Privacy Policy

• Account data: username, email, password (bcrypt-hashed), optional display name, optional bio, optional avatar.
• Content you create: posts (fan art images, titles, descriptions, tags), blog posts (HTML body + cover images + author-uploaded inline images), comments, replies, mentions.
• Activity: favorites, follows, anime list entries (status + score + episodes-watched + private notes), achievement progress, comment scores, view counts on posts you visit.
• Notifications: records of follower / mention / reply / approval / achievement events directed at you, plus your live notification-stream connection state.
• Technical: IP address (for rate-limiting + abuse prevention), browser user-agent, basic request logs.
• Cookies: session cookie for login, CSRF token. No third-party advertising cookies.
• Local storage: minor UI preferences (last sort order, etc.).

• We don't sell your data to anyone. Ever.
• We don't run third-party ad networks (no Google Ads, no Meta pixels).
• We don't track you across other sites.
• We don't require your real name.
• We don't collect biometrics, location, contacts, or device identifiers beyond IP + user-agent.

• Operating the service — showing your posts/blogs, routing notifications, ranking content.
• Moderation, abuse prevention, and DMCA response.
• Awarding achievements based on your activity.
• Aggregate analytics (no personally-identifying info shared with any third party).

• Your profile page (username, display name, bio, avatar, badges, achievement progress, post count, follower / following lists, join date).
• Posts and blog articles you publish.
• Comments and replies you write.
• Your anime list status and per-anime scores — except private notes, which are visible only to you.
• Who you follow and who follows you.

Anime metadata, cover images, and character portraits are pulled from MyAnimeList via the public Jikan API and rendered alongside our own content. Cover images are served from cdn.myanimelist.net. Streaming-platform deep links target the platforms' own URLs — when you click one, you leave twarc and that service's privacy policy applies.

twarc is not directed at children under 13. If we learn we have collected data from a child under 13 without parental consent, we will delete it.

Active account data is retained while your account exists. When you delete your account:

• Your user row is removed.
• Your watchlist, follows, favorites, and notifications are removed.
• Your posts and blog articles may be retained anonymized (author replaced with “[deleted]”) so comment threads on them remain intact.
• Comments you posted may be retained anonymized for the same reason.

• Access: view all your data through the dashboard.
• Correct: edit profile, bio, posts, blog articles, watchlist entries any time.
• Delete: remove your account from /dashboard/profile.
• Export: email [email protected] for a JSON dump.
• Object: email us to opt out of any specific processing.

While the site is open in a foreground tab, your browser maintains a long-lived Server-Sent Events connection to receive live notifications. The connection is closed automatically when the tab is hidden. We log only normal server access info for this stream — no message contents leave our server.

We use HTTPS site-wide, hash passwords with bcrypt, and minimize sensitive-data exposure. No service is 100% secure; if we discover a breach affecting you, we will notify you.

twarc uses a session cookie to keep you logged in and a CSRF cookie for form security. We use local storage for UI preferences (theme, sort order). No third-party trackers.

Clicking a streaming-platform button, an embedded image hotlinked to a CDN, or a user-submitted external link takes you off twarc. Once you leave, the destination's privacy practices apply, not ours.

Privacy questions: [email protected]