Privacy policy
Updated October 26, 2026. This describes the current Anime Shuffle app, including the GitHub Pages demo and the server version.
Optional support
Optional support links, when available, open an external payment page. No donation widget or payment tracker is loaded into Anime Shuffle. Anime Shuffle does not collect card details or attach your watchlist, reactions, or MAL identity to the payment link. The payment service handles checkout under its own privacy policy and may share transaction details, such as your name, email, amount, and message, with the creator.
Accounts and saved choices
On the Cloudflare deployment, signed-in preferences, favorite genres and anime, reactions, settings, and watchlists are stored in a persistent database. They follow your account across devices. A browser cache and pending-sync queue help retain changes if a request fails. Clearing browser data before pending changes sync can lose those changes.
The complete guest profile stays in the current browser. On Cloudflare, a bounded copy is reported for owner diagnostics as described below. The GitHub Pages demo stays local. The local Node version saves accounts and preferences on that installation; reactions stay in the browser. Passwords are stored as salted hashes, never plaintext. Password recovery is not available yet.
MyAnimeList connection
MAL login happens on MyAnimeList. Anime Shuffle receives authorization tokens, not your MAL password. Cloudflare encrypts tokens and session data with a server-only application key. Signed-in sessions last up to 30 days and survive deployments. The local Node version keeps tokens in memory and expires sessions after eight hours.
Currently watching, completed, dropped, plan to watch, optional ratings, favorite genres and anime, and reactions help rank suggestions. Adding to MAL requires an explicit action or the optional auto-add setting. Good and Bad do not change MAL ratings or viewing statuses.
Recommendation enrichment
The server retrieves public MAL reviews through Tenrai using anime IDs. Requests contain public anime IDs, not your login, user identifier, personal scores, or reaction labels. Review text and author names are processed transiently; aggregate descriptive attributes and numerical text embeddings are cached. Review excerpts are not displayed. If model-assisted enrichment is enabled, Cloudflare Workers AI receives bounded public synopsis and review passages without author names. Private analysis may include spoilers; public recommendations use controlled descriptions. Embeddings use spoiler-filtered passages. Personal lists, ratings, accounts, and reactions are not sent to the model. Optional reasons you add to a reaction are saved with that reaction. Episode enrichment stores aggregate filler and recap flags, not episode titles.
On Cloudflare, saved site reactions also contribute to small aggregate correlations between anime. A connection requires at least five other accounts with overlapping choices. Responses contain anime connections and aggregate counts, never account names or individual reactions. Clearing synced reactions removes your contribution from new aggregates after the five-minute cache expires. Guest reactions and private MAL lists are not included in these aggregates.
Cookies and third parties
The server version uses an essential session cookie. The app includes no advertising or analytics scripts. GitHub Pages, the hosting provider and MyAnimeList, and Tenrai process requests needed to provide their services and may retain their own operational logs. Demo cover images load directly from MyAnimeList; in the server version they pass through the app server.
While preparing an anime card, the app may fetch and cache its trailer information from Tenrai to make Watch preview open faster. The Trailers and Images tabs retrieve additional public media information from Tenrai. Trailer thumbnails are fetched from YouTube through the app server when you open the Trailers tab. Hovering over or focusing a preview control may prepare YouTube’s player API. Selecting a trailer loads its privacy-enhanced player. YouTube may process playback and device information under its own privacy policy. Cloudflare’s country code is used to filter trailer availability. It is not sent to the media provider. Recent approximate location may also be retained for owner analytics as described below. The player is not loaded before you select a preview or trailer. Returning to the cover pauses the player; changing anime or closing the page removes it.
Owner administration and operational analytics
Authorized site owners can inspect stored account names, login provider, linked MAL ID, preferences, settings, site reactions, site watchlists and taste summaries derived from that stored information, including reported guest browser snapshots. The admin workspace does not retrieve private MAL lists for inspection, and does not expose passwords, password hashes, OAuth tokens or session credentials.
The hosted app records aggregate API request counts, errors, response timings and country counts, plus which signed-in accounts and anonymous guest browsers were active. It retains the latest reported browser user-agent (including unverified automation hints), IP address and approximate country, region, city and timezone observed for a signed-in account or reporting guest browser for up to 30 days. Network details are encrypted at rest and shown only to authorized owners. Geolocation can be inaccurate, especially with VPNs and mobile networks. IP and location are not recommendation taste features. Query strings, search text, referrers and browser fingerprints are not recorded by these analytics.
Aggregate activity and active-account records are retained for 90 days. Admin inspections and account changes are audited for 180 days; change records may retain prior viewing preferences so corrections can be reviewed or restored. Owners can rename local accounts, edit preferences, restart onboarding, revoke sessions, and suspend or restore an account. Suspension preserves stored data. Analytics begins when this feature is deployed; earlier unrecorded activity is unavailable.
Guest browsers retain a random identifier in localStorage and an IndexedDB backup. The server stores a keyed hash of that identifier, up to 1,000 most recent reaction choices and reasons, anime titles/genres, viewing preferences and onboarding status. These snapshots support aggregate response patterns and owner taste diagnostics; they are not authenticated accounts. Repeated reports replace current choices rather than adding votes. Private MAL lists and credentials are excluded. Clearing browser storage starts a new guest identity; old reports expire after 90 days without activity. Clearing reactions in the app reports an empty snapshot while online. Analytics failures do not prevent local saves or recommendations.
Your choices
You can clear reactions from Privacy in the app (across devices for synced accounts), clear browser site data, sign out, and revoke app authorization on MyAnimeList. Signing out does not delete account records or undo changes to your MAL list. The prototype has no self-service account deletion or password recovery yet.
For questions or to arrange removal of server account data, contact the project maintainer through the project repository. Do not post passwords, tokens or private account information in a public issue.