Privacy Policy

We want you to be able to read this guide without being tracked as an individual. This page explains what information is processed when you visit, who receives it and what you can do about it.

Who we are

Okinawa Direct is a free, independent travel guide run by one person based in Japan. We are responsible for the information described on this page.

• Operator: Okinawa Direct (operated by an individual)
• Operator's name and address: we don't list them on the site, to protect the operator's home address. If we hold personal information about you (in practice, because you have written to us), you can ask for them through our contact form by choosing "Privacy request". Once we have confirmed the request comes from you, as described under Your rights, we will tell you without delay.

What we collect, and what we don't

We don't collect account, sign-up, comment or newsletter data. Apart from our contact form, the site has no forms, and we don't run advertising trackers. The site itself doesn't set cookies, and nothing on it stores data in your browser. To see which pages are read, we use cookie-free, privacy-focused page statistics, described below.

Some technical information is still processed when your browser loads a page, because that is how websites work:

• Our host. Cloudflare, the company that hosts and delivers this site, receives your IP address, browser type, the pages you request and the time of the request. It uses this to deliver the site and to protect it from attacks and abuse.
• Page statistics. Each page loads a small script from Cloudflare (Cloudflare Web Analytics, from static.cloudflareinsights.com). It reports how the page loaded and helps us count page views and visits. We see only totals, grouped by page, the site you came from, country, device type, browser and operating system. Cloudflare says this tool doesn't use cookies or other storage in your browser and doesn't fingerprint visitors for its analytics, and we can't use it to follow one person from page to page. Cloudflare also shows us overall traffic totals for the site, such as the number of requests and the countries they come from, from the delivery information described above.
• YouTube. Some pages have videos. A video isn't loaded until you press its play button, so until then your browser doesn't contact YouTube or Google. When you press play, the YouTube player loads in privacy-enhanced mode (youtube-nocookie.com) and starts the video; from then on, YouTube and Google handle your data under their own policies.

If you write to us through the contact form, we receive what you type into it: your name if you give it, your email address and your message.

The contact page also runs Cloudflare Turnstile, a security check that tells people apart from spam bots. It loads only on the contact page. To do its check, it sends Cloudflare technical signals from your browser, such as your IP address, browser type and a technical fingerprint of the secure connection. We have set it up so that it doesn't place Cloudflare's clearance cookie in your browser.

We don't sell or share personal information for advertising.

Do Not Track and Global Privacy Control: we don't track visitors across websites or build profiles of individuals, and our page statistics are only totals, so there is no tracking for these browser signals to turn off. We treat every visitor as if the signal were on.

Why, and on what legal basis

We use the technical information above only to deliver the site, show its videos, keep it secure and see, in totals, which pages are read so we can improve the guide, and we use the Turnstile check only to keep spam out of our inbox. For readers in the European Union or the United Kingdom, the legal basis is our legitimate interest in running a working, secure website. If you contact us, we use your name, email address and message only to reply, on the same basis. To help us answer general messages, an AI assistant reads them and drafts a reply (see Who receives it); a person who runs this site checks and edits every reply before it is sent. Privacy requests are different: only the person who runs this site reads and answers them (see Your rights).

Who receives it

• Cloudflare, our hosting provider, to deliver and protect the site and to produce our page statistics, under Cloudflare's Privacy Policy.
• Cloudflare also runs our contact form. Turnstile checks that a person is sending the form (see Cloudflare's Turnstile privacy addendum), and Cloudflare's email service passes your message on to our inbox. Cloudflare handles this data for us, and its addendum says it may also use the Turnstile signals to improve its bot detection.
• Google (Gmail), which hosts the email account we use to read and answer messages.
• Anthropic (Claude), whose AI assistant reads general messages (not privacy requests) to draft our reply. We use it through the Anthropic API, Anthropic's service for businesses, under its commercial terms and Anthropic's Privacy Policy. Under those terms Anthropic handles what we send on our behalf, as our data processor, and doesn't use it to train its AI models. The assistant never sends anything by itself, and we don't send Anthropic ratings or feedback about its replies.
• Google (YouTube, only after you press play on a video), under Google's Privacy Policy and its explanation of how Google uses information from sites that use its services.

Where your message goes

Everything you send through the contact form passes through companies based in the United States. Cloudflare checks the form and delivers your message, Google stores it in our Gmail inbox, and Anthropic's AI assistant, Claude, reads general messages to help us draft a reply (it doesn't read privacy requests). These companies may store and process it in the United States and in other countries. The details from the Turnstile check go to Cloudflare in the same way.

Privacy law in the United States works differently from Japan, the EU or the UK. There is no single, comprehensive federal privacy law. Instead, personal information is protected by federal laws that each cover one area, such as electronic communications, finance or health, and by state laws such as California's Consumer Privacy Act. Japan's Personal Information Protection Commission publishes a summary of the US rules (in Japanese): Foreign systems: United States (Japanese). That summary reflects the Commission's survey as of October 2021.

Like any company, these providers can be required to hand over data under the law where they operate, for example in response to a court order or another binding request from a government. Google's privacy policy says it may share information to respond to legal process or enforceable government requests, and Cloudflare publishes regular transparency reports on the requests it receives. The Commission's summary doesn't list any US system that obliges companies to cooperate with government information gathering in a way that seriously affects people's rights. The Commission notes, however, that its survey looked only at representative laws and is not complete, so this doesn't mean no such system exists.

