Last updated October 23, 2026
Privacy policy
This page explains what personal data manhwarecaps uses, why, for how long and what you can do about it. It is written to be read, not to impress lawyers.
On this page
The short version
- You can browse without an account. Without one, the site stores only a few settings in your browser and keeps the usual technical data needed to serve pages and stop abuse.
- With an account (sign-in with Google, or with your e-mail and a password) I keep your e-mail, nickname, library, votes, comments and notification settings, so the site works the same on every device.
- Google Analytics runs only if you allow it in the cookie banner. No ads, no selling data, no cross-site profiles.
- The YouTube player loads only when you press Play.
- You can download all your data or delete your account yourself on the account page.
Who is responsible for your data
The controller of your personal data is Daniel Koziara, who runs manhwarecaps as a private, non-commercial project ("I", "me" below).
You can reach me about anything related to privacy at privacy@manhwarecaps.com or through the contact form. There is no data protection officer: the law does not require one for a site of this size, so I handle requests myself.
What data I use and where it comes from
Every visitor
- Technical data: your IP address, browser and device type, the page you asked for and when. It reaches Cloudflare (which sits in front of the site) and the server, which use it to deliver pages and block attacks. The server also counts requests per IP address for a short time to limit spam on forms and error reports, and attempts to sign in, sign up or reset a password. These counters live only in memory.
- View counter: when you open a recap page, the site counts one view of that recap, without cookies. To count you only once a day, the server keeps a one-way daily code made from your IP address, browser, the recap and the date, mixed with a secret key. The IP address itself is not stored, the code cannot be turned back into it or linked across days, and it is deleted after 2 days. Only the total number of views per recap and day is kept. Your browser also remembers which recaps it already counted today (
mr-viewsin local storage). Known bots are not counted. - Error reports: if a page breaks, the address of the page, your browser version and the technical error are saved so I can fix it. No IP address is saved with them.
- Browser storage: your theme, recent searches and hidden banners stay on your device (see cookies and local storage).
If you create an account
- From Google when you sign in with it: e-mail address, name, profile picture, your Google account ID and whether the e-mail is verified.
- With e-mail and password: your e-mail address, the nickname you choose and your password. The password is never stored as text, only as a one-way hash (scrypt), so nobody can read it, me included. To confirm the address I send you an e-mail with a link (valid 24 hours), and if you forget the password, a link to set a new one (valid 1 hour). Until you confirm the address, the account cannot be used. Better Auth, the open-source library the site uses for sign-in, runs on my server, not at a third party.
- Patreon: if you connect Patreon in your account settings, Patreon tells me if you support this site, your membership status and the amount of your tier. I keep your Patreon account ID and the tokens Patreon gives me so the membership can be checked again daily; your Patreon name and e-mail are not saved. Patreon is not a way to sign in.
- What you add: your nickname, saved recaps, watch history with the point where you stopped (to resume videos), followed series, likes of recaps, votes, title requests, comments, likes of comments, reports of comments, notification settings and the comment style you pick as a patron.
- Sessions: for each device where you are signed in, the IP address and browser at sign-in, so you can see and sign out devices on the account page.
- Push subscriptions: if you turn on browser notifications, the address your browser gives me for delivering them and your browser type.
Your nickname, profile picture, comments, likes count and patron rank badge are public. While you are a patron at B-Rank or higher with Patreon connected, your nickname and rank are also listed on the supporters wall on the Support page; you can turn that off in your account settings at any time. Your e-mail and real name are never shown to other users. Profile pictures are loaded straight from Google's servers, so Google sees the IP address of whoever views them.
If you write to me
The contact and channel submission forms send me your e-mail address, the name you give (optional), your message and topic, the recap or channel it is about and your nickname if you are signed in. You get a short confirmation by e-mail.
