Privacy policy
Last updated: 24 October 2026 (draft)
This policy explains what personal data Kiroku collects, why, who receives it and what rights you have. Kiroku is a service for keeping track of the series, movies and anime you watch.
Who is responsible for your data
The controller of your personal data is [Company legal name and registered address: to be completed before launch]. We are based in Colombia.
For anything about your data, write to privacy@kiroku.tv.
What we collect and why
| When | Data | Why | Legal basis |
|---|---|---|---|
| You join the waitlist | Email address, language, and when you signed up and confirmed | To send you one email when Kiroku launches, once you confirm your address | Your consent |
| You create an account | Email address, name, password (stored only as a hash), optional username and profile picture, whether your email is verified, and whether your profile is public | To create and run your account | Providing the service you asked for |
| You sign in with Google or Microsoft | Your name, email address and profile picture from that provider, and the tokens needed to keep the link | To let you sign in without a password | Providing the service you asked for |
| You are signed in | A session token, your IP address and your browser details for each session | To keep you signed in and protect your account | Our legitimate interest in security |
| We email you | Your email address, passed to our email provider | To send verification and account emails | Providing the service you asked for |
| You search and browse titles | Your search words and the titles you open go to our server and, to find results, to TMDB. Your recent searches stay in your browser tab | To show you results | Providing the service you asked for |
| You accept analytics | An anonymous device ID (and your user ID once you sign in); for each event, the kind of action (for example switching language, running a search and how many results it returned, joining the waitlist); and your browser, operating system, screen size, time zone and language | To understand which features are used and improve Kiroku | Your consent |
Analytics never include which series, movies or episodes you watch or open, your search words, or the addresses of the pages you visit. We don't use advertising trackers and we don't sell your data.
Features that store your watching history and lists are not available yet. This policy will be updated before they launch.
Who receives your data
- Our hosting provider, in Germany, runs our servers and database.
- Cloudflare delivers images and files for the site.
- Our email provider, in the United States, sends our emails.
- Google and Microsoft, only if you choose to sign in with them.
- TMDB provides the series and movie information. Posters and photos load straight from TMDB's servers, so TMDB receives your IP address and browser details when you view them.
- PostHog, on servers in the EU, provides analytics, only if you accept.
We don't sell your personal data or share it for advertising. We may disclose data when the law requires it.
Some of these providers process data outside Colombia and the European Economic Area, including in the United States. Where the law requires it, we rely on contractual safeguards with them.
How long we keep it
- Waitlist: until we send the launch email or you ask to be removed. Addresses that are never confirmed are deleted after [period to be confirmed before launch].
- Account: until you delete it or ask us to. We then remove it within [period to be confirmed before launch].
- Sessions: until they expire or you sign out.
- Analytics: [retention period to be confirmed before launch].
Your rights
Under Colombian data protection law (Law 1581 of 2012, habeas data), Brazil's LGPD (Law 13,709 of 2018) and, if you live in the European Union, the GDPR, you can:
- know what data we hold about you and get a copy;
- ask us to correct or update it;
- ask us to delete it, restrict its use, or object to it;
- withdraw a consent you gave, at any time;
- complain to the data protection authority: in Colombia the Superintendencia de Industria y Comercio (SIC); in Brazil the Autoridade Nacional de Proteção de Dados (ANPD); in the EU, the authority in your country.
To use these rights, write to privacy@kiroku.tv from the email address on your account. We answer within the legal deadlines (up to one month under the GDPR; 10 business days for queries and 15 for claims in Colombia; 15 days in Brazil). Deleting your account and getting a copy of your data are handled by email for now. Self-service tools are planned.
Children
Kiroku is not intended for children. If you think a child has given us personal data, write to us and we will delete it. [Minimum age to be confirmed with the Terms of service.]
Security
We use encrypted connections (HTTPS), store passwords only as hashes and limit who can access our systems. No service is perfectly secure, so we can't promise absolute security.
Changes to this policy
When we change this policy in a way that matters, we update the date above and, for significant changes, tell you in the app or by email.