Privacy Policy

The data controller is Víctor Franco, an individual living in Spain who builds and runs KULTURA. Contact for any privacy matter: kultura.app.contacto@gmail.com. You don't need an account to write.

There is no data protection officer because, given its size and activity, KULTURA is not required to have one. The owner's details are in the legal notice.

It depends on what you use:

• Account: email and password (stored encrypted by Supabase; I can't see it) or, if you sign in with Google, your email and the basic profile data Google shares (name and photo, which KULTURA doesn't display). Also your username, avatar, optional bio, language, and the date and version of the terms you accepted.
• Library: saved titles, status, ratings, progress and dates.
• Social activity: friendships and requests, blocks, private messages, lists, groups and their posts, recommendations between friends and notifications.
• What you send me: suggestions and reports. In the report form for people without an account, also the contact email if you choose to leave one.
• Technical data: IP address and browser data to serve the site, stop abuse and rate-limit requests; error reports; and aggregated usage data (see “Analytics and cookies”). If you turn on push notifications on a device, also the notification address its browser creates, its encryption keys and the language of the notifications.

To create an account, an email and password, or signing in with Google, are required; without them the account can't be created (Art. 13(2)(e) GDPR). Everything else is optional: bio, avatar, what you save or share and the email in the report form.

I don't ask for special categories of data. Still, what you watch, read or play can say things about you: that's why your library is not public by default.

• Providing the service (account, library, lists, friends, chat and groups): performance of the contract you accept when you sign up (Art. 6(1)(b) GDPR).
• AI recommendations, only when you press the button: it's a feature you ask for, under the same contract. If you don't press it, nothing is sent.
• Security (rate limiting, abuse prevention, error diagnostics and backups): legitimate interest in keeping the service working and safe (Art. 6(1)(f) GDPR).
• Reports and moderation: complying with the Digital Services Act (Art. 6(1)(c) GDPR) and legitimate interest in protecting the people who use KULTURA.
• Aggregated usage statistics (how many people sign up or use each feature): legitimate interest in improving the product, with no cookies and no tracking across other sites.
• Account emails (confirmation and password changes): performance of the contract. I don't send newsletters or advertising.

I don't make automated decisions with legal effects on you: recommendations are just suggestions.

“For you” recommendations are generated by Claude, a model from Anthropic, only when you press “Recommend me”. It receives up to 15 titles from your library that you finished or rated highly (title, type, year and rating), your favorite genres and the app language. Your name, email and user ID are not sent.

There is at most one request per person per day, except for one retry if it fails. The answer is kept that day so it isn't repeated, and deleted when the next one is generated. Under Anthropic's commercial terms, what it receives through its API is not used to train its models.

I also use AI to translate some catalog synopses. Only the synopsis text is sent, with none of your data.

• Your library (titles, ratings and stats): by default, only your friends. In Settings you choose between “Anyone with an account”, “Only my friends” and “Only me”. Without signing in, nobody can see it.
• Your public profile (kulturaapp.vercel.app/u/your-username): username, avatar, bio and the lists you make public. Anyone can see it, even without an account.
• Lists: private unless you choose to make them public. Shared lists are also visible to their members.
• Private messages: only the people in that conversation. You can only message your friends, and anyone you've blocked can't message you.
• Groups: posts are only visible to members; the name and description of a public group, to anyone with an account.

Your username is not taken from your email, and your email is never shown to anyone.

To run KULTURA I use these providers, which process data on my behalf under a data processing agreement:

• Vercel (Vercel Inc., USA): website hosting, with the server in Frankfurt (EU), and visit counting.
• Supabase (Supabase Inc., USA): database and sign-in, hosted in the EU (Frankfurt).
• Anthropic (Anthropic PBC, USA): AI recommendations, only when you press the button.
• Sentry (Functional Software Inc., USA): error reports, hosted in the EU (Germany).
• Resend (USA): emails me a notice of each report, with its content and, if you left one, your contact email.
• Upstash (Upstash Inc., USA): a counter for rate limiting. It only receives an encrypted fingerprint (hash) of the IP or ID, which expires within minutes.
• Google (Google Ireland Ltd.): sign-in, only if you choose to sign in with Google.
• Browser push notification services (Google, Mozilla, Apple or Microsoft, depending on yours): only if you turn on notifications. They deliver each notification encrypted and can't read it; the notification says who wrote to you, never the text of the message.
• GitHub (GitHub Inc., USA): stores the backups, which are encrypted before they leave, so GitHub can't read them.

