Privacy Policy

1. Introduction

"M" / TSUNAGI ("we", "us", or "the Service") recognises the importance of protecting personal information and establishes and observes this Privacy Policy.

This Policy applies to the Service as a whole — not only to our website (m3.tsunagi.app, "the Site"), but also to the applications we publish ("the App"; see "9. How the tuning tool handles information") and to the builds of the applications we provide as an owner feature, called WORKS ("the WORKS builds"; see "10. How the WORKS builds handle information").

2. Definition of personal information

▶︎ What counts as personal information

In this Policy, personal information means the following:

  • Name
  • Email address
  • Telephone number
  • Postal address
  • Vehicle Identification Number (VIN)

The VIN is also a value the App reads from the engine control unit (DME) and displays on screen. How the App handles it is set out in "9. How the tuning tool handles information".

3. Purposes of use

▶︎ How we use personal information

We use personal information for the following purposes:

  • Responding to enquiries and providing information
  • Confirming, shipping and supporting products and services
  • Maintaining records of work performed
  • Reference material in blog articles: we may edit and adapt our correspondence with you (the content of enquiries, consultations, and information relating to work performed) into a form in which you cannot be identified — with your name, contact details, VIN and similar withheld — and publish it in our blog articles or other content, in order to inform other customers and improve the Service. If you would prefer your information not to be used in this way, please let us know in advance.
  • Public listing on "MESH": the handle you enter at payment as a Minds contributor, and the name to list, address, website URL, contact, social account URLs and logo you register as a Masters node, are published on MESH at your request. A social account is only used to work out which service it belongs to, from the URL’s own domain, so that an icon can be shown; we do not connect to any of those services. A listing has no term and continues unless you ask for it to be withdrawn. Your name, email address and payment details are not published. To have a listing withdrawn, contact "18. Contact (data controller)".
  • Vehicle identification number (VIN): you may enter one on the Minds join form, optionally. Neither we nor the payment processor stores the VIN entered on the form itself. It is converted on our side into a value it cannot be recovered from, and only that value is stored. It is used for one thing: recognising several payments as coming from the same person, so the years and the number shown are that person's. The VIN is never published. A VIN contained in a record sent by a WORKS build, by contrast, is stored as it is, with that record (see "10. How the WORKS builds handle information"). The two are never matched against each other.
  • MILEAGE (where the MILE goes): which lines you chose is stored alongside the record of the payment. Only the total and the number of supporters per line are published, together with the names, in order, of those who agree to be named in an app’s credits as set out in the next item; who placed how much on what is not. Some lines ask, in a free-text field, which language, for example, you would like; what you write there is not published and is used only to see what to build next.
  • Names in an app’s credits: if you buy MILE for a line that is an app and agree to “Name me in the credits of the apps I back”, the handle you are listed under on MESH (for Masters, the name listed) is shown in that app’s credits screen. Names are ordered by the MILE placed on that line, most first; the MILE itself is not shown. Nobody is named whose handle is blank, who is not listed on MESH, or who has not agreed. The list is also published at /api/credits on this site, and each app writes the list as it stands into the app itself each time it is released. Withdrawing your agreement or your listing therefore takes effect from each app’s next update, and earlier versions keep the name.
  • Using owner features, and restoring them: those who have bought MILE are given the owners page "Master" and the owners' builds of the apps (the WORKS builds). For that purpose we store the record of the purchase and a "recovery code", which is what restores access on another device. The recovery code is a random value generated by us and contains nothing about you. Only a value derived from it with a key is used for matching, and the copy shown back to you on Master is stored encrypted. So that you can see and remove the devices you use, we store, for each device, its kind (for example "iPhone · Safari") and the date it was last used. The kind is only a name worked out from what the browser sends; what the browser sends is not itself stored. We also store the email address entered at payment, encrypted, with only a value derived from it with a separate key used for matching. The address is used to contact you about your purchase — nothing else. It is never published, and never used for advertising or for a mailing list. Master is kept in a private store and served only after the buyer has been authenticated; it is not published and not registered with search engines. The record of a purchase includes, for the purchase slip, a copy of what you entered when you joined (your handle or workshop name, your choices about listing and credits, and the lines you chose) and a “purchase number”. The purchase number identifies the purchase for enquiries; on its own it opens neither Master nor the WORKS builds. The “purchase slip” (購入控え), which brings together the purchase and your recovery code, is shown on screen only after you have been authenticated, and is never sent by email. Once you have saved it, keeping it safe is up to you.
  • Keeping what the WORKS builds send, investigating faults, and analysing drives: records sent by a WORKS build are stored so that you can open them on your other devices, and are used to investigate faults in the tools and improve them. In TUNER, when you ask us to, we analyse the records of a drive and add what we find to its CO-WORK record. The details are in "10. How the WORKS builds handle information".
    Note: where a recovery code, or a link for adding a device, is entered, we briefly store a value derived irreversibly from the connecting IP address, together with a count, so that repeated attempts can be limited (for at most two hours). The IP address itself is not stored, and this value is not linked to any other record.

4. Provision to third parties

▶︎ When we disclose

We do not disclose or provide personal information to third parties except in the following cases:

  • Where you have consented
  • Where required by law
  • Publication on MESH (handle, listing details) and in an app’s credits is made at your own request and with your agreement, and falls under "where you have consented" above.

