Privacy Policy

Chisato Anime Tracker · Last updated: October 3, 2026

This Privacy Policy explains what data Chisato Anime Tracker ("Chisato", "the App", "we", "us") collects, how it is used, where it is stored, who it is shared with, and how you can delete it. It applies to the Chisato Anime Tracker app for iPhone and iPad, its widgets, and the website at chisatoanime.app.

Chisato is an app for tracking the anime you watch: you keep a watch list, log episodes and scores, and see when new episodes air. It is developed by Leo Martin, an independent developer based in Peru. The data controller for the data described here is Chisato Technologies.

Contents

1. Data we collect
2. Google user data
3. How we use your data
4. Sharing and service providers
5. Storage and security
6. Retention and deletion
7. Device permissions
8. Your rights
9. Children's privacy
10. International transfers
11. This website
12. Changes to this policy
13. Contact

1. Data we collect

Account data

An account is required to use Chisato. You can create one with Sign in with Apple or Sign in with Google. There are no passwords: we never see or store your Apple or Google password.

Content you create in the App

• Your anime list: the anime you add, their status (watching, completed, plan to watch, on hold, dropped), episodes watched, scores, optional start and finish dates, and rewatch information.
• Preferences and onboarding answers: for example whether you prefer subtitled or dubbed releases, your taste tags, goals, and favorite anime, studios, characters or openings if you choose to set them.
• Subscription status: whether you have an active Chisato premium subscription and when it expires. We never receive your payment card details; payments are handled entirely by Apple.

Profile details (optional)

You can personalize your profile with the details below. Every one of them is optional, is provided by you directly in the App, and can be changed or removed at any time. Chisato works the same without them.

How images are handled. You frame the image on your device, and only the framed result is uploaded: the rest of the original photo, and the rest of your photo library, never leave your device. On our server the image is re-encoded, which removes embedded metadata such as the location where a photo was taken and the camera that took it. To let you adjust the framing later, the App may keep a copy of the original photo on your device only; it is deleted when you replace or remove the image, or sign out.

We do not use your display name, bio or images for advertising, for identifying you, or for face recognition or any other biometric purpose, and they are not sent to our analytics provider. Because these fields are free for you to fill in, please do not put anything in them that you want to keep private.

MyAnimeList account (optional)

If you choose to link a MyAnimeList (MAL) account, you authorize Chisato on MyAnimeList's own website. The resulting MAL access tokens are stored only on your device, in the iOS Keychain. Our server forwards your requests to the MyAnimeList API to read and update your MAL anime list and to read your public MAL profile (username, join date and list statistics), but it does not store your MAL tokens or your MAL password.

Usage and diagnostic data

• Product analytics: events about how the App is used (for example screens opened, an anime being added or updated, onboarding answers, paywall and purchase events), associated with your Chisato user ID and username, together with basic device information such as device model, iOS version, app version and approximate region derived from your IP address by our analytics provider. Your email address is not sent to our analytics provider.
• Crash reports: technical information about crashes (stack traces, device model, iOS version, app version) so we can fix bugs.
• Server logs: our servers and hosting provider keep short-lived technical logs of API requests (such as IP address, time, endpoint and error details) for security and debugging.
• Time zone: the App sends your device's time zone name (for example "America/Lima") with schedule requests so air times can be shown in your local time. It is not stored.

Data we do not collect

Chisato does not collect your phone number, contacts, precise location, advertising identifier (IDFA), health data or financial information. We do not receive your name or your profile photo from Apple or Google, and we never require your legal name: the only name and images we hold are the optional ones you choose to add to your profile yourself, described above. The App does not use Apple's App Tracking Transparency prompt because it does not track you across other companies' apps or websites.

2. Google user data

This section describes specifically how Chisato accesses, uses, stores and shares Google user data when you choose Sign in with Google.

• Data accessed. Chisato requests only the openid and email OAuth scopes. Through them we receive your Google account's email address and your unique Google account identifier (the "sub" value). We do not request or access your name, profile picture, Gmail, Google Drive, Calendar, Contacts, YouTube account, or any other Google data.
• Data usage. The email address and Google account identifier are used only to create your Chisato account, authenticate you when you sign in, keep your anime list attached to the correct account, and contact you about your account or a support request. They are not used for advertising, profiling, or any purpose unrelated to providing the App.
• Data storage. The email address and Google account identifier are stored in your Chisato account record in Google Cloud Firestore. Google access tokens and refresh tokens are not stored: after verifying your sign-in, our server issues its own Chisato session tokens, which are kept in the iOS Keychain on your device.
• Data sharing. We do not sell, rent or transfer Google user data to third parties. It is processed only by the infrastructure providers that host our database and servers (listed in section 4), acting on our behalf, or disclosed where required by law.
• Data protection. Google user data is transmitted over encrypted connections (HTTPS/TLS), encrypted at rest by our database provider, and accessible only to the developer for the purposes of operating and supporting the App.
• Retention and deletion. Google user data is kept for as long as your Chisato account exists and is deleted when you delete your account (see section 6). You can also revoke Chisato's access at any time from your Google Account settings.
• No AI/ML training and no human reading. Google user data is not used to develop, improve or train AI or machine-learning models, and is not read by humans except where necessary for security, to comply with law, or with your consent when you ask for support.

