Privacy Policy

1. Who is responsible

Animei (animei.me) is a free fan project run by Eren Kaspar, an independent developer in Türkiye. He is the data controller (“veri sorumlusu”) for the personal data described here, under Türkiye's Personal Data Protection Law No. 6698 (“KVKK”) and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR. In this policy “we” and “us” mean him.

Contact for anything about your data: hello@animei.me. A postal address is available on request.

2. What we process, why, and on what legal basis

Accounts you link

When you sign in with MyAnimeList, AniList or Discord, we receive from them and save that account's ID, username, display name, profile picture, banner and profile colour. We use them to create your account, let you sign in again, prevent others from taking your name as their address, and show your picture and banner on your profile. From Discord we request only the identify permission: not your email address, servers or messages. Sign-in tokens from all three are discarded right after sign-in.

Legal basis: performing our agreement with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).

Your Animei profile

Your address (animei.me/you), member number, badges and settings (theme, avatar and banner choice, list source, visibility, section order), and what you add in the editor: your bio, social links (usernames or one website address), and the anime and characters you pick for Top 5, Favourite characters, your banner or your avatar. For picks we store only their MyAnimeList or AniList IDs. We also keep your previous address for 14 days after you change it.

Legal basis: performing our agreement with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).

Your anime list

Your list (titles, statuses, scores, progress, update dates) is read from MyAnimeList or AniList when your profile or share card is shown, using its public API. It is not saved in our database; it is kept only in a short-lived server cache, for up to a few hours, so pages load quickly. Your list must be public on that site for Animei to show it.

Legal basis: performing our agreement with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)), and data you have made public yourself (KVKK art. 5(2)(d)).

Sign-in sessions

A session record with a random token, its start and expiry time, and your browser's user agent (the browser and operating system name it reports), so you stay signed in and can see that a session is yours. We do not store your IP address with it. Sessions end 30 days after your last visit, or when you sign out.

Legal basis: performing our agreement with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).

Security and abuse protection

To limit how often sign-in and similar actions can be attempted, we count requests per IP address and page. We store only a keyed one-way hash of the address, never the address itself, and delete these counters once they are a day old. The address is also seen, but not stored by us, while your request is handled.

Legal basis: our legitimate interest in keeping the service secure (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).

Feedback and reports

Feedback you send while signed in: the message, its type (bug, idea, other), the page it's about and your account. Bug reports also include your browser and operating system name, so we can reproduce the problem. Profile reports: who sent the report, the reported profile, the reason and any note. The reported member is not told who reported them.

Legal basis: our legitimate interest in improving the service and keeping it safe (GDPR art. 6(1)(f); KVKK art. 5(2)(f)); for reports also complying with the law on removing unlawful content (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)) and establishing or defending legal claims (KVKK art. 5(2)(e)).

Visitor statistics

We use Vercel Web Analytics to count page views. It sets no cookies and doesn't identify you: visits are grouped by a hash of the request that is discarded after 24 hours, and we see only totals by page, referring site, country and region, browser, operating system and device type.

Legal basis: our legitimate interest in understanding how the site is used (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).

Error reports and server logs

When something breaks, a technical error report (what failed, the page, browser and operating system) is sent to Sentry. We don't send it your IP address, cookies or account details. Our host, Vercel, keeps standard request logs (including IP addresses) for a short time to run and protect the service; we don't keep our own copies.

Legal basis: our legitimate interest in keeping the service working and secure (GDPR art. 6(1)(f); KVKK art. 5(2)(f)).

Emails you send us

If you write to us, we use your message and email address to answer and keep them as long as needed for that (legitimate interest; for rights requests, our legal obligation to answer).

3. How we collect it

Automatically through the website and your browser; from MyAnimeList, AniList and Discord when you sign in or connect them (with your permission on their sign-in screen); from their public APIs for your list; and directly from you through the editor, Settings and forms.

4. What we don't do

• We don't store your anime list, passwords, email addresses or sign-in tokens.
• We don't sell personal data, share it for advertising, or show ads.
• We don't make decisions about you by automated means or build profiles for marketing.
• We don't ask for or knowingly process special categories of data (health, beliefs and so on).

5. Is giving us this data required?

To create a profile you must sign in with a MyAnimeList or AniList account, and your list must be public there. Everything else (Discord, bio, links, picks) is optional. Without the required parts we can't provide a profile.

