TSUNAGI ///M

1. About this document

The M platform (m.tsunagi.app) answers two questions for TSUNAGI///M’s apps: who is using this, and what may they open. The apps of shops and companies (called Mainstays) and m3 (m3.tsunagi.app) all ask the same platform.

This document covers the platform itself — the sign-in, account, device and invitation pages and the records behind them: what it holds, who receives it, and for how long.

What each Mainstay’s own site or app handles is described in that Mainstay’s documents. Records of payment are held by whoever sold to you (m3, for instance) and do not come to the platform.

2. The operator

[For the operator to fill in: name, address, contact — the same as m3’s legal notice, or a pointer to it.]

3. What the platform holds

The platform holds no name and no e-mail address. An account is a random identifier.

• Accounts: a random identifier, a status, when it was made. The short label shown on screen (for example #K7Q2) is computed from that identifier and is not stored separately.
• Sign-ins of a device: not the sign-in key itself, only a value computed from it (a hash). Also: which app it belongs to, which device group, when it was made, the day it was last used (updated at most once a day), when it expires, and a coarse device name (such as “iPhone · Safari” — only the kind the browser says it is).
• The recovery code: a keyed value for matching it, and an encrypted copy so that you can read it again on your account page.
• Rights: which account holds which right of which Mainstay. When it was granted, by what kind of actor (an admin, a server key, the operator, the migration), what it is based on (for example a purchase number), and the Mainstay’s own number for the person, if it gave one.
• Invitations: the hash of the link’s key, the rights it gives, when it expires, which account accepted it and when, and where to go after accepting.
• Admins of a Mainstay: which account is an admin of which Mainstay.
• A record of actions: that a right was granted or taken back, an invitation made or accepted, a device stopped, and so on. By whom (an admin’s label, a key’s id, the operator, the person), when, and for which account. It contains identifiers and reasons only — never a key, an address or a name.
• Values for rate limiting: to stop repeated attempts from one place in a short time, a keyed value computed from the connecting IP address, and a count, kept for a set time. The IP address itself is not stored.
• One-time values: the code handed to an app, a link for adding a device, the code that carries a sign-in over, the number of a server-to-server ticket. Each is a hash or a number, with a short expiry.

4. What it does not hold

• Names, e-mail addresses, phone numbers, postal addresses.
• Payment information (cards, amounts, receipts). Payment takes place between the seller and its payment provider.
• Vehicle information (VIN, mileage, fault records, maintenance or cost records).
• Location. The IP address itself.
• Passwords. The platform has none.
• The time on your device’s clock. It is received at sign-in to check that the clock is not far out, and is not stored.

5. Cookies, and what stays on your device

• The platform sets one cookie (__Host-m_sess). It is the sign-in key; page scripts cannot read it, and it is sent only over an encrypted connection. It expires 180 days after it was last used.
• The platform’s pages do not use the browser’s storage (localStorage and the like).
• There is no analytics, no advertising, no script or image from elsewhere, and no web font. The pages load the platform’s own files only.
• Only when you press “Copy” is a link or a code written to the clipboard.

6. Who receives what

• The app you sign in to: the account’s identifier and label, which of that app’s Mainstay’s rights the account holds, the number that Mainstay gave, and when the session expires. Rights of another Mainstay are not passed.
• A Mainstay’s admins and its servers: the identifiers and labels of accounts holding that Mainstay’s rights, what became of its invitations, and the record of actions concerning that Mainstay. Nothing of another Mainstay is visible.
• The operator: may look at the records above to run and repair the system. Once a Mainstay has an admin, the operator’s key can no longer let people into, or remove them from, that Mainstay.
• Cloudflare: the platform runs on Cloudflare (Pages, Workers, D1). To deliver traffic, Cloudflare handles the connecting IP address and similar data.
• Nothing is passed to any other third party. Nothing is sold. Nothing is used for advertising.

7. What comes to the platform from a Mainstay

When a Mainstay invites a person, what reaches the platform is the rights to give and the Mainstay’s own numbers (a purchase number, a staff number). There is no way to send a name or a contact to the platform. Only that Mainstay knows who a number stands for.

8. How it is protected

• Sign-in keys, links and codes are stored as hashes only. A leaked record cannot be used as it is.
• The copy of the recovery code, and server-to-server keys, are stored encrypted.
• Servers talk to each other with a ticket that expires in 60 seconds, works once, and fits one exact request.
• Keys are never put in an address (URL).
• What cannot be verified is not let through. When the system cannot answer, the answer is “unavailable”.

9. How long things are kept

• A device’s sign-in: 180 days after it was last used. Signing out, or stopping the device, ends it at once.
• The code handed to an app: 60 seconds. A link for adding a device: 10 minutes. The carry-over code: 60 seconds. An invitation: 10 minutes to 7 days (set by whoever makes it).
• Values for rate limiting: deleted after their set time (an hour at most).
• Accounts, rights and the record of actions: kept until erased. A right taken back stays as a record that it was taken back.

10. What you can do

• On your account page: see and stop the sign-ins of this device and of your other devices. Read the recovery code, or make a new one (the old one stops working). Sign out.
• To have a right taken back: tell the Mainstay that granted it.
• To have your account erased, or to learn what is held about it: contact the operator. That you are the account’s owner is checked by a signed-in device or the recovery code.

11. Delegation to AI

The mechanism that lets an AI assistant use an app on your behalf is not running yet. Before it runs, what is recorded and what reaches the AI’s side will be written in this document.

12. Changes, and language

When what the platform holds or passes on changes, this document is changed first. The Japanese document is the operative text. Where the English differs from it, the Japanese prevails.