Privacy & cookies

Browsing the catalog

You can explore anime without creating an account. Pages and searches send your request to the Shiori server; your browser also provides connection information such as an IP address and user agent.

Shiori reads its own catalog database; no request is sent to another service to show a page. Visiting a title without a synopsis may prompt a background request from Shiori’s server to Wikipedia for that article; it carries no information about you. The current application does not include advertising or third-party analytics scripts. Shiori counts visits with simple anonymous statistics: for each day, how many times each page was opened, from which website the visitor came, and whether it was a phone, tablet or computer. No cookie is used, and your IP address and browser details are not stored; a one-way code that changes every day estimates the number of daily visitors and is deleted after two days. Visits are not counted if your browser sends Do Not Track or Global Privacy Control. Optional personalized discovery is described below.

When a cover image fails to load, your browser tells Shiori which image address failed, so broken covers can be hidden. To require several different visitors, Shiori stores a one-way code made from your IP address and the date for 24 hours; it is not linked to your account. This report is sent even when Do Not Track is on.

Preferences stored in your browser

When you change appearance settings, this browser remembers your theme, accent, layout, motion, and homepage choices in local storage. These preferences are not account credentials and are not sent to our server. Your personal episode-by-episode ratings and watch-planner budget/runtime are also stored in this browser, keyed by anime, and are not sent to Shiori. Community episode votes are separate and are saved to your account only when you submit them. The time you choose in Tonight is stored there too, under one key; it is sent with Tonight requests so Shiori can pick what fits, but it is not saved to your account. Clear these by removing this site’s browser data. They remain until replaced or cleared.

Use Reset defaults in appearance settings to restore the default look. You can remove stored preferences completely through your browser’s site-data controls. Blocking browser storage keeps changes limited to your current visit.

This browser remembers that the first-visit introduction has been shown, so it is not shown again. The shiori.introduction.v1 marker stays in browser storage until you clear this site’s data. It contains no account information and is not sent to Shiori. It also remembers, without any account information, whether you closed the guide card (shiori.guide-card.v1) and which site announcements you dismissed (shiori.notices.v1), and keeps, for this tab only, the page to reopen after your session is renewed. So that Back returns you to where you were, this tab also keeps a short record of recently visited pages under shiori.restore.v1: scroll position, open sections, the selected cover, your place in a Suggestions round, and search text you had not sent. It also holds a code that changes with your account, so the record is cleared when you sign out or switch account. It is not sent to Shiori, except the anime numbers and a random draw number needed to show the same page again, and it ends with the tab.

Images and external services

Cover images load directly from third-party image servers (cdn.anime-planet.com, cdn.anisearch.com, cdn.myanimelist.net, media.kitsu.app, www.anisearch.com) or, for selected titles, from official anime websites; see Data sources. Your browser contacts those servers, which see your IP address and browser details, but no account information. Those servers receive the connection information required to deliver the image. Following a viewing-service link opens an external website, which has its own privacy policy.

Shiori does not send your list to an external tracking service. MAL-compatible XML import and export are handled by Shiori; no MyAnimeList account or API connection is involved.

YouTube trailers load only after you select Load YouTube trailer. Before that, the trailer section sends no request to YouTube and uses no YouTube thumbnail. Loading the player shares connection information with Google/YouTube and may use storage under their privacy policy. Google sign-in is available when the operator configures its OAuth application. Email registration and recovery use the configured mail service, which receives your address and the verification message.

When AnimeSchedule is enabled, Shiori’s server periodically requests timetable, title-identifier and (for matched scheduled titles) streaming-listing data. These requests do not include your account or watchlist. Your browser receives Shiori’s cached schedule and streaming links without contacting AnimeSchedule.net; it contacts an external viewing service only if you follow one of its links. AnimeSchedule sees connections from Shiori’s server; its broadcast times and listings may change. Your browser timezone is sent with home and calendar requests to show local times and appears in calendar URLs; it is not saved to your account.

When someone opens a title for the first time, Shiori’s server may also ask AnimeSchedule.net for that title’s streaming links, sending only the anime ID.

The Support Shiori link opens Buy Me a Coffee, an outside payment service, in a new tab. Shiori sends it nothing about you: the link carries no referrer and no tracking code, and Shiori sets no cookie and loads no script, image or button from it. Buy Me a Coffee receives what your browser sends to any website, such as your IP address and browser details, and what you choose to give it, under its own privacy policy. The payment page is run by Buy Me a Coffee, not by Shiori, and this site never receives your card, bank or other payment details. If you leave a tip, what you give there, such as your name, the amount, the date and any message, stays with Buy Me a Coffee and reaches Shiori Staff, who run the site, through it. That information is handled under Buy Me a Coffee’s own terms and Shiori Staff’s own records, and is not linked to a Shiori account.

