1. Scope & Data Controller Information
This Privacy Policy applies to all services, web applications, APIs, discussion boards, Curated Stacks, and reading synchronization infrastructure operated under the MangakaFolio platform ("MangakaFolio", "MangaFolio", "we", "our", or "us").
For the purposes of the General Data Protection Regulation (EU Regulation 2016/679, "GDPR") and applicable data protection legislation, the Data Controller responsible for your personal data is MangakaFolio Platform Operations. Personal data and application databases are securely hosted in certified cloud data center facilities (including the European Economic Area / Germany and North America) utilizing encrypted communication and storage standards.
2. Personal Data We Collect
We practice strict data minimization and collect only personal data necessary to provide our digital tracking, reading synchronization, and community features:
Unique username, cryptographic password hash (salted via BCrypt), optional email address (used strictly for account security notifications, password resets via short-lived SHA-256 tokens, and donation linking), profile biography, and custom titles.
Manga reading statuses (Reading, Completed, On Hold, Dropped, Plan to Read), chapter progression indices, reading timestamps, series view logs, favorite titles ("Top Four"), reading heatmap logs, and personal notes.
User-created Curated Stacks (titles, descriptions, manga items, and ordering), series and chapter discussion comments, spoiler-tagged reviews, comment upvotes, reactions, and showcase panel clippings uploaded to cloud object storage.
When you voluntarily enable browser push notifications, we store your browser-generated push endpoint URL, public encryption key (p256dh), and authentication secret token (auth). This data is used solely to deliver real-time notifications for comment replies, user mentions, and updates.
If you voluntarily support MangakaFolio on Ko-fi, Ko-fi transmits an automated webhook payload containing your supporter username, email address, tier name, contribution amount, and verification token. This is used exclusively to grant aesthetic perks and elevated upload quotas. MangakaFolio never receives, processes, or stores your credit card, debit card, or banking details.
When importing your library, we process public manga reading lists retrieved from the AniList GraphQL API or parsed from user-submitted MyAnimeList export files. This data is converted into your personal MangakaFolio bookmarks.
Internet Protocol (IP) address, browser user-agent string, and request timestamps collected automatically for rate limiting (180 req/min per IP on image proxies), DDoS mitigation, and intrusion defense.
3. Legal Bases for Processing (GDPR Art. 6)
Under European data protection laws, we process personal data under the following lawful bases:
- Contractual Necessity: Processing required to maintain your user account, synchronize reading progress across devices, publish Curated Stacks, and deliver requested platform services.
- Consent: Explicit opt-in consent given when enabling Web Push notifications in your browser or choosing to link third-party AniList accounts. You may revoke consent at any time.
- Legitimate Interests: Securing our infrastructure against malicious traffic and SSRF exploits, enforcing spoiler masking, optimizing caching, and maintaining community standards.
- Legal Compliance: Retaining necessary records when required to comply with statutory legal processes, DMCA takedown procedures, or lawful judicial requests.
4. Purpose & Data Utilization
We utilize collected information exclusively for the following operational purposes:
- Delivering continuous cross-device reading progression tracking and Folio profile showcases.
- Hosting user-created Curated Stacks and calculating community recommendation upvotes.
- Rendering dual-level discussion forums, spoiler-shielded replies, and reaction media.
- Dispatching opt-in Web Push notifications for comment replies, user mentions, and release alerts.
- Processing Ko-fi webhook payloads to automatically attribute supporter badges, custom titles, and elevated 25MB upload quotas.
- Administering community taxonomy, tag scoring, and automated spam/spoiler quarantine filters.
- Compiling aggregate, non-identifying telemetry (series click counts and reading frequencies) to generate discovery and trending leaderboards.
- Protecting the platform against automated bots, spam flood attacks, SSRF vulnerabilities, and unauthorized reverse-engineering.
6. Sub-processors & Infrastructure Partners
We partner with trusted cloud infrastructure providers, payment platforms, and public data sources to deliver high availability and secure data handling:
- Cloudflare (Cloudflare, Inc.): Global edge reverse proxy network, DNS resolution, DDoS defense, SSL/TLS edge termination, and content delivery network (CDN) caching for public assets.