Why I use it and on what legal basis
The GDPR allows processing only on a legal basis from Article 6(1). Here is which one applies to what:
| Purpose | Data | Legal basis |
|---|---|---|
| Showing the site, keeping it secure, stopping spam and abuse | Technical data, rate-limit counters, Cloudflare security cookies | Legitimate interest in a working, safe site (Art. 6(1)(f)) |
| Your account, sign-in and devices | E-mail, password hash, account data from Google, nickname, sessions, sign-in e-mails | Performing the agreement you accept by creating an account, the Terms of use (Art. 6(1)(b)) |
| Library, resume playback, follows, votes, requests, comments, likes | What you add | Agreement (Art. 6(1)(b)) |
| Counting recap views on this site | Daily one-way code from IP address, browser, recap and date (no IP stored) | Legitimate interest in knowing which recaps people watch here (Art. 6(1)(f)) |
| Patron perks: rank badge, vote weight, comment style, highlighted comments, supporters wall | Patreon account ID, membership status and tier amount, nickname | Agreement (Art. 6(1)(b)): the perks of the tier you join; the supporters wall can be switched off in your account |
| Notifications in the bell, by e-mail and push | Notifications, settings, e-mail, push subscription | Agreement (Art. 6(1)(b)), you choose which channels in settings |
| Welcome e-mail after you pick a nickname | E-mail, nickname | Legitimate interest in explaining the site to new users (Art. 6(1)(f)) |
| Checking comments for abuse (AI moderation) and handling reports | Comment text, reports | Legitimate interest in keeping comments safe for everyone (Art. 6(1)(f)) |
| Answering messages and channel submissions | What you send in the form | Legitimate interest in replying to you (Art. 6(1)(f)); agreement if it is about your account |
| Finding and fixing errors | Error reports | Legitimate interest (Art. 6(1)(f)) |
| Visit statistics with Google Analytics | Analytics cookies, pages viewed, device and approximate location | Your consent (Art. 6(1)(a)), which you can withdraw any time |
| Playing videos in the YouTube player | What Google collects once the player loads | Your consent, given by pressing Play after being told about it (Art. 6(1)(a)) |
| Defending legal claims, meeting legal duties | Only what a specific case needs | Legitimate interest (Art. 6(1)(f)), legal obligation (Art. 6(1)(c)) |
Where I rely on legitimate interest you can object (see your rights). Giving data is voluntary, but an account cannot be created without an e-mail address (from Google or typed in by you and confirmed).
Comments and AI moderation
Before a comment is published, its text (without your name or e-mail) is checked by the OpenAI Moderation API, a free automated filter. Based on the result:
- most comments are published right away,
- comments flagged in a lighter category (for example harassment or sexual content) are published and wait for me to review,
- comments flagged in a serious category (for example threats, graphic violence or sexual content involving minors) are hidden at once until I review them.
This judges the text of a single comment, not you as a person, and builds no profile. Hiding one comment does not have a legal or similarly significant effect on you, so it is not an automated decision in the sense of Article 22 GDPR. Still, every hidden comment is reviewed by a human and I restore it if the filter got it wrong. If you think that happened, write to me.
The moderation result is saved with the comment. A copy of the checked text is kept in a technical log for 90 days. OpenAI states that data sent through its API is not used to train its models and is kept for up to 30 days to detect abuse.
If you delete your account, your comments, likes and reports are deleted with it. Replies other people wrote directly under your comments disappear too, because they no longer make sense on their own.
E-mail and push notifications
Replies, mentions and new parts of series you follow appear in the bell in the header. Depending on your notification settings they can also reach you as an e-mail summary or as browser push notifications.
- Every notification e-mail has an unsubscribe link that works without signing in (the
/unsubscribepage), and supports one-click unsubscribe in mail apps. - Push notifications are delivered through your browser maker's push service (Google for Chrome, Mozilla for Firefox, Apple for Safari, Microsoft for Edge). The content is encrypted end to end, so those services only see that a message was delivered. You can turn push off in settings or in your browser.