Personalized discovery

Personalized discovery is off by default. If you enable it in appearance settings, this browser stores genre interests and up to 30 recently viewed anime IDs. Recent IDs are kept for up to 30 days; aggregate genre interests expire after 30 days without activity. Expired history is removed when the site next runs. The homepage sends your top three genres and recent IDs to Shiori when requesting suggestions. Turning it off removes the saved browsing history from this browser.

Signed-in suggestions also use your saved genres, statuses and ratings. Dropped and low-rated titles reduce a genre’s influence. Reset browsing history clears browser discovery data; it preserves your saved library and appearance choices. This is a simple discovery ranking, not a prediction of how you will rate an anime.

On Suggestions, “For you” is separate from this browser setting: it uses only your watched titles and choices made there. Private ratings may influence ranking but are never shown. Explicit choices are kept with your account for 90 days, included in your data export and deleted with your account. “Catalog picks” ignores these taste signals. No impression or swipe history is stored with your account. So that Back returns you to the same card, this tab remembers the anime you have seen in this visit (up to 120 anime numbers, in this tab only) and your place in the current round; when you go back, the current round's anime numbers are sent to Shiori only to show the same round again and are not saved.

Tonight’s suggestions use the same saved list. They change each day; Shiori remembers which suggestions it showed you, on how many days and when last (title, count and date only), so a title shown on three days without being added rests for two weeks. This record is kept for 15 days, included in your data export and deleted with your account.

You can clear the saved history at any time from the appearance settings, under Personalized discovery. Recommendation choices can be reset on the Suggestions page.

Accounts and session cookies

The site uses your saved language choice when you select English, Italian, Spanish, Brazilian Portuguese, French or German from the header menu. Shiori stores that choice in a necessary, first-party cookie in this browser for up to one year. Without a saved choice, the site follows your browser language. When you sign in, the current language is also saved with your account so that emails and notifications reach you in it.

Public browsing does not create login cookies. Opening email sign-in sets a temporary HttpOnly form-protection cookie; registration and recovery also use a ten-minute browser-bound verification cookie. Email accounts store a verified email address and a salted password hash, never your password. Email verification codes expire after ten minutes and allow up to five attempts. Outgoing verification messages are encrypted temporarily and removed after delivery or expiry. Password reset signs out existing sessions. Google sign-in stores the verified Google account identifier and the e-mail address Google reports, which may prefill adding email sign-in or be shown privately in Account, and is never used to find or merge accounts; it does not store Google access or refresh tokens. Session cookies are HttpOnly; production uses HTTPS and Secure cookies. Your library stores saved anime, progress, ratings and notes. When you save progress on a title, including when you add or import one that already has progress, Shiori also records that episode and the time. These records are combined with other members’ (at least three people) to tell members when a new episode seems to be out; no one sees who watched. They are kept for 8 days, included in your data export and deleted with your account. Your chosen display name and avatar are saved with your account. New accounts choose both during first-login setup. No persistent cookie is used to remember your sign-in provider; older provider-hint cookies are removed when you open sign-in or sign in successfully. Access cookies last 15 minutes. Refresh cookies last up to seven days of inactivity, within a 30-day session-family limit; logout revokes this device’s session. Avatar uploads are no longer accepted. An image uploaded earlier stays in our database, visible only to your signed-in account, until you choose another avatar or reset it; it is then deleted. Import previews are retained for up to seven days; temporary sign-in state expires after ten minutes.

Changing an email address or Google sign-in method requires proof of a current method and a ten-minute browser-bound operation. The existing method stays available until the change is confirmed. Temporary method-change records, including hashed browser bindings and verification codes, are removed after expiry or when you delete your account; they are not included in your data export. Security notices go to verified contacts independently of optional email choices, without showing another contact address or a verification code. Changing your email address turns off optional website emails until you enable them for the new address. Replacing or disconnecting Google removes the old account’s reported address from Shiori.

If you turn on two-step sign-in, Shiori keeps your authenticator key encrypted and a fingerprint of each unused recovery code (never the code itself). These records are deleted when you turn two-step sign-in off or delete your account. Accounts that sign in only with Google rely on Google’s sign-in protection and are not offered Shiori two-step sign-in.

