Privacy Policy

This policy covers aniimoverse.com and everything served from it: the Aniilog, the tier list, the Idyll map, the tools and the guides. “AniimoVerse”, “we” and “our” mean the people who operate the site.

It does not cover anywhere a link takes you. The official Aniimo site, wiki.aniimo.com and YouTube each set their own rules for what they collect, and reaching them from here does not put them under this policy.

If you register, Supabase stores your email, chosen handle, password hash and authentication records. Your collection entries and update timestamps are stored privately under your account. The contact form asks for a name and reply address only when you choose to send us a private message.

That is the whole list. We hold no postal addresses or payment details. A name, email address, and message are held only when you choose to contact us, whether through the form or by direct email.

Voting on the Aniimo tier list and opening a guide both send a small request that leaves a deduplicated record. It is worth setting out exactly, because an earlier version of this page said votes stay in your own browser, and that was wrong.

What is sent

A vote request carries a creature and tier. A guide-read request carries the guide's public slug. Neither request body carries an identifier, name or session.

What is stored

The server reads your IP address from the header our reverse proxy sets, reduces an IPv6 address to its /64 prefix, and computes a SHA-256 hash of a server-side secret joined to that address. Vote and guide-read hashes are separated so database rows from the two features cannot be matched by comparing hashes. A guide-read row holds the guide slug, 64-character hash, UTC day and timestamp. The raw address is never written to the database, never returned to any browser, and the secret never leaves the server.

Why it exists

Database unique indexes enforce the voting rule and count at most one read of each guide from the same connection per UTC day. Clearing site data does not reset either rule. If no address we are willing to stand behind is available, the request is refused rather than recorded against a value somebody could have picked for themselves.

Requests are rate limited in server memory. What any browser can read back is the counted total per tier choice, each guide's lifetime reads, and its daily aggregate used for a seven-day trend. Individual vote and guide-read rows, hashes included, are not readable by a browser. Guide-read ledger rows are deleted after 32 days; identifier-free aggregates are retained for long-term comparisons.

On by default: Umami

Traffic is measured with Umami running on our own server. It sets no cookies, stores nothing on your device and asks you for nothing, which is why it carries no consent prompt. It records the page path, the referrer, a rough country, a device class, and one of twenty fixed event names, such as a search being submitted or a redeem code being copied.

Before a page view is recorded, a script strips the query string of q, query, search, email, token, access_token, refresh_token, error, error_description and next, and drops the fragment. Search terms and anything credential-shaped never reach the analytics server. Separately, completed site-wide search requests are written to a private Supabase table with result counts, but no IP address, account, cookie, session, referrer or user agent. Autocomplete is debounced, so it records the suggestion requests the browser actually sends rather than every keystroke. Nothing records the contents of any other form.

Off until you allow: Google Analytics, heatmaps and replays

Two further measurements are optional and stay switched off until you allow them: Google Analytics, and Umami's session recorder, which captures clicks, scrolling and pointer movement to build heatmaps and replays of the pages you visit. One choice governs both.

In both states the Google tag runs with ad storage, ad user data and ad personalization denied, and with Google Signals and ad personalization signals switched off. Turning the choice off updates the tag's consent to denied, sets its kill switch, and deletes the _ga and _ga_* cookies it can see.

You are asked once. Analytics choices at the bottom of any page reopens the prompt, shows the answer currently in force, and lets you change it in either direction.

Essential sign-in cookies maintain your session. Collection progress is stored in your browser, separated by account. On first sign-in, existing guest progress is merged into your account. Account copies remain on the device for retrying failed syncs, so clear browser data when leaving a shared device. Synced progress remains in your account until you request deletion.

Guest squad listings use an essential, signed cookie to let the same browser manage its listing without an account. It is sent only to AniimoVerse and expires on October 27, 2026. Clearing it loses access to edit or remove that guest listing. Nothing listed here is used to follow you between sites.

Browser storage stays on your device. Essential session cookies are sent to AniimoVerse to authenticate requests. For guest squad abuse prevention, we store a keyed digest of the trusted client address, never the raw address, in a private rate-limit ledger. Old rate-limit entries are pruned during subsequent guest requests after two days. Clearing site data removes local preferences and guest management access; public browsing keeps working.

• Serve the pages and run the tools.
• Count what gets read, so editing time goes to the pages that need it.
• See which searches return few or no useful results, so we can fill those gaps.
• Keep the tier list honest with the one-vote-a-day limit.
• Keep the vote endpoint from being hammered.
• Deliver and answer support, correction, partnership, and press messages.
• Diagnose faults when something breaks.
• Meet a legal obligation, or defend the site against abuse.