5. Disclosure, correction, deletion and suspension of use

▶︎ Responding to your requests

Where you request disclosure, correction, addition, deletion or suspension of use of your own personal information, we will verify your identity and respond promptly. Requests should be directed to the contact in "18. Contact (data controller)".

6. Use of cookies (the Site and the WORKS builds)

This section concerns the Site (m3.tsunagi.app) and the authentication of the WORKS builds. The App uses no cookies at all — see "9. How the tuning tool handles information".

▶︎ Cookies we set ourselves

For the purpose of understanding how the Site is used and improving its content, the Site sets cookies issued by Google Analytics 4 (GA4) — those beginning with _ga and _ga_ — on our own domain.
What is recorded is statistical information: which pages were viewed, time on page, referrer, approximate region, and device and browser type. It does not include information that identifies an individual, such as a name or email address.
We do not use it to serve advertising or to identify individual readers on an ongoing basis.
Details, and how to stop this collection, are given in "8. Analytics and advertising (the Site)".

▶︎ Cookies for owner features

For those who have bought MILE, the Site sets an authentication cookie so that the owners' page "Master" and the owners' builds of the apps can be used.
It is issued at the moment you come back to the Site after paying, and at the moment access is added on another device, either with a link handed over from a device that already has it or with the recovery code. While you use it, it is set again with the same value to extend its expiry. It is issued at no other time.
When it is issued or set again, the device's current time is sent to the Site and compared with the server's clock, to check that the device's clock is right. It is only compared, never stored. Browsers work out a cookie's expiry from the device's own clock, so a cookie issued while that clock is far out would expire the moment the clock is put right. While the device's clock is out by a day or more, the cookie is not issued, and the Site waits for the clock to come right.
It holds a random value with no meaning of its own — no name, no email address, nothing about what was bought. It is set so that JavaScript cannot read it (HttpOnly) and is never sent to any domain other than this Site.
Its only use is to confirm that this browser belongs to the person who bought. It is never used to follow what you read, to serve advertising, or to match you against any other site.
It expires 180 days after it was last used. You can delete it in your browser settings, or switch it off at any time with "Sign this device out" (この端末の認証を解除) under Devices (端末) on Master. Other devices can be removed from the same Devices list. Deleting the cookie does not take away what you bought, or the right it carries. On another device, or after deleting it, access can be restored at any time with a link handed over from a device that has it, or with the recovery code shown on Master. Restoring does not require you to receive any email.
When a purchase is started, a separate temporary cookie is set to recognise the browser the payment began in (a random value only; it expires after 24 hours), and a note that a payment is in progress is kept in this browser's local storage. The note exists so that, if you close the page after paying, your purchase is still recognised the next time you open the Site; it is removed once the purchase is recognised, when the payment is cancelled, or after 24 hours.

▶︎ Cookies for the WORKS builds

To confirm that a WORKS build is being used by an owner, each WORKS build sets an authentication cookie on its own address, for that address only. It is issued when you first open the WORKS build and the Site confirms your access, and while you use it, it is set again with the same value at most once a day to extend its expiry. As with the cookie for owner features, the device's current time is sent when it is issued or set again, to check the device's clock (it is not stored), and it is not issued while the clock is out by a day or more. It holds only a random value with no meaning of its own, is set so that JavaScript cannot read it (HttpOnly), and is never sent to any address other than that WORKS build's. It expires 180 days after it was last used. Alongside it, a WORKS build sets a temporary cookie while it is confirming with the Site (encrypted random values only; it expires after 10 minutes), and a cookie recording the date the authentication cookie was last renewed. For the assistant link in TUNER WORKS (see "10. How the WORKS builds handle information"), the relay server sets, on its own address and only while you connect it to an AI assistant, temporary cookies showing that consent and sign-in are in progress (random values only; they expire after 10 minutes). Using "Sign this device out" (この端末の認証を解除) under Devices on Master also ends the WORKS builds' authentication on that device, within a minute. A WORKS build you have already installed keeps opening, and the data on your device stays usable.

▶︎ Cookies set by third parties

If you click an affiliate link in an article, the affiliate service provider (ASP) and the merchant you are taken to may set cookies in order to measure the referral.
Those cookies are controlled by those companies; we neither obtain nor hold their contents.
Cookies can be disabled in your browser settings.

7. Affiliate programmes (the Site)

This section concerns the Site. The App is provided free of charge, and neither the App nor the WORKS builds contain advertising or affiliate links of any kind.

▶︎ Programmes we participate in

The Site participates in the following affiliate programmes, and may receive a referral fee from the merchant when we introduce a product or service:

  • Rakuten Advertising (LinkShare)
  • Rakuten Affiliate
  • A8.net
  • AliExpress Affiliate Program

▶︎ Disclosure and neutrality

  • Articles containing affiliate links carry a "PR" notice at the top of the body text.
  • Affiliate links carry rel="sponsored" for search engines.
  • Which products we feature, and how we assess them, is our own judgement, regardless of whether a referral fee is involved.
  • Purchasing through a link never changes the price you pay.
  • Referral fees received are put towards the research, development and running costs of the Service.

▶︎ Information we receive

Click and conversion data is aggregated by each ASP; what we receive is only the resulting number of conversions and the amounts. We never receive information that identifies a purchaser.

