YuhoLAB Disclaimer and Privacy Policy
1. Disclaimer
YuhoLAB extracts, processes and restructures financial figures and company descriptions from annual securities reports and other filings published on EDINET, the disclosure system of Japan's Financial Services Agency, and presents them as a reading aid. There is an iOS app and a connector for AI assistants such as Claude (see "3. YuhoLAB Connector"). The data comes from the YuhoLAB API, which the operator runs. Company descriptions include summaries and restructured text produced by automated processing and generative AI.
- Not investment advice: The information is not a solicitation to invest, investment advice, or a recommendation to buy or sell any financial product. The operator is not registered as a financial instruments business operator (investment advisory or agency business) under the Financial Instruments and Exchange Act of Japan.
- Accuracy: Because of extraction, processing, normalization, automated restructuring and the timing of amended filings, what is shown may differ from the original EDINET filings or a company's official disclosures. Completeness, accuracy and timeliness are not guaranteed.
- Decide for yourself: Check the original filings on EDINET and each company's official information, and make investment and other financial decisions at your own responsibility. The extent of liability follows the Terms of Use.
2. Privacy Policy (iOS app)
This chapter covers the iOS app. For the connector, see "3. YuhoLAB Connector". The iOS app has no account registration or login. It uses no advertising SDKs, no third-party SDKs for tracking user behavior, and no analytics or crash-reporting services.
2.1 Data stored on your device and in iCloud
The following data is stored on your device for the app's features. To sync it between devices signed in with the same Apple ID, Apple's iCloud (CloudKit) is also used. It is not sent to or stored on the operator's servers.
- Stocks you added to your lists
- Number of shares held, acquisition price, brokerage and account type
Note: If you are not signed in to iCloud, the data stays on the device only. Data in iCloud may remain after you delete the app. To remove it, empty your lists in the app, or delete YuhoLAB's data from iOS Settings > [Apple ID] > iCloud > Manage Account Storage.
2.2 Communication with the operator's servers
To search and show stock and financial information, the app communicates with the operator's servers over HTTPS (encrypted). Requests carry only what is needed for the screen, such as search keywords, stock codes and screening conditions.
- Not sent: Personal settings and asset data such as shares held, acquisition price, brokerage and account type in your lists are not included.
- Verifying genuine use: To prevent abuse and confirm that requests come from the genuine app, Apple's App Attest and short-lived anonymous tokens are used. They are not used for advertising or tracking.
- IP address: In the course of communication, the connecting IP address and similar information temporarily reaches the server side. The operator does not permanently store IP addresses in its database.
2.3 Logs and identifiers kept on the servers
- Authentication identifiers: The key identifier and public key used by App Attest are kept on the servers to prevent abuse. They are not linked to personal information such as your name or Apple ID, and there are no accounts. They are not advertising identifiers and are not used for tracking through analytics or crash-reporting SDKs. Identifiers on the servers are not deleted automatically. Because there is no name or account, individual deletion requests cannot, in principle, be accommodated.
- Access logs: For stable operation and security, access logs may be kept temporarily by the hosting provider (Cloudflare). They contain access time, request content (which may include search terms and stock codes), response status and connection information. Under Cloudflare's specifications they are kept for up to 7 days and then deleted automatically.
2.4 Third-party services
The following external services are used. Only the data needed for each function is passed to them.
- Cloudflare: hosting and network security
- Fly.io and Neon: hosting of the YuhoLAB API server and database (what is stored is data built from disclosure filings, not user data)
- Apple (App Attest / iCloud): verifying genuine use of the app, and syncing data between devices
2.5 Deleting data
- Uninstalling the app removes the data stored in the app's area on the device (lists, holdings and so on). The anonymous token and App Attest record stored in the iOS Keychain may not be removed by uninstalling alone, and may remain until the OS or you remove them.
- Delete data remaining in iCloud as described in "2.1 Data stored on your device and in iCloud".
- Communication logs are deleted automatically after the retention period (up to 7 days).
2.6 Changes to this policy
This policy may be revised to reflect changes to the service or to the law. For important changes, the "Last updated" date on this page is updated.
3. YuhoLAB Connector (for AI assistants)
The YuhoLAB Connector (the "Connector") is an endpoint that lets AI assistants such as Claude read YuhoLAB data (https://mcp.yuholab.com/mcp, Model Context Protocol). This chapter covers how personal information is handled by the Connector.
3.1 Sign-in when connecting
When you connect the Connector to an AI assistant, you sign in with a Google account.
- What we receive: The user identifier that Google issues as a result of the sign-in, which is meaningful only within Google. We do not ask for or store your email address, name or profile picture.
- What we store: We do not store the user identifier itself, only a one-way hash computed with the operator's secret key. We also store an internal ID that the operator assigns (user and account), a record of the connection (the AI assistant that connected, creation time and expiry), and a hash of the token used to reconnect.
- Why sign-in is required: The iOS app confirms that it is the genuine app on a genuine device using Apple's App Attest. The Connector, used from AI assistants, cannot do this device check. So that excessive access can be limited and abuse prevented, sign-in is required for each person who connects, in order to tell whether requests come from the same person.
- How it is used: Only to treat connections from the same person as the same user, to revoke connections, to apply usage limits, and to prevent abuse.
3.2 Information that arrives from the AI assistant
- What we receive: When the AI assistant calls a Connector tool, the tool name and its arguments (stock codes, search terms such as company names, number of years, kind of breakdown and so on).
- What we do not receive: The text of your conversation, files, and the information you registered with the AI assistant do not reach the Connector. However, an AI assistant may put parts of the conversation into arguments such as search terms. Please do not include personally identifiable information in arguments.
- Handling inside the AI assistant: How conversations and Connector responses are handled inside the AI assistant follows the policy of its provider (Anthropic, for Claude).
3.3 Logs and usage counts
- Usage counts: To keep to usage limits, counts per internal ID and per tool are recorded.
- Logs: For stable operation and security, processing logs are kept by the hosting provider (Cloudflare). They contain time, internal ID, tool name, request content (which may include stock codes and search terms) and response status. They are kept for up to 7 days and then deleted automatically.
- What we do not do: The data is not used for advertising or tracking, and is not sold to third parties.
3.4 Third-party services
- Google: sign-in when connecting
- Cloudflare: hosting of the Connector and the authorization server, and storage of the data in 3.1
- Fly.io and Neon: hosting of the YuhoLAB API server and database (tool arguments are processed there)
Some of these providers process data on servers outside Japan. The operator does not provide or sell the data in 3.1 or 3.2 to them.
3.5 Disconnecting and deletion
- Disconnecting: Remove the Connector in your AI assistant's settings. A connection that is not used for 90 days expires automatically.
- Deletion requests: The data stored under 3.1 is not linked to an email address or name, and the operator cannot find the data of a specific person. Individual deletion requests therefore cannot, in principle, be accommodated. When you disconnect, that connection can no longer be used and its reconnection token is invalidated. For questions, contact support@yuholab.com.
- Logs: Deleted automatically after the retention period (up to 7 days).
4. Source of the data
The data that YuhoLAB shows and provides is extracted, processed and restructured by the operator from disclosure filings published on EDINET (Financial Services Agency). It is not the original EDINET filing itself.
Source: EDINET (Electronic Disclosure for Investors' NETwork) site, Public Data License (Version 1.0) (PDL1.0)
The operator edited and processed it to create this data. What has been edited or processed is not unprocessed information created by the national government (the Financial Services Agency).
5. Contact
- Email: support@yuholab.com
- App Store: the support link on the app page
- Terms of Use: YuhoLAB Terms of Use