Momentum Chimpanzee Privacy Policy

Revised: October 6, 2026. Document version: 2026-10-06.

1. Operator

The service is operated under the display name LittleWorks. Contact support.littleworks@gmail.com. To obtain the operator’s legal name and address, request them at this address; as described in our existing business information, we respond without undue delay by email.

2. Information handled

To provide the service, support and security, we handle provider identity, supplied name/email, Firebase UID, public ID, username, avatar, title/frame, profile settings, account status, dates and consent receipts; posts, comments, replies, optional stock symbols/company names and URLs, author identity, attention/reaction/report records; Forecast questions, choices, criteria, deadlines, resolution time, language/timezone, participation, creator results, Official revisions, fixed rewards and processing IDs; necessary historical AI evidence; Banana balances, ownership/equipment, exchanges, ledgers, receipts, login/invitation/reward records and duplicate-prevention limits; new-activity XP, levels and reached-level claims; private block IDs/state/requests, notification settings/tokens, moderation and necessary operational/security logs.

Public profiles show level and a progress bar, not XP counts or earning-condition lists. Do not enter others’ personal or confidential information. The limited text filter runs on the server; it does not send text to a new external AI service.

3. Authentication

We use supported Apple/Google and Firebase authentication. Provider identifiers, supplied name/email and account IDs support registration, access and linking. Apple private email is handled if supplied. Accounts are not merged solely by email text. We do not collect provider passwords. Phone/SMS registration is not offered.

4. Firebase

Firebase Authentication provides identity; Firestore stores posts, settings, balances and ledgers; Storage holds images; App Check/App Attest helps prevent unauthorized access; FCM supports notifications. Notification tokens and device/installation identifiers are used for delivery and settings. Google’s conditions may also apply.

5. Purposes

We use information for accounts, community/search/Calendar/Forecast/level/Store functions, balances/ownership/rewards and duplicate prevention, moderation/blocking/security, support and fault investigation, quality and legal/platform compliance.

6. Public information

Usernames, avatars, titles/frames, masked public IDs, level/progress, posts, Forecast answers/results/records and necessary dates may be visible to others. Private email, block lists and internal audit information are not public-profile fields. Others can save or share public content; deletion cannot retrieve every outside copy.

7. External links

Linked sites may be outside our control. Their cookies, tracking and data practices follow their own policies.

8. Forecasts, Bananas and levels

Regular creation is free, one per UID per JST day and unavailable while the author’s own Forecast is unresolved. Authors cannot participate in their own Forecasts. Authors manually finalize regular results; 300 plus their pre-creation level is frozen as the correct-answer reward. Official authors manually enter results and freeze a chosen reward at first resolution. The history keeps valid respondents to choices formally declared correct before or after a revision eligible for the amount fixed at first resolution, once per participant. Resending the same result does not make the opposite choice correct. Cancelled Forecasts have no reward.

New Forecast review, completion and resolution are not sent to AI by the app. For Official judgment outside the app, the operator provides only operator-created official questions/criteria and public material with no user information. Usernames, UIDs, participants, answer lists, Wallets and similar user data are not sent. There is no in-app Official AI connection.

Bananas are not cash or financial products; cash purchase, cash-out and user transfers are unavailable. Activity, rewards, XP/levels, limits, ownership and ledgers support consistency and audit.

9. Login and invitations

Eligible dates, invitation status, grants and necessary account-state records prevent duplicate benefits.

10. Store

The current product exchanges Bananas. It records ownership, costs, receipts and operation IDs. The current product does not provide Apple cash IAP checkout. Apple’s TestFlight Sandbox is distinct from Firebase Banana balances and ownership. We do not obtain card numbers or Apple passwords. We may be unable to delete third-party historical purchase records.

11. Age

The service is for adults aged 18 or over. The device evaluates the entered birth date; the server stores eligibility, policy version and confirmation time, not the birth date itself in the account document. Requirements may vary by law or platform.

