Política de Privacidade

• Account information — your email address and an account identifier. If you sign in with Google, we receive the basic profile information Google returns (your name, email address and profile picture). If you sign in by email, we send you a one-time code. We never receive or store your password.
• Profile information — your username, biography, country, preferred language, avatar image, list-privacy setting, and any links you add to your profile.
• Activity — the anime and manga on your lists, their status and progress, your scores, your favourites and their order, and the reviews, comments and reactions you post.
• Import data — if you use the MyAnimeList importer, the profile URL you enter and the list entries that MyAnimeList makes publicly visible for it.
• Engagement events — a record that a signed-in account interacted with a title (opened it, added it to a list, scored it, reviewed it, commented or reacted). These feed the "trending" ranking. They are deduplicated to at most one event per account, per title, per event type, per day.
• Technical information — your IP address, browser and device information, and request logs, used for security, abuse prevention and debugging.

We do not collect payment information, because mirumiru takes no payments. We do not ask for your real name, date of birth or address.

• to create and run your account, and to sign you in;
• to provide the product — your lists, scores, reviews, comments, profile and search;
• to show public profiles and public content to other people, as described below;
• to work out what is trending and to rank search and discovery results;
• to keep mirumiru safe: preventing fraud, spam, abuse and score manipulation, and enforcing our Terms of Service;
• to send you the emails the service depends on, such as sign-in codes and important account or service notices;
• to understand how the product is used so we can improve it; and
• to comply with legal obligations and respond to lawful requests.

We do not use your information for advertising, we do not build advertising profiles, and we do not sell personal information.

Where the EU or UK GDPR applies to you, our legal bases are: performance of a contract (running your account and the features you ask for), legitimate interests (security and abuse prevention, ranking and product improvement — balanced against your rights), consent where we ask for it, and legal obligation where the law requires something of us.

mirumiru is a public, social platform, so a lot of what you create is visible to everyone — including people without an account — and can be indexed by search engines.

• Always public: your username, avatar, biography, country, profile links, reviews, comments, reactions and favourites.
• Public or private, your choice: your list of tracked titles, its statuses, progress and scores, controlled by the list-privacy setting in your profile settings.
• Never shown to other users: your email address and your sign-in details.

Avatar images are stored in a public bucket, which means an avatar remains reachable by its direct URL for as long as it exists, even by someone who is not signed in.

When you share a title or a review, we generate an image card containing your username, avatar and what you shared. Anyone with that link can view the card.

Deleting content removes it from mirumiru, but it cannot reach copies other people have already made, or caches held by search engines and social networks.

We use a small number of cookies, all of them strictly necessary to run the site:

• a session cookie set by our authentication provider, which keeps you signed in and is refreshed as you browse; and
• a language cookie (`NEXT_LOCALE`), which remembers whether you want the interface in English, Spanish or Portuguese.

We do not use advertising cookies, third-party analytics or cross-site tracking of any kind. You can block cookies in your browser, but you will not be able to sign in if you block ours.

We do not sell your personal information and we do not share it for advertising. We do rely on a small number of providers to run mirumiru:

• Supabase — authentication, our database, and file storage for avatars. This is where account, profile and activity data lives.
• Cloudflare — content delivery, TLS and protection against attacks. It processes IP addresses and request metadata for every visit.
• Our hosting provider — runs the servers the application is deployed on.
• Google — only if you choose to sign in with Google. That sign-in happens with Google under its own privacy policy.
• MyAnimeList — only if you use the importer. We request the publicly visible list for the profile URL you give us.

Search runs on our own infrastructure, and so do the usage measurements behind trending — neither sends your data to a third party.

Some catalog descriptions are drafted with the help of an AI provider before we publish them. Only public catalog information is sent — no account, profile, list or user-written content is ever sent to an AI provider.

We may also disclose information where we are legally required to, where it is necessary to enforce our Terms of Service or protect someone's rights or safety, or in connection with a merger or sale of the business — in which case we will tell you before your information becomes subject to a different policy.

• Account, profile and activity data is kept for as long as your account exists.
• Reviews and comments you delete are hidden immediately and retained for a limited period afterwards so we can investigate abuse reports and moderation appeals, then removed.
• Engagement events are deleted once their deduplication window has closed — they are not kept as a long-term history of what you looked at.
• Request logs are kept for a short period for security and debugging.
• When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except where we must keep something to comply with the law or to resolve a dispute.
• Backups roll over on a schedule, so a copy of deleted data can persist in them for a limited period after deletion.

Depending on where you live, you have some or all of these rights over your personal information: to access it, to correct it, to delete it, to receive a portable copy, to object to or restrict certain processing, and to withdraw consent where we relied on it.

You can change most of your information yourself in your profile settings. For anything else — including a copy of your data or deletion of your account — email [email protected]. We will respond within 30 days. Exercising these rights is free, and we will not treat you differently for doing so.

You also have the right to complain to a regulator: in Canada, the Office of the Privacy Commissioner of Canada; in the EU or UK, your local data-protection supervisory authority; in Brazil, the ANPD. We would appreciate the chance to put things right first.

We are based in Canada, and our providers may process your information in Canada, the United States and the European Union. This means your information may be transferred outside the country where you live, and may be accessible to authorities there under local law.

Where personal data is transferred out of the EEA or the UK, we rely on the European Commission's adequacy decision for Canadian commercial organizations, or on standard contractual clauses with the provider concerned.

mirumiru is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that we have, we delete it and close the account. If you are a parent or guardian and believe your child has created an account, contact [email protected] and we will deal with it.

We take practical measures to protect your information: all traffic is encrypted in transit; we never handle passwords, because sign-in uses Google or a one-time email code; uploaded files are access-controlled per account; access to production data is limited to the people who operate the service; and we process no payment or card data at all.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulator where the law requires it.

We may update this policy. When we do, we change the "last updated" date at the top of this page, and for material changes we give notice in the app or by email before they take effect.

The mirumiru interface is available in English, Spanish and Portuguese. This policy is published in English only, and the English text is the authoritative version. Any translation provided for convenience does not govern.

Giga Pupsiki Limited, incorporated in Ontario, Canada (Ontario Corporation Number 1001636902). For any privacy question or request: [email protected].