8. Analytics and advertising (the Site)

This section concerns the Site. Neither the App nor the WORKS builds perform analytics or advertising.

▶︎ The analytics tool we use

The Site uses Google Analytics 4 (GA4), an analytics tool provided by Google.
We use it to understand which pages are read and how much, and to improve our articles and site structure.
For this purpose GA4 uses cookies and records the pages viewed, time on page, referrer, approximate region, and device and browser type.
This data is processed statistically and does not include information that identifies an individual, such as a name, email address or telephone number. Nor do we link this data to personal information entrusted to us through enquiries or otherwise.
For how Google handles this data, please see Google's Policies and Terms.

▶︎ If you would rather not be counted

You can stop this collection at any time, by your own action:

  • Install Google's Google Analytics Opt-out Browser Add-on
  • Disable cookies in your browser settings, or browse in private / incognito mode
  • Delete the cookies stored for this site from your browser settings

None of these will impair your ability to read our content.

▶︎ Advertising

The Service does not currently use any advertising service (such as Google AdSense).
If we introduce one in future, we will update this Policy beforehand and state the name of the service and the purpose of its use.

9. How the tuning tool handles information

▶︎ Applications covered

This section applies to the following applications we publish for everyone ("the App"). It does not apply to the WORKS builds, which are covered by "10. How the WORKS builds handle information".

  • MSS54HP CSL CONVERT /// TUNER (https://mss54hp-csl-convert-tuner.tsunagi.app/)
  • The PWA installed from the above to your home screen
  • The Android application wrapping the above (package name app.tsunagi.e46m3.launcher)

The App is provided free of charge and requires no account registration, sign-in or licence activation.

▶︎ All processing happens inside your browser

There is no server or database operated by us behind the App.
The ECU binaries (BIN) and datalogs (CSV) you load, the tuning data you create, and the information read from your vehicle are all processed and stored on your own device, and are never uploaded anywhere — including to us.

▶︎ What is stored on your device

The App creates the following three databases in your browser's IndexedDB. All of them exist only on your own device:

  • mss54hp-tuner-db — tuning sessions: the 64 KB BASE and TUNED ECU binaries, their paired datalogs, VE maps, tune settings, SHA-256 hashes, flash history, and adaptation-reset records
  • mss54hp-tuner-live — a recovery buffer for a datalog in progress (written roughly every 5 seconds, so that an unexpected browser or tab closure does not lose the recording)
  • mss54hp-tuner-backups — backups of the DME service block (16 KB) taken before erasing

It also stores the following values in your browser's localStorage. All of them exist only on your own device and are never sent:

  • e46m3csl:disclaimer-ack — whether you accepted the first-run disclaimer and chose not to show it again
  • e46m3csl:guide-seen — whether you have closed the "How to use" guide shown right after you accept the disclaimer
  • e46m3csl:map-zoom — the zoom level of the map display
  • mss54hp.verifyPolicy.v1 — the vehicle identification numbers (VINs) of DMEs written with FULL verification where both the read-back and the checksum matched; used to make QUICK the default verification the next time you write to that DME

Apart from the list of VINs, none of these identifies an individual.

▶︎ Information read from the vehicle (DME)

When connected to a vehicle, the App reads the following from the engine control unit (DME) and displays it on screen:

  • Vehicle Identification Number (VIN), AIF records, software number, and write count (flash counter)
  • Operating data while a datalog is being recorded: engine speed, load, short-term fuel trim (STFT), oxygen sensor values, and coolant temperature

As stated above, these are only stored on your device and are never transmitted.
Furthermore, the App does not obtain location, road speed, odometer reading, or diagnostic trouble codes (DTCs).

▶︎ Connecting to the vehicle

The App communicates with the DME over a K+DCAN cable (using the K-line DS2 protocol) via the following standard browser APIs:

  • Web Serial API (primarily on desktop)
  • WebUSB API (primarily on Android)

In both cases a connection is made only when you explicitly select and authorise the device in the dialog your browser presents. You can revoke that permission at any time from your browser settings.
The App does not access Bluetooth, location, camera or microphone.

▶︎ Exports you initiate

The following happen only when you press a button. They are exports on your own device, not transmissions:

  • Downloading a BIN, a datalog CSV, or a service block. The service block filename contains the Vehicle Identification Number (VIN).
  • Copying the parsed service-block report to the clipboard. That content contains the Vehicle Identification Number (VIN).

Storing and sharing the exported files is under your control. Please bear in mind that they contain the VIN if you share them with a third party.

▶︎ Network communication

The only external communication the App performs is a single request to the App's own address, to check whether a newer version exists. That request contains no identifiers and no parameters of any kind.

Accordingly, the App uses no cookies, no analytics, no advertising, no crash reporting, no cloud synchronisation, and no third-party CDNs or scripts.

▶︎ Hosting

The App is served from GitHub Pages (GitHub, Inc.). The ordinary connection records that accompany serving any website (such as IP addresses) are handled under that company's control, and we have no means of accessing them.

▶︎ How to delete your data

All data the App has stored can be erased by clearing the App's site data (IndexedDB and localStorage) from your browser settings. The retention period is under your control; we set none.

▶︎ Disclaimer regarding use of the App

The App erases and writes to the ECU, and may cause serious consequences including immobilising the vehicle. Use is at your own risk, and we accept no liability whatsoever.
Please use tuning only within legally permitted purposes, such as competition and off-road use. Responsibility for compliance regarding public-road use, emissions and safety standards rests with the user.
For details, see the Terms of Service and "13. Disclaimer".