12. Reports, blocking and safety

Reports store necessary author/target/content/time/status information. Blocking applies only to the viewer, not others’ accounts or feeds or established Forecast outcomes/payments. The deleting user’s private block settings and requests are deletion targets. Moderation may include review, removal/hiding and restrictions. Internal criteria and reporter identity may not be publicly disclosed.

13. Providers, AI and advertising

We do not sell personal information. Necessary service-provider processing, consented disclosures and legally required disclosures follow the scope described in this policy.

Avatar generation uses Google Cloud Vertex AI. Its inputs are server-selected category, composition/style and generation instructions; validation sends the generated image and validation instructions. We do not append username, UID, email, posts or users’ face photos to those AI requests. Firebase stores generated images and their ownership. Official off-app judgment is separate and limited to the non-personal information described in section 8.

Google Mobile Ads/AdMob and UMP support Thread/Calendar comment ads. They may process IP address/coarse location, device/app identifiers, impressions/clicks and interaction information, and diagnostic/performance data. The app has no GPS/precise-location feature or location-permission request. We do not add community UID, email, birth date, comment or Forecast text as custom advertising-targeting data.

Regional UMP consent and iOS ATT tracking permission are separate. Where required, Settings → Ad Settings opens Google’s privacy-choice form. Failed consent-state reads are retryable, not treated as permission unnecessary. IDFA is not sent when ATT is denied, undetermined or restricted; we do not bypass refusal with another tracking identifier. Ad personalization and publisher first-party ID are disabled, but this does not eliminate SDK data processing.

Requests follow UMP/SDK authorization, using non-personalized or limited ads when allowed. Missing consent is not overridden. Basic features remain available after refusal or an ad failure. Internal TestFlight and Simulator use Google’s official test ads. Production units are used only for a verified public App Store installation; uncertainty does not trigger production fallback. Consent changes discard old ads/responses before permitted refetching.

Providers also process access, authentication, notification, execution, security and diagnostic logs. Not every such record is advertising tracking. Apple/Google and other provider conditions may apply.

14. Retention

We retain records while needed for service delivery, safety, abuse prevention and legal compliance. We review that need and aim to delete information no longer required for its purpose or organize it by separating identifiers. Results, ledgers, consent history and audit records needed for consistency, disputes or legal obligations may be retained with restricted access. There is no single automatic deletion deadline for every record. Requests are handled according to necessity and law; external logs and backups follow each provider’s conditions.

15. Account deletion

Initiate deletion in Settings with your own reauthentication. Connection failure alone does not delete an account. Targets include Auth, profile, private images, notifications/settings, private blocking, private XP/level records, Wallet and ownership. Community/Forecast consistency, finalized results and payments, economic/audit records and deletion/moderation evidence may remain with restricted access, display changes or identifier separation. They are not all fully anonymous.

Only deletion while banned retains a keyed comparison of verified provider identity and minimal restriction metadata privately until BAN release. Legitimately linked providers are included. No new profile, email, phone, post or token is collected for this purpose. Ordinary deletion does not create this record. Later re-registration does not restore the deleted UID, Wallet or ownership. A keyed value is not automatically anonymous/non-personal. We cannot delete all third-party accounts, receipts or public copies.

16. Security

Authentication, access control, Security Rules and App Check are used according to the actual system. Reasonable safeguards cannot eliminate every device, network, OS or provider risk.

17. Posting precautions

Do not post others’ private/confidential information, infringing material or inappropriate material nonpublic facts. Public content can be copied and shared.

18. Investment information

This policy addresses information handling. Investment conditions, prohibitions and responsibility are set out in the Terms.

19. Requests

Contact support.littleworks@gmail.com for legally supported access, correction, deletion or processing-limitation requests. Necessary identity confirmation may be required. Third-party-controlled information may be outside our direct control.

20. Locations and international processing

We use Google Firebase/Google Cloud for Auth, Firestore, Storage, Functions, notifications, App Check and avatar generation. Major Firestore/Functions processing is in Tokyo. Google states that Firebase Authentication processes data in the United States. Notifications, App Check, AI, ads and diagnostics are not all confined to Japan; processing may occur overseas at Google or its subprocessors’ facilities under the applicable service terms.

