Last updated: 29 October 2026
This policy explains how Anivora handles information when you use its Android app, account service and public website. You can email us with privacy or account questions.
Accounts and Google sign-in
For an Anivora account, we store your display name, email address, selected profile image, verification status and account timestamps. Email accounts also have a password hash; we do not store your password as plain text. Google sign-in supplies a Google account identifier and verified profile information, including email, name and an available profile image. We verify Google's ID token to sign you in or link your account. We do not receive your Google password.
Library, comments and information on your device
The app stores preferences, search and viewing or reading activity, library entries, progress, downloaded files and cached media on your device as features are used. Signed-in library synchronization sends library entries, progress, status and update/deletion timestamps to the Anivora account server. Comments are stored with their author display name, text, associated title and creation date. Comments and author names are public and can be read without an account. Do not post private information in comments.
Anivora stores session credentials and optional external-service credentials on your device. Android account tokens and the password-reset installation secret use the platform's secure storage; some preferences and external-service connection data use app storage. A random installation secret helps restrict Security-page password resets to the installation that requested them. This is not an IMEI or a permanent hardware identifier.
Account emails and Gmail API
We use your email address to send account verification and password-reset messages. These messages contain a code or a one-use reset link and may include your display name. Google processes messages sent through the Gmail API, and messages can remain in the sender's and recipient's mailboxes under their email-provider settings.
The backend operator authorizes a dedicated Gmail sending connection with the gmail.send permission. This connection sends Anivora account emails; it is separate from app users' Google sign-in. Anivora does not request permission to read app users' Gmail inboxes or send from their Gmail accounts. The configured Gmail API integration sends messages and does not read inbox messages. Sender OAuth credentials stay on the backend.
Discord community and support
Discord is optional. Public bug reports and feature requests contain the information you submit, app version, report status and a Discord user ID or pseudonymous Anivora account reference. Optional device information is entered by you. The Cloudflare report form verifies a Turnstile challenge and uses a daily keyed network-identifier hash to limit spam; raw IP addresses are not stored in the report database. Reports may be discussed publicly; never include passwords, tokens, private keys, session cookies or private account information. Private support channels are limited to their creator, authorized staff and the bot. Staff can link approved reports to private GitHub development issues without publishing private issue contents.
Cloudflare D1 stores report and ticket metadata. Completed interaction credentials are removed immediately, or expire after twelve minutes if processing is interrupted. Deduplication records are retained for one day and job metadata for seven days. Closed report metadata is removed after ninety days; Discord channel/message history is managed separately by staff. Contact the developer for privacy or deletion requests. Discord and GitHub apply their own privacy policies to content hosted on those services. Discord OAuth account linking is not enabled.
Optional support payments
The public support website is hosted on Cloudflare Pages and currently has online contributions and bank transfer disabled. It does not collect donor forms, payment details or transaction histories. If an approved hosted checkout is enabled later, payment details and confirmation will be handled by that provider; the support page will identify the provider and link to its support terms. A browser return alone is not treated as payment confirmation.
The previous Flutterwave integration remains in the backend. Where it was used, pending records expire after 30 days and confirmed records are retained for payment administration; contact us about correction or removal of previously supplied public details. The new static website does not migrate or display those records. Hosting it on Cloudflare does not reactivate the previous checkout or create a supporter entry.
The personal portfolio is hosted on GitHub Pages. GitHub also hosts public APK releases and the app update feed. Cloudflare and GitHub receive the connection information needed to serve their websites and files. The support site's theme preference is stored on your device; it does not require an account or contact the Anivora API.
Why information is used and shared
We use information to authenticate accounts, maintain profiles, synchronize libraries, display public comments, deliver requested account emails, provide app features and protect the service. Anivora's backend is hosted on Render and its account database uses MongoDB Atlas. These providers process information needed to operate the service. Google processes sign-in and Gmail requests. Hosting and network providers receive connection information such as IP addresses, request paths and timestamps when you contact their services.
Catalog, image, video and manga requests contact the selected third-party services. Optional AniList or MyAnimeList connections can exchange account and library information with those services when you connect or synchronize them. A configured personal manga server receives requests and credentials needed for that connection. Third-party services receive network information and may have their own policies. Sharing a title uses your device's sharing feature and the destination you choose.
We do not sell Google user data or use it for personalized advertising. Anivora's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google account information for the disclosed account features, not for unrelated advertising or training generalized AI models.
Operational usage measurements
Starting with app version 0.1.33, Anivora sends small operational events for active app use, anime playback sessions after 30 seconds and loaded manga chapters after 10 seconds. Events include a random installation identifier, timestamp, event identifier and, for playback or reading, a catalog title and media identifier. Signed-in events may be associated with your Anivora account. This is separate from your detailed on-device watch/reading history. No media bytes, page contents, passwords, access tokens, advertising identifiers or precise location are included in these events.
The server stores an HMAC of the installation identifier, not the original value. Event detail is retained for up to 45 days, subject to database expiry processing. Small failed batches may remain locally for up to 72 hours and retry when the service is available. Daily server request aggregates (category, counts, status class, response-body byte totals and latency buckets) are retained for up to 400 days; these analytics records do not store raw IP addresses, request URLs, query strings, bodies or credentials. Hosting providers may keep their own connection logs under their own policies.
Only the verified owner can access the operational console. It reports service health, aggregate activity, registrations, popular titles, public comment counts and bandwidth estimates. It does not display private libraries or complete personal watch histories. Operational events are first-party service measurements, not advertising tracking. Counts are best-effort and cannot reconstruct activity before tracking began.
Storage, retention and security
Account and synchronized library records remain in the active database while the account exists. Account verification and reset codes or links expire after ten minutes; expiry prevents use and does not mean every expired database field is automatically erased at that moment. Reset credentials are stored as hashes. Successful link-based password resets consume the link and revoke previous Anivora sessions. Account traffic uses HTTPS.
Deleting the account removes its active account record, the library stored in that record and operational event records associated with that account. Public comments are stored separately and are not automatically removed by the current account-deletion endpoint; contact us to request comment removal. Email messages, hosting logs and provider backups can have separate retention under the relevant provider's settings. Local downloads and exported backups are separate from your server account.
Your choices and requests
You can browse supported guest features without signing in, update your profile, sign out, turn off Remember me, manage local downloads and disconnect optional external accounts. You can revoke Google access through your Google Account connections. Revoking Google access does not itself delete your Anivora account or previously sent email.
To request access, correction, account deletion or comment removal, email us. We may need to verify that the request concerns your account before acting. Do not email passwords, reset codes or OAuth credentials. Deleting local app data or uninstalling does not itself delete a server account; deleting a server account does not remove copies you exported or shared.
Changes
We will update this page when these practices change and show the revised date above. Review the policy before connecting an external account or posting information publicly.