Where the law asks for a basis: cookieless measurement, abuse prevention and the vote limit rest on our legitimate interest in running a site that works and a tier list that means something. Contact-message handling is necessary to answer the request you chose to send and, where relevant, take the steps you asked us to take. Google Analytics, heatmaps and replays rest on your consent, and on nothing else.

We do not build profiles of individuals, do not make automated decisions with legal or similarly significant effects, and do not sell or rent data to anybody.

Your account email and collection are private; signing up does not create a public profile. The single public artifact a visitor produces on AniimoVerse is the vote count beside each creature on the tier list.

Search terms and contact messages stay private. Vote totals are counts and nothing else: they carry no hashes, no per-voter timestamps and no way to tell who voted for what.

Beyond those, we disclose information only when the law requires it, when a lawful request compels it, or when it is needed to investigate abuse of the site. If AniimoVerse were ever transferred to a new operator, the database would go with it, and this policy would continue to apply until the new operator published its own.

There is no advertising on AniimoVerse today and no ad script runs. We have applied to show ads through Google AdSense. If ads are switched on they work as described below, and this section and its date change before the first ad appears.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to AniimoVerse or to other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to AniimoVerse and other sites on the internet.
• You can opt out of personalised advertising in Google's Ads Settings, or opt out of some third-party vendors' cookies at aboutads.info.
• Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent in a Google-certified consent message before any advertising cookie is set.

How Google uses information from sites that show its ads is explained at policies.google.com/technologies/partner-sites.

• The function that records a vote can only be called by a privileged server role. It is revoked from the roles a browser can reach, and it refuses to run if it is ever called as one.
• Row Level Security is switched on for every table. A browser can read published news posts, redeem codes and the counted vote totals. It cannot read a single vote row.
• Search rows are written only by the server role, are unreadable by browser roles, carry no visitor identifier, and are automatically removed after one year.
• The vote secret and the privileged database key are server-only environment variables. Neither is ever sent to a browser.
• Vote requests are size-capped, type-checked and rate-limited before anything reaches the database.
• Contact requests are same-origin, size-capped, strictly validated, rate-limited, checked with Turnstile, and delivered with a server-only Resend credential.

No system is completely secure, and we will not pretend otherwise. If you find a weakness, tell us at the address in section 16 before you tell anyone else.

The analytics switch

Analytics choices at the bottom of any page. Denying stops Google Analytics and the session recorder, and clears the Google cookies already set. The cookieless measurement in section 4 has no switch, because it holds nothing to switch off.

Your browser

Blocking cookies, blocking scripts and clearing site data all work here, and the site stays fully usable with any of them on. Clearing site data removes every key listed in section 5.

Access, correction and deletion

If you are in the EU, the UK, California or anywhere with comparable law, you can ask what we hold about you, ask us to correct or delete it, object to processing based on legitimate interests, and complain to your data protection authority.

Contact us from your account email to request account and collection deletion. Search rows deliberately have no visitor identifier, so we cannot single out which searches were yours; all of them age out after one year. If you wrote to us, we can locate that correspondence by the reply address you supplied. Vote and guide-read rows are keyed only to separate salted hashes, and we can find them only if you contact us from the same connection. Ask, and we will tell you what those checks return and delete what can be linked to you if you want it gone.

On California's terms specifically: we do not sell personal information and do not share it for cross-context behavioural advertising, so there is no opt-out to operate. We offer no financial incentives, and nobody is treated differently for exercising a right.

AniimoVerse is a reference site for a video game, written for players rather than for young children. It is not directed at children under 13, or under the higher age set by local law where that applies.

We do not knowingly build a profile of a child or ask a child to create an account. A site-wide search term is stored without anything that identifies who entered it. If you believe a child's information has reached us through search or a contact message, write to the address in section 16 and we will remove what we can locate.

AniimoVerse is available worldwide, and the companies in section 8 run infrastructure in more than one country. Information handled under this policy may therefore be processed outside the country you are reading from.

Where data from the EU, the UK or Switzerland moves across a border, those companies rely on the transfer mechanisms set out in their own agreements, standard contractual clauses among them. This includes authentication records, collection data and contact messages where applicable.

The date at the top of this page marks the version in force. When something material changes we update that date and rewrite the section it affects, rather than bolting an appendix onto the end.

A change that widens what is collected, most obviously the arrival of advertising, gets described in the section it belongs to before it takes effect. Continuing to use the site after a change means you accept the version then published.

Privacy questions, access requests and anything else about this policy go to [email protected] or the private contact form. Do not include a password, authentication code, or identity document in the first message.

Copyright complaints have their own route on the DMCA page, and the rules for using the site itself are in the Terms of Use.