- Virtual Private Server (VPS) & Dedicated Cloud Compute: Dedicated virtual server and database hosting providers (e.g., DigitalOcean, Hetzner, AWS EC2, or equivalent Tier-3/Tier-4 ISO 27001 / SOC 2 certified data center operators) maintaining physical hardware security, automated system snapshots, and encrypted block storage volumes for relational database records and application containers.
- Cloud Object & Persistent Host Storage (AWS S3, Cloudflare R2 & Secure Host Storage): Encrypted cloud object storage or secure server host persistent volume storage for user-submitted showcase panels and avatar media.
- Ko-fi Labs Ltd (with PayPal & Stripe): Third-party platform handling voluntary community memberships and crowdfunding contributions. All payment transactions occur on Ko-fi's secured domain.
- Browser Push Relays (Google FCM, Apple APNs, Mozilla Push): Relays utilized strictly to deliver encrypted Web Push notifications to subscribed devices.
- MangaDex API: Public query interface for manga metadata and chapter listings (no user personal data is transmitted).
- Jikan API (MyAnimeList): Public endpoint for global popularity ratings and MAL ranking cross-references.
- AniList API: Public data endpoint for auxiliary author, character, and genre taxonomies.
- External Reading Resolvers: Transient proxy resolvers querying public web directories upon user request. No account credentials or private user data are transmitted.
7. Data Retention & Account Erasure Architecture
We retain personal data for as long as your account remains active or as required for operational integrity:
Permanent Account Erasure Protocol:
When an account is deleted via the self-service "Delete Account" feature, our backend executes a cascading database purge. Your user profile, bookmarks, reading history, push notification subscriptions, and password reset tokens are permanently deleted. Additionally, physical avatar files and uploaded panel assets are permanently deleted from object storage.
Discussion Soft-Deletion Architecture:
When a user deletes a comment in a discussion channel, the record is flagged as soft-deleted (is_deleted = true). The user-authored text body and personal attribution are sanitized and replaced with a placeholder to preserve conversational hierarchy for child replies without retaining deleted content.
8. Global Privacy Rights & Automated Self-Service Controls
MangakaFolio extends universal data privacy rights to all registered users globally under the GDPR, CCPA/CPRA, and international data protection standards:
9. Technical Security & Encryption Safeguards
We deploy defense-in-depth security measures to protect user data against unauthorized access, loss, or alteration:
- Edge Auto-TLS & Internal Network Isolation: Dual-layer transport encryption in transit via Cloudflare Edge SSL and Caddy Auto-TLS with strict HTTP Strict Transport Security (HSTS). Internal containerized Docker networks isolate the MySQL database from the public internet, accessible only by internal backend API containers.
- Cryptographic Password Salting: Account passwords are processed through BCrypt cryptographic hashing functions. Plaintext passwords are never logged or stored.
- Cryptographic Token Hashing: Password reset tokens are generated using 32-byte cryptographically secure random bytes and stored as SHA-256 hashes with a strict 1-hour expiration window.
- Transport Layer Encryption: All client-server communications are enforced in transit via TLS 1.3 / HTTPS protocols.
- Pre-Signed Time-Limited Upload Tokens: Panel submissions utilize short-lived, pre-signed S3 authorization vectors with backend MIME and size validation to prevent unauthorized write operations.
- SSRF Defense & IP Rate Limiting: Image streaming proxies enforce DNS validation against internal network ranges and sliding-window rate limiters (180 requests/min per IP) to prevent abuse.
10. Children's Privacy (COPPA Compliance)
MangakaFolio is not directed to individuals under the age of 13 (or under 16 in the European Economic Area). We do not knowingly solicit or collect personally identifiable information from children. If we discover that personal data of a child has been collected without verified parental consent, we will take immediate steps to permanently delete the data and terminate the account.
11. Policy Revisions & Privacy Contact
We may revise this Privacy Policy periodically to reflect technical enhancements or regulatory updates. Any modifications will be published to this page with an updated "Last Revised" date.