Depending on the service, the Firebase Data Processing and Security Terms or Google Cloud Data Processing Addendum apply. These address processing instructions, safeguards, subprocessors, deletion and applicable international-transfer conditions. Google describes its encryption and access controls in Firebase’s privacy and security information. We use the authentication, limited permissions, Security Rules and App Check actually configured for this service. We do not claim to have implemented optional controls or certifications that we have not adopted.

AdMob/UMP and the Apple/Google authentication providers are also subject to their own terms and policies, including Google’s Privacy Policy; not all processing is solely on our instructions. We provide necessary information, seek applicable consent and review providers as required by law. Contact support.littleworks@gmail.com for specific handling and safeguard information.

21. Updates and consent

Material changes are explained with reasons and timing and necessary consent is sought. Page dates and recorded consent versions are managed separately; publication alone does not rewrite prior consent.

22. Contact

LittleWorks — support.littleworks@gmail.com.

Document version and canonical text

2026-10-06 · SHA-256: cb455e12571bc5c8f99a9f0607b793f51fc77db21c4203a1d683209402d4ea6c

# Momentum Chimpanzee Privacy Policy

Revised: October 6, 2026. Document version: 2026-10-06.

## 1. Operator

The service is operated under the display name LittleWorks. Contact support@littleworks.tech. To obtain the operator’s legal name and address, request them at this address; as described in our existing [business information](https://littleworks.tech/home/legal-tokusho/), we respond without undue delay by email.

## 2. Information handled

To provide the service, support and security, we handle provider identity, supplied name/email, Firebase UID, public ID, username, avatar, title/frame, profile settings, account status, dates and consent receipts; posts, comments, replies, optional stock symbols/company names and URLs, author identity, attention/reaction/report records; Forecast questions, choices, criteria, deadlines, resolution time, language/timezone, participation, creator results, Official revisions, fixed rewards and processing IDs; necessary historical AI evidence; Banana balances, ownership/equipment, exchanges, ledgers, receipts, login/invitation/reward records and duplicate-prevention limits; new-activity XP, levels and reached-level claims; private block IDs/state/requests, notification settings/tokens, moderation and necessary operational/security logs.

Public profiles show level and a progress bar, not XP counts or earning-condition lists. Do not enter others' personal or confidential information. The limited text filter runs on the server; it does not send text to a new external AI service.

## 3. Authentication

We use supported Apple/Google and Firebase authentication. Provider identifiers, supplied name/email and account IDs support registration, access and linking. Apple private email is handled if supplied. Accounts are not merged solely by email text. We do not collect provider passwords. Phone/SMS registration is not offered.

## 4. Firebase

Firebase Authentication provides identity; Firestore stores posts, settings, balances and ledgers; Storage holds images; App Check/App Attest helps prevent unauthorized access; FCM supports notifications. Notification tokens and device/installation identifiers are used for delivery and settings. Google's conditions may also apply.

## 5. Purposes

We use information for accounts, community/search/Calendar/Forecast/level/Store functions, balances/ownership/rewards and duplicate prevention, moderation/blocking/security, support and fault investigation, quality and legal/platform compliance.

## 6. Public information

Usernames, avatars, titles/frames, masked public IDs, level/progress, posts, Forecast answers/results/records and necessary dates may be visible to others. Private email, block lists and internal audit information are not public-profile fields. Others can save or share public content; deletion cannot retrieve every outside copy.

## 7. External links

Linked sites may be outside our control. Their cookies, tracking and data practices follow their own policies.

## 8. Forecasts, Bananas and levels

Regular creation is free, one per UID per JST day and unavailable while the author's own Forecast is unresolved. Authors cannot participate in their own Forecasts. Authors manually finalize regular results; 300 plus their pre-creation level is frozen as the correct-answer reward. Official authors manually enter results and freeze a chosen reward at first resolution. The history keeps valid respondents to choices formally declared correct before or after a revision eligible for the amount fixed at first resolution, once per participant. Resending the same result does not make the opposite choice correct. Cancelled Forecasts have no reward.

