Privacy policy

This policy explains what personal data DonOtaku (donotaku.com) collects, what it is used for and what rights you have. The short version: we only keep what the service needs to work, we do not sell your data and we do not record which pages you visit.

1. Who is responsible for your data

DonOtaku. For anything related to your data, use our contact form.

2. What data we collect and why

If you create an account

• Account details: email, username, the name you sign with (if any) and your password, which is never stored as such: we only keep a one-way hash (Argon2id). The history of your usernames is also kept, to deal with impersonation.
• Preferences: language, country, time zone, who can see your country and whether you want to see adult content.
• Your list: the works you add, their status, your rating, whether they are favourites and your progress, plus the date of each change of status, rating or favourite.
• Comments you publish, and the «likes» and reports you make.
• Security: your open sessions (IP address, browser and last activity), a log of logins and account changes (with IP and browser) and, if you enable it, the two-step verification secret and your recovery codes (these, hashed).

If you just browse

• We do not ask you for any data and we do not record which pages you visit.
• The server keeps technical logs (IP address, requested address, browser) to keep the site running and to detect abuse.
• We count how many times each news article is read, as one daily total per article, without linking it to any person.
• If you try to log in or register, the IP address and email used are recorded to stop repeated attempts.

If you write to us

• From the contact form we receive your name, email, reason and message, plus the IP address and your account if you are logged in, by email. We use them only to reply to you and keep them for as long as it takes to deal with your request.

3. Legal basis

• Performance of the service you request when creating the account: your account, list, comments and preferences.
• Legitimate interest in keeping the service and its users safe: sessions, access logs, attempt limits, technical logs and moderation.
• Legal obligation, when a law requires us to keep or provide data.
• Consent, if we ever use cookies or tools that require it (see section 7).

4. How long we keep it

• Account data, list and comments: while the account exists. If you ask us to delete it, we delete it, except what the law requires us to keep.
• Sessions: they expire after 30 days of inactivity or when you log out.
• Server technical logs: a few weeks.
• Login attempts: only as long as needed to stop attacks.

5. Who we share it with

We do not sell or give your data to anyone for their own purposes. Some providers process it on our behalf, only to provide the service:

• OppaHost: hosting of the website, the database and email, in the European Union.
• Cloudflare: content delivery network and protection against attacks. Visits pass through its network, which processes the IP address.
• iDrive e2: storage of the site's images, in the European Union.

We will only disclose data to authorities when required by law.

6. International transfers

Cloudflare may process data outside the European Economic Area. It does so under the safeguards provided by the GDPR (the EU-U.S. Data Privacy Framework and standard contractual clauses).

7. Cookies and local storage

We only use what is necessary for the site to work:

• sesion (cookie): keeps you logged in. Only if you log in; lasts 30 days.
• tz (cookie): your browser's time zone, to show dates and schedules in your time.
• Local storage of your browser: light or dark theme, catalogue filters (they expire after 30 minutes) and panels you have folded. It never leaves your device.

Today we do not use analytics or advertising cookies. If we add them, we will ask for your consent before loading them.

8. Third-party content

Some pages embed videos (YouTube in privacy-enhanced mode, Vimeo, Dailymotion, Twitch) or posts from social networks (X, Instagram, TikTok). When they load, those platforms may collect data according to their own policies. The buttons to share and «Ask the AI» only open the third-party service if you click them.

9. Your rights

You can request access to your data, its correction or deletion, object to or restrict its processing, and receive it in a portable format. Write to us through the contact form with your account's email; we will answer within one month. You can also change most of your data yourself in your settings.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority of your country.

10. Minors

You must be at least 18 years old to create an account. If we find out that an account belongs to a minor, we will delete it.

11. Security

All connections are encrypted (HTTPS), passwords are stored with Argon2id and you can enable two-step verification and close your sessions on other devices from your settings.

12. Changes to this policy

If we change this policy, we will update the date at the top and, if the changes are important, we will let you know on the site or by email.