Several are US companies or may access data from there to provide support. These international transfers rely on the EU-US Data Privacy Framework where the company is certified and, in any case, on the European Commission's standard contractual clauses included in their processing terms (Arts. 45 and 46 GDPR).

Title information comes from public catalogs: TMDB (with JustWatch data for “Where to watch”), RAWG, Steam, AniList, MyAnimeList (through Jikan), MangaDex, Open Library, Google Books and Comic Vine. KULTURA's server makes these requests with the search text, without your IP or your account. Some covers load directly from those catalogs' image servers, which receive your IP as with any website you visit.

Trailers on some title pages come from YouTube (Google): the trailer loads from youtube-nocookie.com only when you press play; from that moment, Google's policy applies.

No provider receives data for advertising, and I don't sell or share data with anyone unless the law requires it.

There's no cookie banner because KULTURA doesn't use cookies that need your consent:

• Session (Supabase): strictly necessary cookies to keep you signed in.
• Language (NEXT_LOCALE): remembers the language you pick.
• Local storage: during sign-up, the browser briefly keeps the character you pick and deletes it once sign-up is done.

Visits are counted with Vercel Web Analytics, which uses no cookies: it counts page views with a temporary fingerprint that is discarded within 24 hours and can't identify you.

KULTURA may also record usage events from registered people (for example, signing up, saving a first title or accepting an invitation) and how you arrived when you signed up (an invitation or campaign link), to study them in aggregate, with no cookies and no cross-site tracking.

• Your account data, library and activity: for as long as you have the account.
• When you ask to delete your account, it is scheduled for 7 days; if you sign in again, you can cancel it. After that, your profile, library, lists, friendships, the messages and posts you sent, your recommendations, notifications and reports are deleted.
• Groups you created and your shared lists pass to another member so the others don't lose their content; if nobody is left, they are deleted. Titles you added to other people's lists stay there, without your name.
• Suggestions you sent are kept without any link to your account. If you want them deleted, just ask.
• AI recommendations: until the next day's are generated.
• Usage events: while you have the account; they are deleted with it.
• Devices with push notifications: until you turn them off or sign out on that device, the browser cancels them, or 10 deliveries in a row fail. They're deleted with your account.
• Server logs: deleted automatically within a day. Error reports (Sentry): 30 days. Rate-limit fingerprints: a few minutes.
• Encrypted weekly backups: 90 days. What you delete disappears from them when they expire.
• Reports and their outcome: as long as needed to resolve the case and handle a possible appeal.

You can ask for access, rectification, erasure, objection, restriction of processing and portability of your data. You can do many things yourself in Settings: edit your profile, change who sees your library, export your data and delete your account. For anything else, write to kultura.app.contacto@gmail.com; I reply within one month at most.

The export is a JSON file with your profile, library, lists, friendships, the messages you sent and the ones other people wrote to you in the conversations you're still in (with who wrote them), your conversations (dates and participants), posts, groups, invitations, recommendations sent and received, suggestions, notifications, reports, your diary and your devices with push notifications. It doesn't include messages from conversations you've left (if you want a copy, ask me by email and I'll send it) or the encryption keys of push notifications: for each device you only get the dates and the start of its notification address.

If you think I haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.

You must be at least 14 to use KULTURA, the age from which you can consent to the processing of your data in Spain (Art. 7 LOPDGDD); you confirm it when you sign up. If I learn that an account belongs to someone under 14, I'll delete it. If you're a parent or guardian and think this is the case, write to me.

Everything travels encrypted (HTTPS). The database applies row-level permissions so each person can only read and change what belongs to them, passwords are stored encrypted, and backups are encrypted before they leave. If you find a vulnerability, write to kultura.app.contacto@gmail.com; details are in the legal notice.

If I change anything important, I'll announce it in the app before it applies and update the version and date at the top.