What each company says it does to protect your information:

• Cloudflare says in its privacy policy that it takes reasonable steps to protect the information it receives, that people can ask it to access, correct or delete their personal information, and that it follows the EU–U.S. Data Privacy Framework for transfers, with standard contractual clauses as a fallback. Its Turnstile addendum adds that it handles the security-check signals on our behalf, and also uses them itself to improve its bot detection.
• Google says in its privacy policy that it builds security into its services, encrypts data in transit and limits staff access to personal information to those who need it. It also says it complies with legal frameworks for data transfers.
• Anthropic says that, under its commercial terms, it doesn't use what we send to train its models and deletes it from its systems within 30 days. The exceptions include cases where its safety systems flag a possible breach of its usage policy, where the law requires it to keep data longer, and ratings or feedback, which we don't send. Its data processing addendum, which includes standard contractual clauses for transfers, lists its security measures, such as access controls and encryption.

For transfers from the EU or UK, each provider relies on its own legal safeguards, described in its privacy policy.

Your choice: for a question, a correction or anything else, the form asks you to tick a box confirming that you understand all of this before it sends. For a privacy request, you don't have to tick it. Choose "Privacy request" on the form, and the person who runs this site will read and answer it personally, with no AI assistant involved. Because the form delivers every message by email, a privacy request still passes through Cloudflare and Google as described above.

How long it is kept

We don't keep a database of visitors, and we have switched off Cloudflare's optional request logs for this site, so we don't keep server logs ourselves. Our page statistics show only totals, never a record of one person's visit. Cloudflare keeps the data it processes under its own privacy policy; it doesn't publish a fixed number of days, and says it keeps personal information only as long as its stated purposes require.

The contact form doesn't save your message anywhere. It checks the message and passes it straight on by email. Cloudflare may keep a record of the delivery under its own policies. In our inbox, messages are kept only as long as needed to deal with them. Google keeps data under its own policies. Anthropic deletes the messages we send it within 30 days, apart from the exceptions described under Where your message goes.

How we protect it

Messages are read only in an email account used for nothing but this site. The email account and our Cloudflare account are both protected with two-step verification, and only the person who runs this site can read your messages, along with the AI assistant that drafts our replies to general messages. The secret key for the form's security check is kept in Cloudflare's encrypted settings, not in our code. Apart from that assistant, we don't copy your messages into other systems, and we delete them once we no longer need them.

How to limit what is shared

Our typefaces are served from this site itself, not from Google Fonts, and videos load only when you press play, so simply reading a page doesn't contact Google. If you block static.cloudflareinsights.com in your browser, the page statistics script doesn't run and the pages still work. If you never press play, no information goes to YouTube. You can also block youtube-nocookie.com in your browser; the pages still work. Turnstile runs only on the contact page, so if you don't open that page, it isn't loaded.

Your rights

Depending on where you live, you may have rights over your personal information:

• EU and UK: you can ask for access to, correction of or deletion of your personal data, ask us to restrict its processing, ask for a copy in a portable format, object to its processing, and complain to your local data protection authority.
• California and other US states: you can ask what personal information we have about you and ask us to delete it. We don't sell or share personal information.
• Japan: under the Act on the Protection of Personal Information, you can ask us to disclose, correct, add to or delete, or stop using or providing personal information we hold about you. If we hold personal information about you, you can also ask for the operator's name and address, and once we have confirmed it is you, we will tell you without delay.

Because we don't keep visitor records ourselves and our page statistics are only totals, in most cases the only personal information we hold is a message you have sent us.

How to make a request: send it through our contact form and choose "Privacy request". You don't need to tick the consent box, and no AI assistant reads your request; the person who runs this site handles it personally. Tell us what you would like us to do, and help us find your message, for example with the date you wrote to us and the email address you used. To make sure the request really comes from you, we will usually reply to that email address before acting on it. We will answer without undue delay.

Children

This site is a general travel guide and is not directed to children under 13. We don't knowingly collect personal information from children. If you believe a child under 13 has sent us personal information, for example through our contact form, contact us and we will delete it.

Future changes

If we add other analytics, advertising or affiliate tracking, we will update this page before turning them on, and record the change below.

• 2026-10-12: First version of this policy.
• 2026-10-12: Typefaces are now served from this site instead of Google Fonts.
• 2026-10-12: Added rights to restriction and portability, browser privacy signals, and how we handle messages from children.
• 2026-10-12: Videos now load only when you press play.
• 2026-10-13: You now contact us through a contact form instead of email. Added how we protect your messages and how to make a request.
• 2026-10-13: An AI assistant (Claude, by Anthropic) now helps us read messages and draft replies. A person checks every reply before it is sent, and we have turned off the setting that would let Anthropic train its models on our conversations.
• 2026-10-13: Named the operator, our host and our contact form provider (Cloudflare). Explained the Turnstile security check on the contact page, how long Cloudflare keeps data, and how to ask for the operator's name and address.
• 2026-10-13: Added "Where your message goes", which explains that the companies handling your message are based in the United States and how US privacy law differs. The contact form now asks you to confirm you understand this before it sends.
• 2026-10-13: Our AI assistant now runs on the Anthropic API under Anthropic's commercial terms, which don't allow training on what we send and delete it within 30 days, with limited exceptions. Added what Anthropic does to protect your information.
• 2026-10-13: Privacy requests can now be sent without ticking the consent box. Only the person who runs this site reads them; the AI assistant doesn't.
• 2026-10-18: Added cookie-free page statistics (Cloudflare Web Analytics) and Cloudflare's overall traffic totals, which show us only totals of which pages are read, never one person's visits. We also use Google Search Console, which shows us how often the site appears in Google Search; it doesn't add anything to our pages.

Contact

For privacy questions or requests, please use our contact form.

We don't publish an email address on this site. We reply from an email account used only for this site.

Last updated: October 18, 2026.