YouTube videos
Thumbnails are served from this site's own image storage. Rarely, while a new video is being added, a thumbnail may load from YouTube's image server for a moment.
The video player is not loaded until you press Play, and before that nothing is sent to YouTube. When you press Play, the player loads in YouTube's privacy-enhanced mode (youtube-nocookie.com). From then on Google receives your IP address and browser data and may store cookies or similar data in your browser. Google decides how it uses that data and is responsible for it: see the Google Privacy Policy. If you are signed in, the site reads the playback position from the player to let you resume later.
Pressing Play is your choice and counts as your consent to load the player. If you don't want that, use the "Watch on YouTube" link or don't play videos here.
Google Analytics
If you allow analytics in the cookie banner, the site uses Google Analytics 4 to count visits, popular pages and the devices people use. Without your consent the Google script is not loaded at all.
- Google Analytics 4 does not store IP addresses. Google signals, advertising features and ad personalisation are turned off.
- Page addresses are sent without any parameters, so links with personal tokens (like unsubscribe links) are never shared.
- Analytics cookies last 13 months, and statistics are kept in Google Analytics for 14 months.
- Google Ireland Limited acts as my processor for this. More about it: How Google uses information from sites that use its services.
You can withdraw consent any time in the cookie settings. The analytics cookies are then deleted and nothing more is sent.
Patreon
Support is handled by Patreon, not by this site: payments and your Patreon profile are under Patreon's own privacy policy. Patreon is not a way to sign in to this site. If you connect Patreon in your account settings (your Patreon e-mail may differ from your account e-mail), I receive the membership status and tier amount for this site's campaign, and Patreon notifies the site when that membership changes. I never see payment details. The tier decides your rank on the site (B-Rank, A-Rank or S-Rank), shown as a badge next to your nickname and, unless you turn it off, on the supporters wall. Disconnecting Patreon in your account removes the stored Patreon account ID and tokens and ends the perks right away.
Who else processes your data
I don't sell or rent personal data. These companies process it for me under data processing agreements (processors):
- Hosting: OVHcloud (virtual server in a data centre in Canada). The server and database run there.
- Cloudflare, Inc. (USA): network in front of the site (CDN, DNS, protection against attacks) and storage of images. See the Cloudflare privacy policy.
- E-mail delivery: Resend, Inc. (USA). Sends e-mail confirmation and password reset links, notification e-mails, welcome e-mails and form confirmations. See the Resend privacy policy.
- OpenAI (USA): moderation of comment text.
- Google Ireland Limited / Google LLC: Google Analytics, only with your consent.
These act on their own responsibility (independent controllers) when you use them: Google when you sign in with it, Google (YouTube) when you press Play, Patreon for your membership, and your browser maker's push service. I may also have to share data with authorities when the law requires it.
Transfers outside the European Economic Area
The server and database run at OVHcloud in Canada. The European Commission recognises Canada as providing an adequate level of data protection (adequacy decision under Art. 45 GDPR), so no extra safeguards are needed for that.
Cloudflare, Resend, OpenAI, Google and Patreon are US companies and may process data in the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework for certified companies (you can check the list of participants), and otherwise on the Standard Contractual Clauses approved by the Commission (Art. 46(2)(c) GDPR). You can ask me for a copy of the safeguards.
How long data is kept
| Data | How long |
|---|---|
| Account, library, watch history, votes, comments, follows, settings | Until you delete them or your account. Deleted data disappears from database backups within 30 days. |
| Sign-in sessions (with IP and browser) | 7 days from your last visit (renewed while you use the site), then removed in a daily clean-up |
| Links to confirm your e-mail or set a new password | Work for 24 hours (confirmation) or 1 hour (password, single use), expired ones are removed in a daily clean-up |
| Notifications in the bell | 12 months |
| Log of sent e-mails (address, subject, result) | 90 days |
| Copy of comment text in the moderation log | 90 days |
| Error reports | 90 days after the error last happened |
| Rate-limit counters by IP address | Minutes to 24 hours, in memory only |
| Daily codes for the view counter (no IP stored) | 2 days, then removed in a daily clean-up; only total views per recap and day stay |
| Likes of recaps | Until you remove the like or delete your account |
| Messages from the contact form | As long as needed to handle the matter, then up to 2 years in my mailbox in case of follow-up questions |
| Technical logs on the server and at Cloudflare | Up to 14 days on the server; at Cloudflare under its own policy |
| Google Analytics statistics | 14 months (cookies 13 months) |
| Your cookie choice | 12 months, then the banner asks again |
Data needed to defend legal claims may be kept longer, but only as long as the claim can be raised.