10. How the WORKS builds handle information

▶︎ Applications covered

This section applies to the WORKS builds of the following applications, which we provide to those who hold the owner features (those who have bought MILE, and owners whose cars we have worked on and whom we have confirmed separately):

  • MSS54HP CSL CONVERT /// TUNER — WORKS (https://mss54hp-csl-convert-tuner-preview.pages.dev/)
  • E46M3 /// MONITORING — WORKS (https://e46m3-monitoring-preview.pages.dev/)
  • E46M3SMG2 /// MAPPING — WORKS (https://e46m3smg2-mapping-preview.pages.dev/)
  • MSS54HP CSL CONVERT /// BOOT — WORKS (https://mss54hp-csl-convert-boot-preview.pages.dev/)
  • E46 M35080 /// MIGRATION — WORKS (https://e46-m35080-migration-preview.pages.dev/)
  • The PWA versions of the above, installed by adding them to a home screen

The WORKS builds are under development, and what they contain changes without notice. Their source code is published under the MIT licence.

▶︎ Confirming access

A WORKS build is delivered only after the Site has confirmed that you can use the owner features. The first time you open one, it passes through the Site to confirm this, and an authentication cookie is set on the WORKS build's own address (see "6. Use of cookies"). The confirmation happens when a new version is fetched or updated. Opening a WORKS build you already have, talking to the car, and using the data on your device need no confirmation.

▶︎ What is sent

So that what you save opens on your other devices, and so that faults can be investigated and the tools fixed, the WORKS builds send the following to our server:

  • Sessions you save: sent when you choose to save one (SYNC; UPLOAD in BOOT). In TUNER, also when you confirm a request to send through the assistant link.
    • TUNER: drive and idle logs (drives recorded one after another in the same session are each kept separately), the CO-WORK record (see "CO-WORK"), the BASE BIN read and the TUNED BIN written (64 KB), the vehicle identification number (VIN) and the software number
    • MONITORING: fault-memory (DTC) reads, datalogs (engine speed and other running data), the communication log, and the ECU identification (including the VIN)
    • SMG2 MAPPING: the image read from the SMG II ECU, the ZB number, the manufacturer data, the values you edited, and the read log
    • BOOT: the 1 MiB DME backup (including the VIN, the AIF record and the flash counter) and the log of the session
    • M35080 MIGRATION: the cluster EEPROM image (including the last seven characters of the VIN and the mileage) and the backup, rewrite and restore history
  • Error records: sent automatically — by TUNER after each operation, by SMG2 MAPPING after each read and whenever something fails, and by MONITORING, BOOT and M35080 MIGRATION when something fails. They contain the outcome and any error text, the connection type, transfer timings and retries, an excerpt of the communication, and the identifying values above such as the VIN, software number and ZB number. M35080 MIGRATION's error records also carry the mileage and the bridge (Arduino) firmware version. Without a connection they are kept on the device and sent at the next opportunity.
  • Read records (MONITORING): every read sent to the vehicle and its outcome, sent automatically whether it succeeded or failed. When you clear a fault memory on the screen, the clear (the frame sent and the bytes that came back) and the fault codes read again automatically right after it are sent too. They contain the frame sent, the bytes that came back, the road speed read just before sending, the module and job names, the time, and the record of reads that answered with the car stationary (the verification ledger). Depending on the module and job read, the bytes that came back include identifying values (which may include the VIN). They are for establishing which reads may be sent to a vehicle, for confirming that a clear took effect, and for fixing the tool. Without a connection they are kept on the device and sent at the next opportunity.
  • Investigation records (MONITORING): when you hand over an investigation (see "Handing over an investigation"), its CO-WORK record (the mandate, plans, step marks, findings, questions and answers, and notes of your own words) and the data PROBE took are sent automatically, so that this service's development environment can carry the investigation on. Once you withdraw the mandate or it passes its time limit, that investigation's records stop being sent. Without a connection they are kept on the device and sent at the next opportunity.
  • Requests and fault reports (MONITORING): only when you tell the assistant about a request or a fault in the tool and confirm that it should be sent, its content and the evidence for it are sent (see "Requests and fault reports").
  • Both carry the app version. The browser type (user agent) is added to both by SMG2 MAPPING and BOOT, and to error records only by M35080 MIGRATION; TUNER and MONITORING do not send it.

The first time you open a WORKS build, the WORKS build itself tells you what it sends and why, and sending starts only after you have seen that. No location, name or email address is sent.

▶︎ Assistant link (TUNER and MONITORING WORKS)

TUNER WORKS and MONITORING WORKS have a feature (ASSISTANT) that lets an AI assistant you have connected (claude.ai and others) ask questions of the WORKS build you have open. It is off by default, and works only on a device where you have switched it on. Before you switch it on, the WORKS build tells you on screen what it sends and where.