Community episode ratings are saved with your account when you submit them. Only episode averages and vote counts are shown publicly, after at least three members have rated that episode; names and individual votes are never shown. Your votes are included in your data download and deleted with your account.

Your data download lists whether two-step sign-in is on and when the authenticator app was added and last used. It does not include keys, recovery codes or other security records such as sessions and password hashes.

If you lose every two-step method and recovery code, the site operator can start a request to remove two-step sign-in. It takes effect after 7 days, we tell every verified address on the account, and signing in with two-step sign-in before then cancels it. Shiori keeps the request (its status, its dates and the operator’s reference), and each step is also noted in the operator’s audit log, which has no fixed expiry. Your data download lists the status and dates of such requests, not the operator’s reference.

When you create an account and your email address is verified (or Google reports it), we send you one welcome message. It is a one-time service message with no marketing, no tracking and no unsubscribe link, and it is not sent again. It uses the same daily mail allowance as other messages and is skipped on busy days.

Support tickets

Submitting a report stores its category, subject, message, creation time and reference with your account. You and explicitly authorized support staff can view its conversation. Replies record their author, staff role and timestamp; status changes update the report. Only the reference and category of your request, and the reference and status when you reply, are sent to the operator’s private staff channel on Discord, never the text. Account email addresses, session tokens and IP addresses are not included in that notification. Do not include passwords, verification codes or sensitive personal information in reports.

When outbound email is configured and your account has a verified email/password identity, a confirmation and staff replies/status updates are sent to that verified address. Mail includes the subject and reference of your request and the staff reply, not your original message. Messages are encrypted in a temporary delivery queue, removed after delivery or expiry (24 hours). Email-provider copies are subject to that provider’s handling. Accounts without an email address can follow replies on-site but do not receive these emails yet. Email replies are not monitored; continue the conversation on the site.

When a ticket is resolved you can answer “Helped” or “Not yet” with an optional comment of up to 500 characters; “Not yet” reopens it. The answer is stored with your account, included in your data export, deleted with the ticket or your account, and counted (without your name) in the staff’s helped rate.

Delivery attempts are recorded to retry interrupted notifications. Open tickets remain until resolved. Resolved tickets, their replies, ticket notifications and feedback are deleted 365 days after the ticket was created. Copies sent to the operator’s private Discord staff channel and delivered email copies are stored separately; their retention depends on those services and the recipient’s mailbox. This feature creates no additional cookies. It handles website conversations and outbound notices, not incoming email or Discord replies.

Site feedback

When you send feedback, we store your rating from 1 to 5, your two optional answers, the kind of page you came from if you choose to include it, the language of the page and when you sent it. If you are signed in, it is linked to your account; if not, it is not linked to anyone.

Only Shiori staff can read it. It is never published or shown on your profile or in the feed.

Your rating and written answers are never sent to Discord or another service.

When the optional quick-rating prompt is enabled, a generic notice may be sent to staff on Discord at most once a day; it contains no rating, written answer, account or page information.

Staff see an average and counts without names.

When you send feedback without signing in, a keyed one-way code of your network (not your IP address) is kept for up to two days to limit abuse, and then erased. It is not copied into backups. The form uses the same one-hour security cookie as the sign-in forms; it sets no other cookie. The feedback itself is included in the encrypted nightly backups of members’ data.

If you are signed in with an e-mail address and allow it, staff may e-mail you one reply at that address. Without that choice nobody contacts you. Your feedback is included in your data download; you can delete it from the feedback page at any time, and it is deleted with your account or 12 months after you sent it.

Cookie policy

Shiori only sets cookies it needs to work, so there is no cookie choice to make. The floating notice near the bottom of the page is informational, not a consent request. If you choose “Got it”, this browser stores that the notice was read under shiori.cookie-notice.v1 in local storage.

• Signed-in session. Two protected cookies keep you signed in: a short one (15 minutes) and a refresh cookie (up to seven days without activity, 30 days at most). Signing out removes them.
• Sign-in steps. Email/password forms use a separate one-hour CSRF cookie. Verification codes and Google sign-in use temporary flow cookies (at most ten minutes) so the step can only be completed in the browser that started it. A separate cookie remembers which page to return to after signing in, for at most 30 minutes. The feedback form for visitors uses the same CSRF cookie.
• Two-step sign-in. A sign-in waiting for its second step uses a temporary cookie (at most ten minutes) so the step can only be completed in the browser that started it.
• Account method changes. A temporary, host-only HttpOnly cookie binds an email change to the browser that started it. It lasts at most ten minutes and uses Strict SameSite. Google method changes use a separate temporary Lax SameSite cookie for the provider redirect. Both use Secure in production.
• Staff access. Support staff get one extra cookie for as long as their staff session lasts, plus a ten-minute cookie while confirming it.

