Privacy policy

What we keep

• Your account: your university email, username, name, and your password (stored only as a secure hash, never as you typed it). If you sign in with Google, we get your name, email and profile photo from Google, and Google's sign-in tokens.
• What you post: your reviews and verdicts, the reviews you like, and your list (watching, completed, paused, dropped). Club leads' weekly suggestions and club verdicts too.
• Sign-ins: for each signed-in device, its IP address, browser and when it signed in. We use these to keep your account safe and show them in the sign-in code email, so you can spot a sign-in that wasn't you. Sign-ins last up to 30 days.
• Sign-in codes and email links: the 6-digit codes are stored only as a hash and deleted once used (they expire after 10 minutes). Confirmation and password-reset links expire after 24 hours and 1 hour.

What other members can see

Your profile shows your username, profile photo, when you joined, your reviews and verdicts, and your list. Your email address and real name are never shown to anyone.

Cookies

We use only the cookies the site needs: one that keeps you signed in, one that remembers light or dark mode, and a short-lived one while you sign in with Google. No advertising or analytics cookies.

Who else handles your data

The site runs on these services, which only use the data to provide their part:

• Vercel hosts the website, and Render runs the server behind it (in Singapore).
• Neon stores the database (in Singapore).
• Brevo sends our emails: sign-in codes, confirmations and password resets.
• Google, if you choose to sign in with Google.
• Have I Been Pwned checks whether a new password has appeared in a data breach. Only the first 5 characters of a scrambled (hashed) version of it are sent, never the password itself.
• AniList provides the anime and manga information. If you import your AniList list, we use your AniList username to fetch your public list, and don't keep the username.

Links to streaming and reading sites take you to those sites, which have their own privacy policies.

Your choices

• Change your username or password in Settings, where you can also sign out every other device.
• Delete your account in Settings at any time. Your reviews, likes, list and sign-ins are deleted with it. Club suggestions and verdicts a club lead gave stay, without their name.
• For anything else, such as a copy of your data, ask a club lead.

Changes

If this policy changes, we'll update this page and its date. For a big change, we'll tell members on the site first.