6. Who receives it

• Anyone on the internet sees your public profile: address, avatar, banner, badges, bio, links, picks, favourite characters and your list stats. You can make it unlisted (see section 10).
• Service providers who process data for us under their data processing terms: Vercel Inc. (hosting, request logs, visitor statistics; United States), Neon (database, hosted in the United States), Functional Software Inc. / Sentry (error reports; United States) and Cloudflare Inc. (domain name service; United States). Our encrypted nightly backups are stored with GitHub (United States).
• MyAnimeList, AniList and Discord are independent services: when you sign in with them, their own privacy policies apply. We send AniList the anime and character IDs we need artwork for, and the text you type into the character search.
• Font and emoji services: when a share card contains characters our font doesn't include (for example emoji or Japanese text in a bio), our server fetches just those characters from Google Fonts or emoji images from jsDelivr. They receive those characters only, not who you are.
• Authorities, only when the law requires it (for example a court order), and only what is required.

7. Transfers outside Türkiye and the EEA

Our providers are mainly in the United States, so your data is stored and processed there. Transfers of data of people in the EEA and UK rely on the providers' data processing terms, which include the European Commission's Standard Contractual Clauses (and, for certified providers, the EU–U.S. Data Privacy Framework). Transfers from Türkiye are made under Article 9 of the KVKK, on the basis of the standard contracts published by the Turkish Personal Data Protection Authority where in place, or another ground allowed by that article. You can ask us which safeguard applies to a given provider and for a copy of it.

8. How long we keep it

• Account, profile and linked-account data: until you delete your account.
• Your previous address after a change: 14 days.
• Sessions: until you sign out, or 30 days after your last visit.
• Abuse-protection counters: deleted once a day old.
• Feedback and reports: deleted 90 days after we've dealt with them.
• Linked-account details from a sign-in that didn't complete: deleted after an hour.
• Anime list data: only in a server cache, for up to a few hours.
• Backups: deleted data can remain in encrypted backups for up to 30 days, after which the backups are deleted.

When data is no longer needed it is deleted, or anonymised where deletion isn't possible.

9. Cookies

We use only cookies that are strictly necessary, so they don't need your consent. There are no advertising, analytics or tracking cookies.

• better-auth.session_token: keeps you signed in; up to 30 days after your last visit.
• better-auth.state: protects a sign-in in progress against forgery; a few minutes.
• animei_admin: only for the site administrator's tools; a few hours.

On HTTPS their names may start with __Secure-.

10. Your choices

In Settings you can change your profile, make it unlisted (search engines are asked not to index it; anyone with the link can still open it), disconnect accounts, or delete your account. Deleting your account removes your profile and everything linked to it right away, apart from the backup copies described above.

11. Your rights

Under Article 11 of the KVKK you have the right to: learn whether your data is processed; request information about it; learn the purpose of processing and whether it's used for that purpose; know the third parties in Türkiye or abroad it is transferred to; ask for incomplete or wrong data to be corrected; ask for it to be deleted or destroyed under Article 7; ask that third parties it was transferred to are told about such corrections or deletions; object to a result against you that arises solely from automated analysis; and claim compensation for damage caused by unlawful processing.

If you are in the EEA or UK, you also have the rights of access, rectification, erasure, restriction, data portability and objection (including to processing based on legitimate interest), and you can complain to your local data protection authority.

How to make a request. Write to hello@animei.me and tell us your Animei address so we can find your data; we may ask you to confirm the request from your signed-in account so we know it's really you. You can also apply in writing, by registered electronic mail (KEP), or with a secure electronic or mobile signature, as the Turkish rules on applications to data controllers allow. We answer within 30 days, free of charge.

Complaints. If we turn your request down, don't answer within 30 days, or you find the answer unsatisfactory, you can complain to the Turkish Personal Data Protection Board (KVKK) within 30 days of our answer, and in any case within 60 days of your request. People in the EEA or UK can complain to their supervisory authority at any time.

12. Security

We keep data to the minimum, use encrypted connections (HTTPS) everywhere, store no passwords or sign-in tokens, hash IP addresses used for abuse protection, keep backups encrypted, and limit administrative access to the developer, protected by a second, app-generated code. If a breach ever affects your data, we will tell the authorities as the law requires (in Türkiye, the KVKK Board within 72 hours) and let affected people know as soon as possible.

13. Children

Animei is not meant for children under 13, and you must be at least 13 to sign up. If you're under the age of majority where you live, ask a parent or guardian before signing up. If you believe a child under 13 has an account, write to us and we'll delete it.

14. Changes

If this policy changes, we'll update the date at the top, and for important changes we'll also tell members on the site before they take effect.