We do not use advertising, social media or tracking cookies. Your appearance choices and Tonight’s time are kept in browser storage, not in cookies. Visit counts are anonymous and use no cookie at all. You can delete cookies in your browser at any time; you will be signed out.

Profiles, friends and notifications

Profiles start private. Your display name and account ID can be searched by signed-in users, and your name and visibility are shown on your profile link. A private library is visible only to you and approved followers. If you choose Public in your profile, anyone with your profile link can view your anime titles, watch status and episode progress. Personal notes and ratings are not shared. Your cover banner and short bio are shown to whoever can see your profile, and you choose whether your collection counts, anime list and activity appear. A private profile shows only your name and avatar to everyone else. Existing approved followers keep access when you switch back to private; you can remove followers in your profile.

Follow requests, approvals and new followers create in-app notifications, not emails. Shiori stores these events and your follow relationships with your account. Episode alerts are optional; email delivery is a separate opt-in and uses your verified email sign-in address. Unfollowing or removing a follower ends private-library access but does not erase historical notifications. Social records are removed when the associated account is deleted.

Blocking and reporting: you can block any member from their profile. Blocking removes any follows between you, and you will no longer see each other in search, activity or profiles. The other person is not told. You can unblock at any time in Manage connections. You can also report a member, an activity or a comment, with a reason and an optional note of up to 500 characters. Only authorized Shiori staff can read reports. We keep a report until it is reviewed, then up to 90 days more. Reports are never shown to the member you reported.

Friends activity: when you add an anime, change its status, watch an episode or rate it on Shiori, a short note (the title, what you did and when) appears in the activity feed. It is shown to you and to people who follow you; if your profile is public, anyone can also see it on your profile page. Imports do not create activity. Activity sharing is on when you create an account; your profile itself starts private. You can turn activity sharing off at any time in your profile. Activity is deleted after 90 days.

Staff access to a private library

A private library stays private on your profile. In a narrow case, a Shiori staff member can open a read-only view of your library from the staff area: when there is an open report, a support ticket or a safety concern, or for another reason they must write down. They see the titles and their status, the counts and the date of your last activity. They never see your notes or ratings, and they cannot change anything. Each view needs a fresh staff sign-in and a reason, and is recorded in the staff history with the staff member's name, the reason and the time. The record does not contain any of your library. You are not notified, and each new view is logged again.

Optional website-update emails

Notification Preferences includes a separate, off-by-default choice for emails about major Shiori releases. Enabling it requires a verified email address and is not a condition of using Shiori. We record the preference, consent wording version and timestamp, plus later consent changes. You can withdraw it anytime in the same settings without changing security emails or anime alerts. Announcements are sent only by authorized staff, only to members who turned this on, and at most once per release. These preference records are deleted with your account.

Notification Preferences also offers an optional Sunday digest, off by default: once a week, only when there is something to say, it summarizes what you logged, what is next and one sequel you have not added, without ratings. It uses your verified email address, records the consent wording version and time, and can be turned off in the same settings or with the link in every digest.

