Privacy Policy

What we collect

Kuroko is intentionally minimal — we collect only what's required to run the site. Specifically:

• Account data — when you sign up: your email address and a bcrypt-hashed password. We never store the plaintext password.
• Library data — your watchlist, history, completed list, liked list, ratings and votes. All tied to your account id; never sold.
• Usage data — server logs include timestamp, requested URL, referrer, IP and user agent. These are kept for 14 days for abuse detection and rotated off.
• Contact submissions — name (optional), email, message body, IP and user agent. Stored until your issue is resolved or 90 days, whichever is shorter.

Why we collect it

Email + password let you sign in and sync your library across devices. Library data lets the home page show "Continue Watching" and your profile show "My list". Server logs catch abuse — bots scraping the catalog, automated stream-rips, CSRF probes — so we can rate-limit or block the offending IP. Contact submissions let us reply to your issue.

We don't use your data for analytics, A/B testing, ad targeting, personalisation, or any commercial purpose. There are no trackers, no fingerprinting libraries, no third-party analytics beacons.

Third parties

Kuroko makes outbound requests to a small, fixed set of third parties:

• image.tmdb.org — episode still thumbnails and backdrop images (TMDB API)
• artworks.thetvdb.com — fallback episode screenshots (AniZip / TVDB)
• s4.anilist.co — character portraits and cover images (AniList CDN)
• The upstream stream providers kuro-embed and Inazuma — only when you press play

Each of these receives only the request it needs (e.g. the still URL for episode 4 of id 21) — not your account id, not your kuroko session, not your watchlist. Cloudflare sits in front of kuroko.cc for DDoS protection and edge caching; Cloudflare's privacy policy applies to their log handling.

Cookies & local storage

Kuroko uses one cookie: kuroko_session, the signed session token for "remember me" logins. It's HttpOnly, Secure and SameSite=Lax. No analytics cookies, no ad cookies, no third-party cookies.

Local storage holds your library (watchlist, history, completed, liked, status map, progress) for guest mode, plus your kvs player settings (volume, speed, sub/dub preference, theater mode). Clearing local storage resets these to defaults — sign in to keep them across devices.

Your rights

You can, at any time:

• Export your library — sign in and visit your profile; there's a JSON export button under the account section.
• Delete your account and all associated data — use the contact form with your signup email and we wipe everything within 24 hours.
• Object to specific processing — same contact form, we'll review within 7 days.

We don't do behavioural profiling, so there's no "right to object to profiling" — there's nothing to object to.

Retention

• Account + library data: kept until you delete your account.
• Server logs: 14 days, then rotated.
• Contact submissions: until resolved, plus 90 days for spam-abuse follow-up, then deleted.
• Stream cache files (the per-episode server lists): 4 hours, then expired and re-fetched.
• AniList / TMDB / AniZip cache: 30 days for hits, 7 days for misses.

Children

Kuroko is not directed at children under 13. We don't knowingly collect personal information from anyone under 13. If you believe a child has registered an account, please use the contact form and we'll delete it immediately.

Changes to this policy

If we materially change what we collect or how we use it, we'll update this page and bump the "Last updated" date above. We won't retroactively change the rules — anything you submitted under the old policy stays under the old policy unless you actively re-consent.

Questions? Contact us.