.
2. Scanning on your iPad
The core scanning functions do not require a Mokutori account. Page detection, image correction and optical character recognition (OCR) run on your device. Core OCR does not upload your pages to a cloud OCR provider.
The app handles camera images and images you select from Photos or Files. It stores original images, corrected images, recognized text, your corrections, page titles and identifiers, creation times, quality warnings and processing information in its local scan library. Reprocessing can preserve earlier versions. Imported originals may retain embedded metadata.
Camera access is used to scan pages. The app uses the system photo and file pickers to access items you select; it does not request microphone, contacts or location access. Local hand detection helps determine when a page is ready to capture; it is not used to identify people.
The current app has no advertising, third-party analytics or automatic crash-reporting SDK. Locally stored quality and error information helps processing and troubleshooting. This does not prevent Apple's TestFlight distribution service from sharing diagnostics with us as described below.
4. Optional agent and Muse connections
Agent delivery is optional and starts only after you set up a receiver and pair your iPad. After pairing, completed scans can be sent automatically without asking again for each page, including pages with review warnings and pages that you reprocess. Check the connection state before scanning material you do not want sent.
Review the receiving agent and gateway before opening a pairing link or scanning a pairing QR code. If your app presents a pairing confirmation screen, check those details and confirm only if you want automatic delivery. Earlier builds can begin pairing when the link is opened, without an additional confirmation screen.
- The app prepares a page image, recognized text, page identifiers and quality information. The image is normally resized and re-encoded from the corrected page, or from the original when no corrected image is available.
- The app encrypts the page content for the paired recipient and sends it through the configured Friends gateway. The gateway handles encrypted messages and routing information, including account, device, conversation and operation identifiers, device names, public keys, permissions, delivery state, timestamps, attachment counts and sizes. Connecting to it also exposes normal network information such as an IP address.
- The receiving agent or connector decrypts and stores the pages on its own host. After saving a batch, the current connector marks its gateway delivery as read and keeps a separate local unread marker. The gateway receipt means the receiver took delivery; it does not prove that you read the page or that Muse analyzed it. The host operator and the software running there can access the readable copies.
- When Muse requests a scan list, the connector can fetch and cache scans and return OCR text, summaries and file information to Muse. When Muse requests a page image, it receives the image. Connection-status requests can return device names, pairing information and service identifiers.
Gateway registration may require an email address and verification, even though local scanning does not. The gateway and host used by your installation are selected during setup. The default gateway is the Chekusu-operated bots.yobiru.com. The Yobiru privacy notice supplements this policy with the gateway's current retention, deletion and infrastructure details. Chekusu remains responsible for the gateway it operates.
Encryption during relay delivery does not prevent the receiving host or Muse from reading content you send to them. Muse and other connected AI services handle prompts, scan content and conversation history under their own terms and settings. Their retention or model-training choices are separate from Mokutori's behavior.
The current self-hosted connector uses one private installation and one scan library. Its connection key can give access to that library; it is not a system of separate accounts for multiple unrelated users.
5. Website visits, support and TestFlight
The product website uses Cloudflare for hosting and delivery. Cloudflare may handle IP addresses, request details, timestamps and security or operational information to serve and protect the website. See Cloudflare's privacy policy.
If you contact us, we receive the contact details, message, ordinary email metadata, attachments and diagnostics you choose to provide. We use them to respond, investigate problems, handle privacy or security requests and keep appropriate records. Messages sent to support@mokutori.com for product help and contact@mokutori.com for privacy or security requests pass through Cloudflare Email Routing and are stored in the same Google Gmail mailbox used by the operator. The retention and rights-request provisions below apply to both addresses. The alternative chekusu contact form uses Formspree and is also subject to the company website privacy policy.
If you use a TestFlight build, Apple automatically collects crash logs and usage information and shares them with us as the app provider. Feedback you submit may also include comments, screenshots and identifying information. We use the information Apple makes available to investigate faults and improve the app, subject to Apple's restrictions on its use and disclosure. See Apple's TestFlight privacy notice.
Please send only what is needed to explain the problem. Do not send passwords, verification codes, pairing secrets, connection keys or unrelated personal documents. We do not need your complete scan library to begin helping you.
6. Purposes and disclosures
We use information we handle to provide requested features and support, maintain service security, investigate faults and abuse, respond to rights requests and meet legal obligations. We do not sell scan content, use it for targeted advertising or use it to train our own general-purpose AI models.
For information handled through the Muse connector, our use is limited to fulfilling your requested operations and operating, protecting, supporting and improving that connector as described here. We do not repurpose that information for sale, unrelated advertising or profiles, sensitive-attribute inference, or training any model. We share it only as needed for your request, without granting the recipient additional usage rights. These restrictions govern our connector handling; they do not describe Muse’s independent handling under its own policies.
Information may be handled by service providers performing these tasks for us, by recipients you select, or where disclosure is legally required. We limit disclosures for legal claims or safety to what is justified under applicable law. If a business transfer affects your information, the applicable protections and legally required notice continue to apply.