Chisato's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The same applies to Sign in with Apple: we request only your email address, and receive it together with Apple's unique account identifier. We do not request your name.

The optional display name and profile images described in section 1 are entered or chosen by you inside the App. They are never read from, or filled in using, your Google or Apple account.

3. How we use your data

• To create and authenticate your account and keep you signed in.
• To save your anime list, scores, progress and preferences and sync them across your devices and widgets.
• To show the display name, bio, profile picture and banner you chose on your profile.
• To show airing schedules and countdowns in your local time.
• To sync your list with MyAnimeList, if you link a MyAnimeList account.
• To provide and verify premium subscriptions.
• To understand how features are used, fix crashes and improve the App.
• To respond to support requests and feature suggestions you send us.
• To protect the service against abuse and comply with legal obligations.

We do not sell your personal data, show third-party ads, use your data for targeted advertising, or build profiles about you for anyone else.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (providing the App and your account), legitimate interests (security, analytics and improving the App), consent (optional features and device permissions), and legal obligations.

4. Sharing and service providers

We share data only with the service providers needed to run Chisato. Each one processes data on our behalf and under its own privacy terms:

We may also disclose data if required by law or a valid legal request, or to protect the rights, safety and security of users or of Chisato. If Chisato is ever transferred to another owner, your data may be transferred as part of that transaction, and we will notify you before it becomes subject to a different privacy policy.

5. Storage and security

• Account data and your anime list are stored in Google Cloud Firestore, encrypted at rest, and sent over HTTPS/TLS.
• Your profile picture and banner are stored in Google Cloud Storage (Firebase), encrypted at rest. They are not listed publicly: each image is delivered over HTTPS through a long, unguessable link.
• Session tokens and any MyAnimeList tokens are stored in the iOS Keychain on your device.
• A copy of your list, cached artwork, widget settings and app preferences are stored locally on your device (including in the app group shared with Chisato's widgets) so the App and its widgets work quickly and offline. Chisato does not use iCloud.
• Access to production data is limited to the developer and used only to operate, secure and support the service.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and will notify you and the relevant authorities of a data breach where the law requires it.

6. Retention and deletion

We keep your account data and anime list for as long as your account exists.

Deleting your account. You can delete your account at any time in the App under Settings → Delete account. This immediately and permanently deletes your Chisato account record (including your email address, sign-in identifier, username, display name, bio, preferences and subscription cache), your profile picture and banner, and your entire anime list from our database and file storage, and removes your session and MyAnimeList tokens from your device. If you cannot access the App, email support@chisato.io from the address associated with your account and we will delete it within 30 days.

Removing profile details. You do not need to delete your account to remove them. Clearing your display name or bio in the App deletes it from our database, and removing or replacing a profile picture or banner deletes the previous image from our storage. A copy of an image may remain for a limited time in caches on devices that already displayed it.

Deleting your Chisato account does not delete anything stored in your MyAnimeList account, which is controlled by MyAnimeList. Analytics events, crash reports and purchase records held by our service providers are kept under their retention periods and are no longer linked to an active account; you can ask us to request their deletion by email. Server logs are deleted automatically after a short period.

7. Device permissions

Depending on the features you use, iOS may ask you to allow access to your photo library (to save images you create for sharing), to your camera (to take a photo for your profile picture or banner), or to your microphone or speech recognition. These are requested only when you use a feature that needs them, are always optional, and can be changed at any time in iOS Settings.

Choosing an existing photo for your profile uses the system photo picker, which gives the App only the photo you pick and no access to the rest of your library. The only images uploaded to Chisato's servers are the ones you choose as your profile picture or banner, after you frame them. No other photos, and no audio or recordings, are uploaded.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or Peru's Personal Data Protection Law No. 29733), you may have the right to access, correct, export, restrict or delete your personal data, to object to certain processing, and to withdraw consent. You can exercise most of these directly in the App (edit your username, profile details, preferences and list, or delete your account) or by emailing support@chisato.io. We will not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data protection authority.

9. Children's privacy

Chisato is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, contact us and we will delete it. Where local law sets a higher age of digital consent, users below that age need the consent of a parent or guardian.

10. International transfers

Our service providers operate servers in the United States and other countries, so your data may be processed outside the country where you live. Where required, such transfers rely on appropriate safeguards such as the providers' standard contractual clauses.

11. This website

The chisatoanime.app website does not require an account and does not use advertising or tracking cookies. It uses Vercel Web Analytics, which counts page views without cookies and without identifying individual visitors.

12. Changes to this policy

We may update this Privacy Policy as the App evolves. When we do, we will post the new version on this page and update the "Last updated" date above. If a change materially affects how we use your data, including Google user data, we will notify you in the App and, where required, ask for your consent before it applies.

13. Contact

Questions or requests about this policy or your data can be sent to:

• Email: support@chisato.io
• Developer: Leo Martin
• Data controller: Chisato Technologies
• See also our Terms of Service.