  • How it works: you connect our relay server (the TSUNAGI///Matrix bridge, run on Cloudflare Workers) to your AI assistant by signing in with your account on this site, and switch ASSISTANT on in the WORKS build. The assistant's questions then reach the WORKS build through the relay, and its answers return the same way. When it connects, the WORKS build tells the relay a random number that tells devices apart, and whether it was opened from the head unit (the head unit's launcher). The relay keeps these in memory only, and uses them only to accept the same device reconnecting and to prefer the head unit.
  • What is sent (TUNER): only when the assistant asks, the WORKS build's state (the device's name — the one you gave it, or a default such as the head unit's, whether it is connected to the vehicle, whether a data log is recording, the mode, the view on screen, the open session, the number and duration of samples, the software number), the list of sessions saved on that device (each session's number and name, when it was made, its mode, and whether it holds a BIN and a data log and how many samples) and parts of the data log it has recorded (engine speed, load, throttle opening, filling, fuel trims, ignition timing, knock records, gear, road speed, exhaust temperature, coolant and intake temperature, manifold pressure, cam target and actual angles and similar), the calibration items of the open session's BIN that the assistant asks about (each item's name, description, address, units and values, and the values changed in that session), the observation mode's plan and record (the byte values of the addresses specified, and the marks), the contents of the CO-WORK record and the stretches of the recording data log that meet a plan step's conditions (found by the device), a summary of a whole data log (a thinned time series; the time spent and the mean fuel trim in each cell of engine speed and load; and when fuel cuts, gear changes, knock and marks happened), the state of the VE map's correction (each cell's value in the BIN and the newly calculated value, the size of the correction, the number of samples, whether it can be written and why not, and whether the write is set to include it), and the list of sessions stored on this service's server (each one's name, when it was made and sent, its state, and whether it holds a tune and a data log and how many samples). The VIN and file names are not sent.
  • What the assistant can do (TUNER): read the above, start and stop a data log (stopping only after you confirm it, by voice or otherwise), change the view on screen, open a saved session, start a new session or copy one (not while a data log records or the vehicle link is busy), drop unsaved changes, set the plan for a drive (including the observation mode's plan), put marks on a data log while it records, write in the CO-WORK record (notes of your own words, steps marked done, findings, questions and answers), change what the WORKS build shows on screen (a step's target, the list of steps, values it names, the graph), change calibration values of the open session (placed on the calibration screen as changes), save the session (SAVE, recorded in the session on the device), send to this service's server (SYNC), bring a session stored on the server back into the device, disconnect the vehicle cable, reconnect a cable you have already allowed on the screen, and switch to the MONITORING WORKS build. These happen only when you ask for them or confirm them, by voice or otherwise, and, except for marks, notes, steps marked done and changes to what is shown, not while a data log records. Anything that loses something (dropping unsaved work, sending over a newer copy another device sent, replacing the device's copy by bringing one back, stopping a data log) is always read back for you to confirm. What is sent or brought back passes directly between the WORKS build and this service's server, not through the relay. It cannot write to or flash the vehicle, or allow a new device to connect. You do those on the screen. The vehicle changes only when you write to it on the screen.
  • What is sent (MONITORING): only when the assistant asks, the WORKS build's state (the device's name — the one you gave it, or a default such as the head unit's, whether it is connected to the vehicle, which module it is connected to, whether it is recording, whether the car is standing still and its road speed, the view on screen), the fault codes read from each module and their descriptions, parts of the data log and of the read results it has recorded, the list of episodes recorded automatically on the device (their automatic names, their times, and how many of each kind of record they hold), the jobs each module can be read with or tested with and their descriptions (from the catalogue the WORKS build carries), the state of the verification ledger, and the CO-WORK record. The VIN is not sent.
  • What the assistant can do (MONITORING): read the above (including reading every module's fault codes in turn), start and stop a recording (stopping only after you confirm it, by voice or otherwise), run the plan of an investigation you handed over (PROBE; stopping only after you confirm it, by voice or otherwise), change which module the screen shows (when connected to the vehicle, it disconnects and connects again to that module through the same cable), write investigation plans, findings and questions for you in CO-WORK (a plan that reads the car stays within an investigation you handed it; see "Handing over an investigation"), change what is shown on screen, put an actuator test or adjustment procedure on the screen (without running it), save a session and send it when you ask (including choosing an automatically recorded episode to save), reconnect a cable you have already allowed on the screen and disconnect it (while recording, only after you confirm the recording may stop), switch to the TUNER WORKS build, and send a request or fault report you have confirmed. It cannot allow a new device to connect, run an actuator test, an adjustment or a fault-memory clear, or write to or flash any ECU. You do those on the screen, with the car stationary. Only reads are sent to the vehicle, and the WORKS build decides which may be sent (a read limited to a stationary car is sent only after the road speed has been read just before it).
  • What the relay stores: questions and the WORKS build's answers are handled in memory only while being relayed, and are neither stored nor logged. Only what the link itself needs is stored: the registration of the AI assistant's app, the identifier and display label of your account on this site, an encrypted record of your sign-in on this site, and credentials converted for matching. It is stored in a Cloudflare, Inc. data store (Workers KV), and a link expires after at most 90 days. For MONITORING, the list of tools and the procedure text the WORKS build declares are also stored, per account, in the same company's Durable Objects, so that the assistant can be given them while the WORKS build is not open. They are the app's own text and contain none of your records. Signing the device out under "Devices" in Master makes the link unusable within a minute.
  • Where answers go: the WORKS build's answers reach the AI service you connected, and are handled under that provider's (Anthropic, OpenAI and others) terms and privacy policy. We do not control how they are handled there.
  • Stopping: switch ASSISTANT off in the WORKS build, or disconnect the relay from your AI assistant.