Cookies and local storage
Cookies and local storage are small pieces of data kept in your browser. Necessary ones work without consent, because the site cannot work (or keep your choice) without them. Analytics cookies are only set after you agree.
| Name | What it does | How long | Type |
|---|---|---|---|
better-auth.session_token | Keeps you signed in (on the live site the name starts with __Secure-) | 7 days, renewed while you use the site | Necessary, only when signed in |
better-auth.state | Protects sign-in with Google and connecting Patreon against forgery | 5 minutes | Necessary, during sign-in with Google or connecting Patreon |
mr_consent | Remembers your cookie choice and when you made it | 12 months | Necessary |
__cf_bm, cf_clearance | Set by Cloudflare only if its bot protection checks your browser | 30 minutes to a few hours | Necessary, third party |
_ga | Google Analytics: tells visits from the same browser apart | 13 months | Analytics, only with consent |
_ga_<ID> | Google Analytics: keeps the state of the current visit | 13 months | Analytics, only with consent |
| YouTube (youtube-nocookie.com, google.com) | Set by Google once you press Play, for the player, settings and abuse detection | Decided by Google | Third party, after Play |
mr-theme | Light or dark mode (local storage) | Until you clear it | Necessary |
mr-auth | Remembers you were signed in, so the page does not jump while loading (local storage) | Until you sign out | Necessary |
mr-views | Recaps already counted as viewed today, so a view is counted once a day (local storage, no personal data) | Until the next day's visit or until you clear it | Necessary |
mr-searches | Your last 8 searches, only on this device (local storage) | Until you clear it | Necessary |
mr-pt-bar, mr-pt-side | When you hid the support banners (local storage) | 30 days or until cleared | Necessary |
If you turn on browser notifications, your browser also keeps a service worker and a push subscription for this site until you turn them off. You can clear all of this in your browser settings at any time.
Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Art. 15),
- correct it (Art. 16),
- delete it (Art. 17),
- restrict processing (Art. 18),
- data portability, a copy in a machine-readable format (Art. 20),
- object to processing based on legitimate interest (Art. 21),
- withdraw consent at any time, without affecting what happened before (Art. 7(3)).
Most of it you can do yourself: download your data as a JSON file, change your nickname, clear your watch history, sign out devices, change notification settings, delete your account, or change cookie choices with the button above or the "Cookie settings" link in the footer. For anything else, contact me through the contact form. I answer within one month, and it is free.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU or EEA country where you live, work or where you think the infringement happened.
Children
The site is not meant for children. You need to be at least 16 to create an account (the highest age of digital consent allowed under Article 8 GDPR), or have the consent of a parent or guardian. If I learn that an account belongs to a younger child without that consent, I delete it. Parents can contact me through the contact form.
Security
The site uses HTTPS everywhere, sign-in through Google or with a password stored only as a salted one-way hash, e-mail confirmation before an account works, limits on sign-in and password reset attempts, encrypted secrets and access to the admin panel only for a few accounts. If a data breach puts your rights at risk, I will report it to the supervisory authority within 72 hours and tell affected users without undue delay.
Changes to this policy
When the way data is used changes, this page changes too and the date at the top shows the current version. If a change needs your consent again (for example a new analytics tool), the cookie banner will ask you again. This version is effective from October 23, 2026.