How long we keep things

• Notifications you have read: 90 days. Unread ones: 180 days.
• Resolved support tickets and their replies: 12 months after creation.
• Site feedback: 12 months after it is sent. The network code kept with feedback from visitors: erased within two days.
• Expired sessions are removed daily.
• Pending sign-in method changes expire after ten minutes and are removed by daily cleanup or account deletion.
• Sign-ins waiting for a second step and unfinished two-step setups: 10 minutes.
• Two-step methods and unused recovery codes: until you remove them or delete your account.
• Requests to remove two-step sign-in: until they take effect or are canceled. A canceled request is deleted after 90 days; a completed one is kept until you delete your account.
• Your library, profile and settings stay until you delete them or your account. Activity items, and the comments and reactions on them, are deleted after 90 days.
• Explicit recommendation choices: 90 days after each choice.
• Visit counts use a daily one-way code that is deleted after two days; only daily totals are kept.
• Tonight’s record of shown suggestions: 15 days.
• Reviewed reports: 90 days after review.
• Cover-failure reports and anti-abuse counters (one-way codes of IP or email address): from 15 minutes to 24 hours.
• Record of optional emails planned or sent to you: 60 days. Unsubscribe links: valid 90 days.
• If an address bounces or reports spam, a one-way code of it is kept for up to two years so we do not write to it again, also after account deletion.
• Episode records (the episodes you advanced): 8 days.
• Your community episode votes: until you change them or delete your account; they are included in your data download. Public episode averages are shown only after three members have voted.
• Encrypted backups of members’ data: 30 days.
• Deletion record: when your account is deleted, by you or at your request, Shiori keeps a one-way code derived from your account ID (the identifier shown on your profile; the code is made with a secret key that is kept apart from the database) and the date of the deletion, and nothing else, for 38 days, on our legitimate interest in honouring your deletion. It is used only to delete the account again if an older backup is ever restored. Backups made in that time keep it for as long as they are kept (up to 31 days more), so the record can exist for up to about 69 days in all.
• The web server’s access log: 7 days.
• The database’s error log (no statement text): 7 days, at most 8.

Your data and your rights

From your profile you can download a copy of your data (JSON) and delete your account, which removes your profile, list, activity, comments, alerts, support tickets and feedback and ends all sessions. You can also ask for access, correction or restriction by contacting us, and complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali). We rely on your agreement to the terms to run your account, and on our legitimate interest to keep the service secure and prevent abuse.

Who processes data for us

These services handle data for Shiori. Which ones apply to you depends on what you do on the site.

• Hosting. Amazon Web Services runs the Shiori server, so it handles every request, including your IP address and the page you ask for. The web server’s access log keeps the time, the request method, the site name, the response status and size, how long the reply took, and the network address that connects to the server (with Cloudflare in front of the site, that is Cloudflare’s address, not yours). It records no page addresses, no cookies, no browser headers and no address that Cloudflare forwards for you. The log is rolled daily and deleted after 7 days.
• Network. Cloudflare, a US company, sits in front of the site. It manages the domain name, encrypts the connection to your browser, keeps copies of the site’s static files, and sees every request, including your IP address and the page you ask for. It also forwards mail sent to the support address to the operator’s mailbox.
• Database. The database that holds your account and what you save runs on the same server as the site, at the host named above. No separate database service is involved.
• Email. SMTP2GO sends verification codes and notices, and receives your email address and the message. Messages wait in an encrypted queue until they are sent. A security notice that cannot go out the same day can wait there for up to six days, and it is still sent if you delete your account in the meantime.
• Backups. Every night an encrypted copy of the members’ data is stored in Oracle Cloud Infrastructure Object Storage. It holds accounts (with password hashes and encrypted two-step keys), libraries, lists, notes, profiles, activity and support tickets. It does not hold the catalog, sessions, sign-in codes or the email queue. The copy is encrypted before it leaves the server, and the key is kept offline by the operator, not on the server. Encrypted backups are kept for 30 days. An account you delete disappears from the backups within 31 days. If an older backup ever has to be restored, the deletion record (see How long we keep things) is used to delete again, before the site reopens, the accounts deleted since. That only works for deletions made in the last 38 days and recorded in a newer backup or in the database being replaced: if the whole database were lost, a deletion made after the newest backup would be recorded nowhere, and a backup copy older than 38 days cannot be corrected this way, so we would repeat those deletions by hand when you ask.
• Sign-in with Google. Google is involved when you choose to sign in with Google.
• Support tickets. Discord, a US service, receives the reference and category of each ticket in the operator’s private staff channel. Staff alerts also go to a private Discord channel. They contain no member data.
• Support link. Buy Me a Coffee is involved only if you follow the Support Shiori link. Shiori gives it nothing from your account.

The location of the hosting, backup storage and email servers is not listed here yet.

Catalog data comes from the open anime-offline-database, and images are loaded from third-party image servers.

Who runs Shiori and how to reach us

Shiori is run by Giuseppe Casillo. Privacy contact: [email protected].

To ask for access, correction or deletion of your data, or to raise a privacy concern, open a support ticket from your account or write to the address above. Include your account name so we can find your data.

If you cannot sign in, for example because your account is suspended or you lost access to two-step sign-in, ask by ticket or e-mail and we will delete the account for you. That deletion is done by the same routine as the Delete account button, so it also leaves the deletion record described under How long we keep things.