New Forecast review, completion and resolution are not sent to AI by the app. For Official judgment outside the app, the operator provides only operator-created official questions/criteria and public material with no user information. Usernames, UIDs, participants, answer lists, Wallets and similar user data are not sent. There is no in-app Official AI connection.

Bananas are not cash or financial products; cash purchase, cash-out and user transfers are unavailable. Activity, rewards, XP/levels, limits, ownership and ledgers support consistency and audit.

## 9. Login and invitations

Eligible dates, invitation status, grants and necessary account-state records prevent duplicate benefits.

## 10. Store

The current product exchanges Bananas. It records ownership, costs, receipts and operation IDs. The current product does not provide Apple cash IAP checkout. Apple's TestFlight Sandbox is distinct from Firebase Banana balances and ownership. We do not obtain card numbers or Apple passwords. We may be unable to delete third-party historical purchase records.

## 11. Age

The service is for adults aged 18 or over. The device evaluates the entered birth date; the server stores eligibility, policy version and confirmation time, not the birth date itself in the account document. Requirements may vary by law or platform.

## 12. Reports, blocking and safety

Reports store necessary author/target/content/time/status information. Blocking applies only to the viewer, not others' accounts or feeds or established Forecast outcomes/payments. The deleting user's private block settings and requests are deletion targets. Moderation may include review, removal/hiding and restrictions. Internal criteria and reporter identity may not be publicly disclosed.

## 13. Providers, AI and advertising

We do not sell personal information. Necessary service-provider processing, consented disclosures and legally required disclosures follow the scope described in this policy.

Avatar generation uses Google Cloud Vertex AI. Its inputs are server-selected category, composition/style and generation instructions; validation sends the generated image and validation instructions. We do not append username, UID, email, posts or users' face photos to those AI requests. Firebase stores generated images and their ownership. Official off-app judgment is separate and limited to the non-personal information described in section 8.

Google Mobile Ads/AdMob and UMP support Thread/Calendar comment ads. They may process IP address/coarse location, device/app identifiers, impressions/clicks and interaction information, and diagnostic/performance data. The app has no GPS/precise-location feature or location-permission request. We do not add community UID, email, birth date, comment or Forecast text as custom advertising-targeting data.

Regional UMP consent and iOS ATT tracking permission are separate. Where required, Settings → Ad Settings opens Google's privacy-choice form. Failed consent-state reads are retryable, not treated as permission unnecessary. IDFA is not sent when ATT is denied, undetermined or restricted; we do not bypass refusal with another tracking identifier. Ad personalization and publisher first-party ID are disabled, but this does not eliminate SDK data processing.

Requests follow UMP/SDK authorization, using non-personalized or limited ads when allowed. Missing consent is not overridden. Basic features remain available after refusal or an ad failure. Internal TestFlight and Simulator use Google's official test ads. Production units are used only for a verified public App Store installation; uncertainty does not trigger production fallback. Consent changes discard old ads/responses before permitted refetching.

Providers also process access, authentication, notification, execution, security and diagnostic logs. Not every such record is advertising tracking. Apple/Google and other provider conditions may apply.

## 14. Retention

We retain records while needed for service delivery, safety, abuse prevention and legal compliance. We review that need and aim to delete information no longer required for its purpose or organize it by separating identifiers. Results, ledgers, consent history and audit records needed for consistency, disputes or legal obligations may be retained with restricted access. There is no single automatic deletion deadline for every record. Requests are handled according to necessity and law; external logs and backups follow each provider’s conditions.

## 15. Account deletion

Initiate deletion in Settings with your own reauthentication. Connection failure alone does not delete an account. Targets include Auth, profile, private images, notifications/settings, private blocking, private XP/level records, Wallet and ownership. Community/Forecast consistency, finalized results and payments, economic/audit records and deletion/moderation evidence may remain with restricted access, display changes or identifier separation. They are not all fully anonymous.