A privacy notice is not blanket consent to new uses. When an activity requires a separate notice or consent, we will provide it before that activity. If EEA or UK data-protection law applies to processing under our control, our bases are performance of a requested service or contract, legitimate interests in proportionate security and support, compliance with legal obligations, and consent where required. You can withdraw consent for future processing without affecting processing lawfully carried out beforehand.
7. Retention and deletion
- On the iPad: scans and retained versions remain until you remove the relevant local files. There is currently no automatic expiry or in-app scan deletion button. See the support instructions for using Files to manage local copies.
- Local relay state: pairing credentials and connection information remain until you disconnect or replace that pairing. Prepared encrypted messages can survive app restarts for retry. Removing a scan folder does not remove an already prepared relay message. Disconnecting is designed to clear local relay state, but earlier builds can resume pending work after disconnection. Follow the steps to stop delivery, including revocation at the receiver.
- On an agent or connector host: downloaded images, text and receipt records do not automatically expire. The operator of a Muse connector must arrange deletion or make them inaccessible when they are no longer needed, access is revoked or the user requests deletion, and address copies in backups. This currently requires operator action; acknowledging a scan does not do it.
- At the gateway and connected services: their retention and deletion procedures apply to copies and records held there. Removing a local copy does not remove these copies.
- Support, website and TestFlight records under our control: we keep them only for as long as needed for the stated purpose, taking account of unresolved requests, security investigations, legal retention duties and the establishment or defence of claims, and subject to applicable provider restrictions. We delete or de-identify them when they are no longer needed. Apple and other providers' records, logs and backups may follow separate retention cycles.
A gateway read receipt or local acknowledgement does not delete a scan. The connector’s acknowledgement operation only removes a batch from its local unread list; it does not make another gateway request or remove stored pages. Disconnecting Muse does not erase its conversation history, the host cache or iPad scans, and does not itself unpair the iPad. Disconnecting the iPad does not itself confirm that all pending work has stopped: earlier builds can resume queued work or restore relay state after disconnection. Stop processing, disconnect, fully close the app and have the receiving operator revoke or block the device before relying on delivery being stopped. A transfer already in progress may still complete, and content already sent or accepted by the gateway cannot be recalled. Exports, device backups and other recipients' copies must be addressed separately.
8. Security and processing locations
The app uses iPadOS file protection and stores pairing credentials and keys in the device Keychain. Page content is encrypted for relay delivery. A self-hosted agent or connector stores decrypted scans as readable files; application-level encryption is not added to that cache. Its operator must protect the host, disk, backups, credentials and network connection. No service can guarantee that every security risk is eliminated.
Information about the safeguards applied to personal data held by Chekusu is available from contact@mokutori.com. We provide information required by applicable law without undue delay, excluding details whose disclosure would undermine those safeguards.
Local scanning takes place on your iPad. Optional gateways, receiving hosts, AI services, website infrastructure and support providers may process information outside your country, including outside Japan. The location of a self-hosted receiver depends on its operator. Cloudflare and Google use international infrastructure; this policy does not promise Japan-only storage.
Where we are responsible for a regulated international transfer, we must use the information, consent or other safeguards required by applicable law. Enabling a feature or accepting these terms does not waive those requirements. Before using a hosted connection for information that requires a particular storage location, obtain the actual provider and location details from its operator. For processing arranged by Chekusu, contact us for the applicable recipients, processing countries and transfer safeguards. Where Japanese law requires prior information and consent, we provide that information before obtaining consent.
9. Your choices and rights
You can use local scanning without pairing an agent, select which items to import or export, manage camera permission in iPad Settings, disconnect a paired agent and request help with deletion. The support page explains the limits of each action.
Depending on applicable law, you may request information about our use of your personal data, access or disclosure, correction, deletion, cessation of use or third-party provision, or records of disclosures. Other rights may include portability, restriction, objection, withdrawal of consent and complaints to a competent authority.
Send requests to contact@mokutori.com with “Mokutori privacy request” and enough detail to locate the information. We may ask for proportionate identity or authority verification; do not send identity documents unless we explain why they are needed. We respond within applicable legal time limits, explain any lawful limitation and provide information about available complaint routes. We do not penalize you for exercising your rights.
We cannot remotely access or erase a library held only on your device or a host we do not control. We can explain how to contact the relevant operator. For concerns in Japan, you may also contact the Personal Information Protection Commission.
10. Children and policy updates
Mokutori is a general-purpose document tool and is not designed to solicit personal information from children. A minor who needs a guardian's permission under applicable law must obtain it. If you believe a child has supplied information to us improperly, contact us so we can review the situation.
We will update this policy when our practices change and show the effective date on this page. For material changes, we will provide any additional notice or consent mechanism required by law. Revised wording does not by itself authorize an incompatible new use of information already collected.