Privacy Policy

Last updated: May 30, 2026

This translation is provided for reference. The Japanese version is the governing document.

The COSMA operations office handles personal information in accordance with Japanese privacy laws and related regulations. This policy explains what we collect, how we use it, and how users can contact us.

1. Personal Information

Personal information means information about a living individual that can identify that individual, such as name, email address, address, phone number, or other identifiers.

2. Information We Hold

• Email address, display name, nickname, and profile image
• Shipping information such as name, postal code, address, and phone number
• Transaction history, including purchases, listings, amounts, and transaction status
• Listing information such as item descriptions, photos, and prices
• Optional profile fields, including cosplay history, activity areas, gender, age range, and favorite genres
• Inquiry details
• Access logs, IP address, browser information, OS information, and device information
• Search, filter, browsing, display-position, dwell-time, and price-change data used for service improvement. In Japan this applies unless analytics cookies are rejected; outside Japan or when region cannot be determined, it applies only after analytics cookie consent.
• Analytics data, including Cookie identifiers, IP address, browser and device information, viewed pages, referrer, and event information
• Stripe Connect account information. COSMA does not store full card numbers or payment method details.

3. How We Collect Information

• Information users provide directly through registration, profile editing, listing, purchase, and inquiry forms
• Information automatically collected when users access or use the service
• Information received from external services necessary for authentication, payment, and analytics, including Clerk, Stripe, Google Analytics, and Microsoft Clarity

4. Purposes of Use

1. Providing and operating COSMA, including account management, listing, purchase, and order processing
2. Executing transactions, including shipping information disclosure to sellers and payment processing
3. User support and inquiry response
4. Fraud detection, abuse prevention, and service security
5. Service improvement, demand analysis, trend analysis, and recommendation improvement
6. Creating aggregated statistics and trend reports that do not identify individuals
7. Displaying and improving relevant advertisements inside the service
8. Handling violations of terms and legal obligations
9. Sending important notices and optional product updates

5. Third-Party Provision

We do not provide personal information to third parties without user consent except where permitted by law. When a transaction is formed, shipping information necessary for delivery may be provided to the seller. Sellers must not use that information for any purpose other than shipping.

6. External Services

7. Security Measures

• Sensitive transaction data, including shipping information, is encrypted at rest.
• Shipping information is automatically deleted after a defined period following transaction completion.
• Access control, log review, and operational restrictions are used to protect personal information.

8. Cookies and Similar Technologies

COSMA separates cookies and similar technologies into the following categories. Rejecting non-essential cookies does not prevent login, purchases, payments, security features, or language settings from working.

• Essential cookies: Used for login, security, payments, language settings, and core service functions. These are always used.
• Analytics cookies: Used for Google Analytics, Microsoft Clarity, first-party behavior analytics, affiliate link click measurement, and service improvement. In Japan, these cookies are enabled by default and stop if you reject or change settings. Outside Japan or when region cannot be determined, they are used only after you accept them.
• Advertising cookies: Used for advertising personalization, retargeting, and related advertising features. They are off by default in all regions and used only after consent.

Google Analytics

• Recipient: Google LLC (United States)
• Information sent: Cookie identifiers, IP address, viewed pages, referrer, browser and device information, and event information
• Purpose: Access analytics, service improvement, and analysis of overseas traffic
• Consent: In Japan, analytics cookies are sent by default and stop if you reject or change settings. Outside Japan or when region cannot be determined, they are sent only after you accept them.

Microsoft Clarity

• Recipient: Microsoft Corporation (United States)
• Information sent: Cookie identifiers, region inferred from IP address, viewed pages, referrer, browser and device information, and click or scroll interaction data
• Purpose: Behavior analytics, heatmaps, and service improvement
• Consent: In Japan, analytics cookies are sent by default and stop if you reject or change settings. Outside Japan or when region cannot be determined, they are sent only after you accept them.
• Safeguards: Microsoft Clarity is disabled on address-entry pages, order detail pages, and around payment forms. Areas that may show messages, inquiry details, shipping information, or other personal information are masked and controlled so they are not recorded.

9. Retention Period

We retain personal information for the period necessary to achieve the purposes above or as required by law. Shipping information is automatically deleted 90 days after transaction completion.

10. User Rights

Users may request disclosure, correction, suspension of use, or deletion of personal information to the extent provided by law. Please contact us through the contact page.

11. Changes to This Policy

We may update this policy due to legal or service changes. Material changes will be announced through the service or by another appropriate method.

12. Contact

For privacy inquiries, please contact us through the contact page.