Only deletion while banned retains a keyed comparison of verified provider identity and minimal restriction metadata privately until BAN release. Legitimately linked providers are included. No new profile, email, phone, post or token is collected for this purpose. Ordinary deletion does not create this record. Later re-registration does not restore the deleted UID, Wallet or ownership. A keyed value is not automatically anonymous/non-personal. We cannot delete all third-party accounts, receipts or public copies.

## 16. Security

Authentication, access control, Security Rules and App Check are used according to the actual system. Reasonable safeguards cannot eliminate every device, network, OS or provider risk.

## 17. Posting precautions

Do not post others' private/confidential information, infringing material or inappropriate material nonpublic facts. Public content can be copied and shared.

## 18. Investment information

This policy addresses information handling. Investment conditions, prohibitions and responsibility are set out in the Terms.

## 19. Requests

Contact support@littleworks.tech for legally supported access, correction, deletion or processing-limitation requests. Necessary identity confirmation may be required. Third-party-controlled information may be outside our direct control.

## 20. Locations and international processing

We use Google Firebase/Google Cloud for Auth, Firestore, Storage, Functions, notifications, App Check and avatar generation. Major Firestore/Functions processing is in Tokyo. Google states that Firebase Authentication processes data in the United States. Notifications, App Check, AI, ads and diagnostics are not all confined to Japan; processing may occur overseas at Google or its subprocessors’ facilities under the applicable service terms.

Depending on the service, the [Firebase Data Processing and Security Terms](https://firebase.google.com/terms/data-processing-terms) or [Google Cloud Data Processing Addendum](https://cloud.google.com/terms/data-processing-addendum/) apply. These address processing instructions, safeguards, subprocessors, deletion and applicable international-transfer conditions. Google describes its encryption and access controls in [Firebase’s privacy and security information](https://firebase.google.com/support/privacy). We use the authentication, limited permissions, Security Rules and App Check actually configured for this service. We do not claim to have implemented optional controls or certifications that we have not adopted.

AdMob/UMP and the Apple/Google authentication providers are also subject to their own terms and policies, including [Google’s Privacy Policy](https://policies.google.com/privacy); not all processing is solely on our instructions. We provide necessary information, seek applicable consent and review providers as required by law. Contact support@littleworks.tech for specific handling and safeguard information.

## 21. Updates and consent

Material changes are explained with reasons and timing and necessary consent is sought. Page dates and recorded consent versions are managed separately; publication alone does not rewrite prior consent.

## 22. Contact

LittleWorks — support@littleworks.tech.

# Momentum Chimpanzee Privacy Policy

Revised: October 6, 2026. Document version: 2026-10-06.

## 1. Operator

The service is operated under the display name Little Works. Contact support@littleworks.tech. To obtain the operator’s legal name and address, request them at this address; as described in our existing [business information](https://littleworks.tech/home/legal-tokusho/), we respond without undue delay by email.

## 2. Information handled

To provide the service, support and security, we handle provider identity, supplied name/email, Firebase UID, public ID, username, avatar, title/frame, profile settings, account status, dates and consent receipts; posts, comments, replies, optional stock symbols/company names and URLs, author identity, attention/reaction/report records; Forecast questions, choices, criteria, deadlines, resolution time, language/timezone, participation, creator results, Official revisions, fixed rewards and processing IDs; necessary historical AI evidence; Banana balances, ownership/equipment, exchanges, ledgers, receipts, login/invitation/reward records and duplicate-prevention limits; new-activity XP, levels and reached-level claims; private block IDs/state/requests, notification settings/tokens, moderation and necessary operational/security logs.

Public profiles show level and a progress bar, not XP counts or earning-condition lists. Do not enter others' personal or confidential information. The limited text filter runs on the server; it does not send text to a new external AI service.

## 3. Authentication

We use supported Apple/Google and Firebase authentication. Provider identifiers, supplied name/email and account IDs support registration, access and linking. Apple private email is handled if supplied. Accounts are not merged solely by email text. We do not collect provider passwords. Phone/SMS registration is not offered.