▶︎ Handing over an investigation (MONITORING WORKS only)

In MONITORING WORKS, when you hand the assistant a fault to investigate (for example "DSC seems to cut in early in slow corners — find out why and what to do", "carry on with it"), your words are kept in the CO-WORK record as a mandate, and within it a plan of reads from the vehicle is made and the investigation goes on.

  • Who carries it on: your AI assistant, and this service's development environment (AI the operator uses, including Anthropic's Claude). The development environment reads the records of the investigation handed over (its CO-WORK record, its read records and data logs) from this service's server, adds plans and findings, and fixes faults and missing features in the tool. It does not read records that were not handed over. The VIN and other identifying values in the read records are removed before they reach the development environment.
  • Scope: only reads from the vehicle can go into a plan. Anything outside it (anything other than a read, a different investigation, one past its time limit) is left in CO-WORK as a question for you, and waits for your answer. A read sent while the car moves is one you have allowed to be sent while moving.
  • It never tells you how to drive. While you drive, the WORKS build records by itself when a plan's condition occurs (for example, slow speed with a large steering angle). A plan starts running when you press PROBE on the screen, or when the assistant starts it within an investigation you handed over.
  • The record: the mandate and the investigation's plans, step marks, findings, questions and answers, and notes of your own words are kept on your device as its CO-WORK record and sent automatically (see "What is sent"). Entries are only ever added, never rewritten, and each carries who wrote it and when. Notes of your words, and the mandate, are made only from your own words.
  • Stopping: withdraw the mandate in CO-WORK, stop PROBE on the WORKS build's screen, or ask the assistant to stop it.

▶︎ Requests and fault reports (MONITORING WORKS only)

In MONITORING WORKS, when you tell the assistant about something you want from the tool or something wrong with it (a value it cannot read, an error, a job that is missing, a screen that is hard to follow), its content and the evidence for it are sent to this service's development environment and used to fix the tool.

  • What is sent: your request in your own words, the evidence for it (which screen, which module and job, which error, and the related read records and error records), and the app version.
  • When: only when you have told the assistant and confirmed that it should be sent. The assistant never sends one on its own judgement.
  • Who reads it: this service's development environment (AI the operator uses, including Anthropic's Claude) reads it and fixes the tool. The VIN and other identifying values are removed before it reaches the development environment. Your assistant only gathers and sends the request; it does not touch the tool's code.
  • How fixes reach you: there is one WORKS build, so a fix reaches everyone who uses it. Fixes of faults, translations and procedure text, and new read-only jobs (only those that pass the WORKS build's check of what may be sent) go out without waiting for the operator. Changes to screens and operation, changes that add kinds of things sent to the vehicle (anything other than reads), changes to what is sent or stored, and changes to the gate, sign-in or delivery go out only after the operator has confirmed them.
  • Other owners: the content of a request and its evidence are not shown to other owners.
  • Stopping: if you send no request, nothing is sent. To have a request you sent deleted, contact us via "18. Contact (data controller)" or Discord.

▶︎ Observation mode (TUNER WORKS only)

TUNER WORKS has a mode (OBSERVE) that records RAM addresses of the engine computer (DME) that you specify (up to four, up to 4 bytes each) as the raw byte values read, alongside engine speed, load and throttle opening. It is for finding out what a value not yet understood means, so what it records depends on the addresses you specify. The record also contains the text of the marks you put on it (a step finished, for example). The observation plan (the addresses and the steps) is kept in the CO-WORK record. The record is stored on your device like any other data log, and is sent only when you choose to save it (SYNC), or when your assistant asks for it through the assistant link. Observation mode does not write to the vehicle.

▶︎ CO-WORK (TUNER WORKS only)

TUNER WORKS has a record (CO-WORK) for each session, in which your AI assistant and you (and the operator, when you ask us) write down the plan for a drive and what came of it. You never need to operate the screen while driving: your assistant writes in the record and changes what the screen shows.

  • What it holds: the plan for a drive (its purpose, hypothesis, steps, the criteria for judging it, and the observation mode's addresses), each step marked done and when (your assistant marks it, from your words or from a stretch of the recorded data that meets the step's conditions), notes of what you said (in your own words, with the data log's time), and findings, questions and answers (including whether each is a fact or an interpretation, and which stretch of data it rests on). Each entry carries who wrote it (you, your AI assistant, or the operator) and when.
  • Who can write in it: your AI assistant (through the assistant link; it writes down your words and what you ask for) and the operator (only when you ask us to analyse a session; we add to the record stored on this service's server). CO-WORK on the screen only shows the record; nothing can be written from the screen. Notes of your words are made only from your own words.
  • Entries are only ever added, never rewritten. Deleting a session deletes its record.
  • Storage and sending: the record is kept on your device, and sent with the session when you choose to save it (SYNC, including when you ask for that through the assistant link). A record on the server is brought into the device when you open the session, when you SYNC, and when the assistant reads the record.
  • What the screen shows: the WORKS build shows, in the upper part of DASH, what your assistant chooses (the current step's target and whether engine speed and opening are within it, the list of steps, values it names, the graph). It also changes it when you ask by voice. Changing what is shown happens on the device only and sends nothing.
  • Notes keep your words as you said them. Please do not say anything you would not want kept, such as people's names or places. Audio itself is never sent (turning speech into text is done by the AI service you use).

