Privacy policy

1. Scope and contact

This policy describes information handling when you browse, read, sign in, comment and submit requests on MuScans. External advertiser sites and services such as Google, Discord and Telegram have their own policies.

For questions, access, correction, deletion or account closure requests, use Contact us with “Privacy request” in the subject, identifying your account, the information concerned and your requested action. If you cannot sign in, ask an administrator through an official community for a private submission route. Do not publish personal details in a public channel.

2. Account and authentication information

Email registration processes your email, nickname, password hash, verification status and creation time. Passwords are checked using server-side hashes. If you choose enabled Google sign-in, Google identifiers, verified email and returned profile details such as your name are used to create or link an account; this does not give us your Google password.

Sign-in creates sessions with expiry times. Two-step verification processes encrypted authenticator secrets, recovery-code verification data and temporary challenge state to protect account access. Never put passwords, verification codes, secrets or recovery codes into comments or requests.

3. Comments, requests and collaboration

Comments store account associations, text, target comic or chapter and posting time. Public comments can display your nickname and text to other readers. Requests retain their type, subject, explanation, source links, selected comic or language, status and administrator response for review and follow-up.

Translation collaboration also processes comic and language permissions, edits or notes, and revision information. Submit only relevant information, without other people’s private details, unnecessary identity documents or full payment information. Administrators can access and handle records within their responsibilities and permissions.

4. Browser storage

Favorites, chapter and page positions, reader preferences, comment display settings, appearance and a local anonymous reader identifier are stored in your browser. Popup frequency uses session storage. Signing in does not automatically sync your library or detailed reading positions across devices.

Local storage does not mean these features never contact the server. Opening comics, fetching library title details, reporting chapter reads and loading ads make service requests. Changing devices, private browsing, disabled storage or clearing site data can remove saved progress and preferences.

5. Cookies and their purposes

Sign-in and security cookies include folio_reader, folio_session and folio_csrf. Google sign-in and two-step verification may also use temporary cookies when those features are used. folio_locale remembers the interface language, with a separate language cookie for the admin interface.

muscans_visitor is a server-issued visitor cookie containing a random identifier and the IP address at issuance. Signing verifies integrity and does not encrypt its contents. It lasts 30 days and supports visitor recognition, deduplication and related safety controls. View, restrict or clear cookies in your browser; blocking sign-in or security cookies can prevent authentication or submissions.

6. Reading, advertising and security activity

Servers receive network information such as IP addresses and request details to deliver pages, limit requests, prevent abuse and investigate failures. Reading statistics use a hash derived from the server visitor identifier with comic, chapter, date or last activity information for deduplication, views and popularity. This is separate from locally saved reading positions.

Ad events record an ad identifier, impression, click or popup attempt and time for counting and deduplication. Hashes and random identifiers do not guarantee that data is irreversibly anonymous. Administrative and security actions may also produce audit records for access and incident review.

7. Advertising, service providers and external services

Ads may depend on interface language, device type, scheduling and frequency rules. The current implementation blocks creatives marked as requiring consent. There is no functioning ad-consent management interface yet; continuing to browse must not be treated as consent to all third-party tracking.

Displayed creatives may load external images, scripts or embedded pages. Their providers may receive your IP and browser information and use their own storage technologies. Ad and community links open external services. Choosing Google sign-in exchanges authentication information with Google; email verification uses email delivery services. Infrastructure and mail providers process information needed to deliver those services.

Providers can have different operators, processing locations and retention practices. This page does not guarantee processing in a single country or region. Contact us about specific providers or locations and review the current provider policy when using an external feature.

8. Retention and cleanup

Local library data and preferences normally remain until you or the browser removes them; session storage normally ends with the browser tab session. Login and temporary authentication state have their own expiry periods.

Detailed reading and ad event records are cleaned in batches according to the configured retention window. The system default is 90 days; the running configuration can differ. This is not a 90-day deletion promise for accounts, comments, requests or backups. Aggregate counts may survive the removal of detailed events.

Account, comment, collaboration and request records support ongoing service, follow-up and dispute review; this page does not set a single automatic deletion deadline for them. Ask about a specific record or request deletion. Backups and information needed for security, disputes or applicable legal requirements may not be removed at the same time as live records; the handling of a request depends on those circumstances.

9. Your choices and privacy requests

You can sign out, inspect or clear browser site data and keep personal details out of public comments. Signing out ends the relevant session; it does not delete your local library, account, comments or requests. Clearing browser data does not close an account.

Use Contact us to request access, a copy, correction, deletion, account closure or restrictions on processing. There is currently no one-click account deletion or export interface. An administrator may verify account ownership and consider applicable requirements, others’ rights and necessary retention. Never send a password or verification code as proof of identity.

10. Information security

Password hashing, session checks, request forgery protection, access controls and rate limits reduce risks. Authenticator secrets are encrypted and recovery codes use verification data. No transmission or storage system can guarantee absolute security. Use a unique password, protect your email and devices, and report suspicious account activity.

11. Younger users

Minors should review the service, content notices and information practices with a parent or guardian. Avoid posting real names, schools, addresses or contact details. A guardian who finds inappropriate collection, disclosure or content can contact an administrator with the relevant page and requested action for review.

12. Changes to this policy

This policy may change as features, providers or information practices change. The date above identifies the latest revision. Significant changes to processing should be highlighted appropriately, with any required consent requested separately. You can return here from the footer at any time; continued use does not replace consent where separate consent is required.