## 4. Firebase

Firebase Authentication provides identity; Firestore stores posts, settings, balances and ledgers; Storage holds images; App Check/App Attest helps prevent unauthorized access; FCM supports notifications. Notification tokens and device/installation identifiers are used for delivery and settings. Google's conditions may also apply.

## 5. Purposes

We use information for accounts, community/search/Calendar/Forecast/level/Store functions, balances/ownership/rewards and duplicate prevention, moderation/blocking/security, support and fault investigation, quality and legal/platform compliance.

## 6. Public information

Usernames, avatars, titles/frames, masked public IDs, level/progress, posts, Forecast answers/results/records and necessary dates may be visible to others. Private email, block lists and internal audit information are not public-profile fields. Others can save or share public content; deletion cannot retrieve every outside copy.

## 7. External links

Linked sites may be outside our control. Their cookies, tracking and data practices follow their own policies.

## 8. Forecasts, Bananas and levels

Regular creation is free, one per UID per JST day and unavailable while the author's own Forecast is unresolved. Authors cannot participate in their own Forecasts. Authors manually finalize regular results; 300 plus their pre-creation level is frozen as the correct-answer reward. Official authors manually enter results and freeze a chosen reward at first resolution. The history keeps valid respondents to choices formally declared correct before or after a revision eligible for the amount fixed at first resolution, once per participant. Resending the same result does not make the opposite choice correct. Cancelled Forecasts have no reward.

New Forecast review, completion and resolution are not sent to AI by the app. For Official judgment outside the app, the operator provides only operator-created official questions/criteria and public material with no user information. Usernames, UIDs, participants, answer lists, Wallets and similar user data are not sent. There is no in-app Official AI connection.

Bananas are not cash or financial products; cash purchase, cash-out and user transfers are unavailable. Activity, rewards, XP/levels, limits, ownership and ledgers support consistency and audit.

## 9. Login and invitations

Eligible dates, invitation status, grants and necessary account-state records prevent duplicate benefits.

## 10. Store

The current product exchanges Bananas. It records ownership, costs, receipts and operation IDs. The current product does not provide Apple cash IAP checkout. Apple's TestFlight Sandbox is distinct from Firebase Banana balances and ownership. We do not obtain card numbers or Apple passwords. We may be unable to delete third-party historical purchase records.

## 11. Age

The service is for adults aged 18 or over. The device evaluates the entered birth date; the server stores eligibility, policy version and confirmation time, not the birth date itself in the account document. Requirements may vary by law or platform.

## 12. Reports, blocking and safety

Reports store necessary author/target/content/time/status information. Blocking applies only to the viewer, not others' accounts or feeds or established Forecast outcomes/payments. The deleting user's private block settings and requests are deletion targets. Moderation may include review, removal/hiding and restrictions. Internal criteria and reporter identity may not be publicly disclosed.

## 13. Providers, AI and advertising

We do not sell personal information. Necessary service-provider processing, consented disclosures and legally required disclosures follow the scope described in this policy.

Avatar generation uses Google Cloud Vertex AI. Its inputs are server-selected category, composition/style and generation instructions; validation sends the generated image and validation instructions. We do not append username, UID, email, posts or users' face photos to those AI requests. Firebase stores generated images and their ownership. Official off-app judgment is separate and limited to the non-personal information described in section 8.

Google Mobile Ads/AdMob and UMP support Thread/Calendar comment ads. They may process IP address/coarse location, device/app identifiers, impressions/clicks and interaction information, and diagnostic/performance data. The app has no GPS/precise-location feature or location-permission request. We do not add community UID, email, birth date, comment or Forecast text as custom advertising-targeting data.

Regional UMP consent and iOS ATT tracking permission are separate. Where required, Settings → Ad Settings opens Google's privacy-choice form. Failed consent-state reads are retryable, not treated as permission unnecessary. IDFA is not sent when ATT is denied, undetermined or restricted; we do not bypass refusal with another tracking identifier. Ad personalization and publisher first-party ID are disabled, but this does not eliminate SDK data processing.