▶︎ Purposes of use

  • So that you can open your records on your other devices (saving and restoring)
  • To investigate faults in the tools and improve them
  • To answer questions from your own AI assistant (assistant link)
  • To analyse a drive when you ask us to, and add what we find to its CO-WORK record (TUNER)
  • To carry on an investigation you handed over and add what is found to its CO-WORK record, and to establish which reads may be sent to a vehicle and fix the tool (MONITORING)
  • To fix the tool from your and other owners' requests and fault reports, and put the fixes into the WORKS build (MONITORING)

They are not used for anything else. They are never published, sold or used for advertising, and are never linked with information about the use of the App (the public build).

▶︎ Where it is kept, and who can see it

In a database run by Cloudflare, Inc. (D1, Asia-Pacific region), kept separately per account. Only you and the operator can see what is stored; no other user can.

▶︎ Retention and deletion

You can delete saved sessions and error records in the WORKS build at any time. To have everything deleted, or to stop the use of your data, contact "18. Contact (data controller)" or us on Discord; we will verify your identity and act on it. Even if you do not delete them, records are deleted within 90 days of the owner features ceasing to apply to you, or of the WORKS build being withdrawn.

▶︎ What is stored on your device

A WORKS build stores its records on your device (IndexedDB; in TUNER and MONITORING, the CO-WORK record too) and keeps up to the 20 most recent error records it could not send. TUNER WORKS and MONITORING WORKS record in local storage that you switched ASSISTANT on, the device's name, a random number that tells devices apart, and whether it was opened from the head unit. Deleting that WORKS build's site data in your browser settings removes all of it.

MONITORING WORKS automatically records on your device each read made outside an investigation you handed over (see "Handing over an investigation") and its result: connecting and disconnecting, fault codes read, data logs, learned values, the results of procedures, the communication log and the ECU's identification, including the VIN. It divides them into episodes, such as from connecting to disconnecting. An episode you do not save (SAVE) is deleted from your device automatically 7 days after it was recorded. An episode recorded before your device's clock was set is deleted 7 days after the clock is set, because the time it was recorded is not certain. An episode is sent to our server only when you save it and then choose SYNC. Read records are sent automatically, as described under "What is sent".

▶︎ Hosting

The WORKS builds are served from Cloudflare Pages (Cloudflare, Inc.).

11. How the calculations for AI assistants (TSUNAGI///Matrix) handle information

▶︎ What this covers

  • The npm packages "matrix-tsunagi" and "matrix-tsunagi-migration", and the MCP servers you run with them on your own machine
  • The remote MCP server we operate (https://matrix-mcp.tsunagi.app/mcp/mapping), which AI assistants such as ChatGPT connect to

Both make the calculations of our tools, such as the tuning tool, available to AI assistants. There are no accounts and no sign-in.

▶︎ Running it on your own machine

All calculation happens on your own computer, and nothing is sent to us. The results go to the AI assistant you use, and how it handles them is governed by that service's terms and policies. Results never include the VIN or the DME's identity record.

▶︎ Using the remote MCP server

  • What we receive: the files you attach in your AI assistant and hand to a tool (a DME BIN, a drive-log CSV, an SMG II image and its definition file). Our server fetches them from the temporary download URL the AI service issues.
  • Purpose: only to return the result of that request.
  • Storage: calculation happens in memory, and neither the files nor the results are stored. We do not write their contents to any database or storage, and we do not log them.
  • What it does not accept: cluster EEPROM and DME backups (MIGRATION) carry a VIN and a mileage, so the remote server does not accept them. They can only be used on your own machine.
  • Provision to third parties: none.
  • Hosting: it runs on Cloudflare Workers (Cloudflare, Inc.). Ordinary connection records that come with delivery (IP addresses and the like) are handled under that company's control.

▶︎ Relationship with the AI service

Uploading files and keeping the conversation happen on the AI service's side, and are governed by that service's terms and policies.

12. Copyright

▶︎ Rights and quotation

Copyright and portrait rights in the content published by the Service (articles, images, video and so on) belong to us or to the rightful rights holders.
Reproduction without permission is prohibited; quotation requires attribution and a link to the Service.
Where there is a problem, we will respond promptly upon contact from the rights holder.

13. Disclaimer

▶︎ Scope of disclaimer

While we strive to provide accurate information, the content published by the Service may contain errors or out-of-date material. All information we provide (data, manuals and so on) is reference material and carries no guarantee of outcome. Any damage arising from work or decisions made on the basis of that information is entirely the user's responsibility.
We accept no responsibility whatsoever for information or services provided by sites reached through links from the Service.
Problems and faults arising from work performed are entirely the user's responsibility. We will, however, cooperate towards a resolution, with any costs so arising borne by the user.
For oils we sell, judging suitability is the user's responsibility, and we accept no responsibility for problems following use. Damage or loss in transit is subject to the carrier's compensation scheme.

14. Security measures

▶︎ Measures to protect personal information

We take the following security measures in order to handle personal information safely:

  • Encryption of communications, by SSL and similar
  • Management of server access privileges
  • Measures to prevent unauthorised access
  • Security training for administrators
  • Records of the owner features and the WORKS builds are kept separately per account, and every read and write checks who is asking, so that nobody but the owner and the operator can reach them

Our processor Cloudflare, Inc. is a company in the United States; the data of the owner features and the WORKS builds is stored in its Asia-Pacific region. We use it having checked that country's arrangements for the protection of personal information.

