In this article
On October 20, 2026, we revised our Terms of Service, Privacy Policy and related billing disclosures. This notice explains our security work and the changes customers should review.
This article does not announce a data breach. It explains the security measures we have consistently pursued and our approach to strengthening them.
Why we rebuilt the VoicePing 3.0 backend
Since VoicePing 2.0, we have repeatedly observed suspicious access resembling automated vulnerability scanning. This was one of the reasons for completely rebuilding the backend for VoicePing 3.0.
We use frontier AI models to assist development and security review alongside open-source penetration-testing tools. We have tested systems within our defined scope from internal and external perspectives, and implemented protections against cross-site scripting (XSS), SQL injection and parameter tampering that could bypass authorization.
Defenses implemented and improvements underway
We have implemented alerts for suspicious access and warning signs, automatic IP blocking based on detection rules, and logic that supports detecting and investigating suspected account impersonation.
We are currently expanding detection and blocking capabilities across the many servers we own and operate. We are also developing layered containment and mitigation measures to limit the impact if an intrusion occurs.
We will continue security reviews, testing and remediation as AI models improve and new vulnerabilities emerge. Testing reflects its scope and timing; it does not guarantee protection against every future attack.
Unauthorized access, reverse engineering and IP restrictions
Article 22 of the Terms prohibits conduct and attempts such as:
- Unauthorized reverse engineering or extraction intended to obtain or reproduce nonpublic internals, source code, model weights, system prompts or credentials, including through AI or automation tools.
- Bypassing authentication, permissions, billing, usage limits or other safeguards, or accessing data and features without authorization.
- Excessive or repeated access that harms security or availability, and evading restrictions through another account or connection source.
We do not permit service use from IP addresses reasonably identified through access records and other objective evidence as used for unauthorized access or attempts. We block those connections within a necessary and proportionate scope.
API and MCP use within published specifications, ordinary analysis of data you are authorized to access, and security testing we approve are outside these prohibitions. Using AI, a VPN or a shared network alone is not a violation. We review reports of mistaken restrictions, including shared or reassigned IP addresses, and remove or correct restrictions when an error is confirmed.
Refunds and settlement after termination for serious violations
Unnecessary charges caused by our system failures or bugs will be investigated and corrected, canceled or refunded. Refunds arising from our payment or cancellation defects carry no processing or handling fees. If payment failed and we received no money, we check the billing record and make any necessary correction.
Refunds for customer convenience are generally unavailable. If we voluntarily make an exception where no refund is owed, we may deduct actual unrecovered Stripe processing costs and a JPY 2,000 tax-inclusive handling fee, after advance itemized disclosure and agreement, within applicable legal and payment-service limits. Deductions cannot exceed the refund amount, and we do not bill a shortfall separately.
For a business customer whose contract is lawfully terminated for a serious violation, fees for the contractual one-month segment containing the termination date are nonrefundable under Article 13 . Prepayments for subsequent unprovided periods are returned after lawful settlement. Consumer contracts have separate settlement conditions under that article. Suspicion or a temporary restriction alone does not forfeit prepayments for unprovided services.
Cancel, switch to Free or delete accounts within the app
For plans ordered and paid for in the app, the contracting customer or authorized administrator must complete ordinary cancellation, stopping automatic renewal and changing to Free through Billing. We do not accept or perform these ordinary operations by email, including replies to billing or notification messages. Procedures separately agreed in individual contracts continue to apply.
Authorized customers must also perform ordinary workspace and user-account deletion within the app. We do not carry out ordinary deletion operations in response to email requests. If our system failure or bug prevents an operation, support will review the situation and take necessary action after verifying identity and authority.
Uninstalling the app or removing a payment card does not cancel a paid plan. Check the subscription status and cancellation result after completing the procedure. Requests to erase personal information and valid personal-data deletion requests are handled separately under the Privacy Policy, rather than as ordinary app-operation assistance.
How we handle security records
IP addresses, access times, authentication outcomes, detection results, restrictions and appeal-handling records are used to detect, prevent and investigate unauthorized access. We limit this processing to the scope and period necessary for security, subject to the retention and deletion conditions in our Privacy Policy .
Review the revised documents
This article summarizes the changes. Please consult the documents for the full conditions. If you suspect a defect or want a restriction reviewed, contact us through the support form .
