Privacy Policy

Last updated: August 2026

1. Who we are

otakko is a personal anime tracking web application operated by an individual based in Spain. For any questions about this policy, contact us at contact@otakko.app.

2. What data we collect

We collect and process the following personal data:

  • Account information: Email address, display name, and password hash (for email/password accounts) or Google profile data (for Google sign-in)
  • Profile data: Avatar image URL, bio (optional)
  • Usage data: Anime tracking entries (titles, episodes watched, ratings, status), library metadata
  • Technical data: Session tokens (JWT), timestamps of account activity

3. Why we collect it (legal basis)

We process your data based on:

  • Contract performance (Art. 6(1)(b) GDPR): To provide the anime tracking service you signed up for
  • Legitimate interest (Art. 6(1)(f) GDPR): To improve the service and prevent abuse
  • Consent (Art. 6(1)(a) GDPR): For optional features like email notifications

4. How we store your data

Your data is stored in a PostgreSQL database hosted by Neon (neon.tech) in the EU region. The application is deployed on Vercel. All data is transmitted over HTTPS.

5. Third-party services

We use the following third-party services:

  • Google OAuth: For sign-in with Google (processes your Google email and profile picture)
  • AniList API: For anime data (no personal data is shared)
  • Resend: For sending verification and notification emails
  • Vercel: For hosting and deployment
  • Neon: For database hosting (EU region)

6. Cookies

We only use essential cookies required for authentication (session token). We do not use tracking cookies, analytics cookies, or advertising cookies. No consent banner is needed because we only use strictly necessary cookies.

7. Your rights (GDPR)

Under the General Data Protection Regulation, you have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Erase your data / right to be forgotten (Art. 17)
  • Restrict processing (Art. 18)
  • Data portability — receive your data in a structured format (Art. 20)
  • Object to processing (Art. 21)

To exercise any of these rights, email contact@otakko.app. We will respond within 30 days.

8. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently removed within 30 days. Anonymized aggregate data (community scores) may be retained.

9. Data security

Passwords are hashed using bcrypt. All connections use TLS/HTTPS. Access to the database is restricted to the application only.

10. International transfers

Some services (Vercel, Google) may process data outside the EU. Where this occurs, it is covered by Standard Contractual Clauses (SCCs) or the service's EU-US Data Privacy Framework certification.

11. Children

Our service is not directed at children under 16. We do not knowingly collect data from children. If we become aware of such collection, we will delete the data.

12. Supervisory authority

If you believe your rights have been violated, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):
www.aepd.es

13. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a notice on the platform.