Requests follow UMP/SDK authorization, using non-personalized or limited ads when allowed. Missing consent is not overridden. Basic features remain available after refusal or an ad failure. Internal TestFlight and Simulator use Google's official test ads. Production units are used only for a verified public App Store installation; uncertainty does not trigger production fallback. Consent changes discard old ads/responses before permitted refetching.

Providers also process access, authentication, notification, execution, security and diagnostic logs. Not every such record is advertising tracking. Apple/Google and other provider conditions may apply.

## 14. Retention

We retain records while needed for service delivery, safety, abuse prevention and legal compliance. We review that need and aim to delete information no longer required for its purpose or organize it by separating identifiers. Results, ledgers, consent history and audit records needed for consistency, disputes or legal obligations may be retained with restricted access. There is no single automatic deletion deadline for every record. Requests are handled according to necessity and law; external logs and backups follow each provider’s conditions.

## 15. Account deletion

Initiate deletion in Settings with your own reauthentication. Connection failure alone does not delete an account. Targets include Auth, profile, private images, notifications/settings, private blocking, private XP/level records, Wallet and ownership. Community/Forecast consistency, finalized results and payments, economic/audit records and deletion/moderation evidence may remain with restricted access, display changes or identifier separation. They are not all fully anonymous.

Only deletion while banned retains a keyed comparison of verified provider identity and minimal restriction metadata privately until BAN release. Legitimately linked providers are included. No new profile, email, phone, post or token is collected for this purpose. Ordinary deletion does not create this record. Later re-registration does not restore the deleted UID, Wallet or ownership. A keyed value is not automatically anonymous/non-personal. We cannot delete all third-party accounts, receipts or public copies.

## 16. Security

Authentication, access control, Security Rules and App Check are used according to the actual system. Reasonable safeguards cannot eliminate every device, network, OS or provider risk.

## 17. Posting precautions

Do not post others' private/confidential information, infringing material or inappropriate material nonpublic facts. Public content can be copied and shared.

## 18. Investment information

This policy addresses information handling. Investment conditions, prohibitions and responsibility are set out in the Terms.

## 19. Requests

Contact support@littleworks.tech for legally supported access, correction, deletion or processing-limitation requests. Necessary identity confirmation may be required. Third-party-controlled information may be outside our direct control.

## 20. Locations and international processing

We use Google Firebase/Google Cloud for Auth, Firestore, Storage, Functions, notifications, App Check and avatar generation. Major Firestore/Functions processing is in Tokyo. Google states that Firebase Authentication processes data in the United States. Notifications, App Check, AI, ads and diagnostics are not all confined to Japan; processing may occur overseas at Google or its subprocessors’ facilities under the applicable service terms.

Depending on the service, the [Firebase Data Processing and Security Terms](https://firebase.google.com/terms/data-processing-terms) or [Google Cloud Data Processing Addendum](https://cloud.google.com/terms/data-processing-addendum/) apply. These address processing instructions, safeguards, subprocessors, deletion and applicable international-transfer conditions. Google describes its encryption and access controls in [Firebase’s privacy and security information](https://firebase.google.com/support/privacy). We use the authentication, limited permissions, Security Rules and App Check actually configured for this service. We do not claim to have implemented optional controls or certifications that we have not adopted.

AdMob/UMP and the Apple/Google authentication providers are also subject to their own terms and policies, including [Google’s Privacy Policy](https://policies.google.com/privacy); not all processing is solely on our instructions. We provide necessary information, seek applicable consent and review providers as required by law. Contact support@littleworks.tech for specific handling and safeguard information.

## 21. Updates and consent

Material changes are explained with reasons and timing and necessary consent is sought. Page dates and recorded consent versions are managed separately; publication alone does not rewrite prior consent.

## 22. Contact

Little Works — support@littleworks.tech.

Momentum Chimpanzee Privacy Policy (2026-10-06, English)

Effective October 8, 2026 — Banana grant clarification