15. Outsourcing

▶︎ Subcontracting and personal information

We may outsource part of our operations (server management, payment processing and so on) to external contractors.
Where we do, we conclude a confidentiality agreement with the contractor and supervise them appropriately.

Our principal contractors at present are:

  • Payment processing: Stripe (Stripe, Inc. and Stripe Payments Japan K.K.). The payment pages on this site are operated by Stripe; card numbers and other payment details never pass through our servers.
  • Storage and delivery of MESH data: Cloudflare, Inc. (D1 database and R2 storage, Asia-Pacific region). What is stored is the Stripe transaction identifier, the handle, and the name to list, address, website URL, contact, social account URLs and logo, anything written in a line's free-text field, and whether you agreed to be named in an app’s credits. No email address is used for the public MESH listing, and none is ever listed there.
  • Storage and delivery of owner features: Cloudflare, Inc. (as above). The record of a purchase (including its purchase number and a copy of what you entered), the encrypted recovery code and the value derived from it for matching, the encrypted email address and the value derived from it for matching, the authentication sessions with each device's kind and date of last use, and the value used to match links for adding a device are stored in D1. Master's articles and files are kept in a separate R2 store that is never published, and are served only after authentication. No external email provider is involved in restoring owner features.
  • Delivery of the WORKS builds and storage of their data: Cloudflare, Inc. (Pages and D1, Asia-Pacific region). Each WORKS build's authentication sessions, and the records described in "10. How the WORKS builds handle information", are stored.
  • Operating the remote MCP server: Cloudflare, Inc. (Workers). As set out in "11. How the calculations for AI assistants (TSUNAGI///Matrix) handle information", the files it receives and its results are not stored.
  • Relaying the assistant link: Cloudflare, Inc. (Workers, Durable Objects, Workers KV). As set out in "10. How the WORKS builds handle information", questions and the WORKS build's answers are not stored; only what the link itself needs is (for MONITORING, including the list of tools and the procedure text the WORKS build declares).
  • Analysing investigations handed over, and improving the tool: Anthropic, PBC (Claude). Used when this service's development environment reads the records of an investigation you handed over, and the requests and fault reports you sent, in MONITORING WORKS ("Handing over an investigation" and "Requests and fault reports" in "10. How the WORKS builds handle information").

16. Children's privacy

▶︎ Collection of information from children under 13

The Service does not knowingly collect personal information from anyone under 13 years of age.
Should any such collection come to light, we will delete it promptly.

17. International users' rights and cross-border transfers

▶︎ Scope

The App is available worldwide. This section sets out matters applying to users resident outside Japan.

▶︎ Cross-border transfers

As set out in "9. How the tuning tool handles information", data handled in the App never leaves your device. Accordingly, no cross-border transfer of personal data by us arises in connection with use of the App.

Only where you browse the Site may statistical information obtained by Google through GA4 be processed by that company in the United States or elsewhere. For details, see "8. Analytics and advertising (the Site)".

Where you use MESH, payment details may be processed by Stripe, and the details published on MESH stored by Cloudflare, in the United States or elsewhere (see "15. Outsourcing"). Where you use a WORKS build, the records it sends are processed by Cloudflare and stored in its Asia-Pacific region (see "10. How the WORKS builds handle information"). Where you use the remote MCP server, the files you hand it may be processed at Cloudflare locations in any country, and are not stored (see "11. How the calculations for AI assistants (TSUNAGI///Matrix) handle information"). Where you use the assistant link in TUNER WORKS, the WORKS build's answers are relayed through Cloudflare locations in any country (and not stored), and may be processed in the United States or elsewhere by the provider of the AI service you connected (see "10. How the WORKS builds handle information").

▶︎ If you are in the European Economic Area (EEA) or the United Kingdom

Under the GDPR and the UK GDPR you have the right to request access to, rectification of, erasure of, restriction of processing of, and portability of your personal data, to object to processing, and to lodge a complaint with your local supervisory authority.
We hold personal data subject to these rights only where you have provided it to us directly, such as through an enquiry, or where you use the owner features or the WORKS builds. Please direct requests to "18. Contact (data controller)".

▶︎ If you are in California

We do not "sell" or "share" personal information as those terms are used in the CCPA and CPRA.
For rights to know and to delete, please likewise contact us at "18. Contact (data controller)".

18. Contact (data controller)

▶︎ Controller and contact details

Please direct enquiries about this Policy, and requests for disclosure, correction or deletion of personal information, to:

  • Controller: Kazuhiro Muto ("M" / TSUNAGI)
  • Address: 609-1 Shirasu, Hakushu-cho, Hokuto-shi, Yamanashi 408-0315, Japan
  • Email: m3@tsunagi.app

Full business details are given in the Japanese Specified Commercial Transactions Act disclosure.

19. Changes to this Privacy Policy

▶︎ Review and revision

The Service complies with the laws of Japan, and will review and seek to improve this Policy as necessary.
The current version is published on this page as it is revised.

▶︎ Language versions

This Policy is published in Japanese and in English.
In the event of any discrepancy between the two, the Japanese version prevails.