Privacy policy

1. Information we store

For member management, we retain the account hash, sign-in provider, first and latest recorded sign-in times, and private management notes. We do not store Google email, name, photo or authentication tokens. Sign-in times and notes are cleared at closure; minimal identification and closure status remain to prevent reuse.

Optional profiles and external video

Photos, bios, social and video links you submit are public. We do not import Google profile photos. You can edit or remove them; account closure erases them from active data. Backups expire under the existing retention schedule.

We do not connect to YouTube before playback. Playing loads its privacy-enhanced player, where YouTube processes connection and playback data. Social links open their external services when clicked.

• Hash of the unique Google account identifier — a 64-character SHA-256 string derived with a server secret, used to distinguish signed-in readers and creators. We do not store the original identifier, but this value can link activities by the same account.
• Pen name — the name chosen by the creator.
• Uploaded episode files (HTML), their SHA-256 hashes, sizes, upload times and publication times.
• Token ledger entries, including grants, adjustments and reasons.
• Review stages, decisions, reasons and times; fingerprints of the reviewed file and review account; the model used; and administrator action history.
• Likes and followed works, linked only through the account hash described above.
• We retain public comment text, display labels, posting times, spoiler settings and account links, plus report categories, status and private moderation reasons. Deletion by the author or account closure erases the comment text, label, account link and moderation reason. Content-free deletion records and minimal audit records remain to prevent restoration. Reporter account links are cleared on comment deletion or reporter account closure.
• Request counts for abuse prevention. Connection addresses are counted only as hashes and deleted after 25 hours.
• An optional email address entered by the creator on the notifications page; see section 2-3.
• The version, language, time and fingerprint of accepted terms, and the rights confirmation, fingerprint and size of an uploaded file. Links between accounts and acceptance records are managed separately.
• Report, support and privacy request messages and references, notices to the parties, and processing stages, outcomes and times. Submit personal information and third-party material only as needed to handle the request.
• A session revocation number, recent sign-in time and account closure state, used to prevent a closed account from resuming activity through an old session.

2. Information we do not store

• Email, name, profile picture and the original Google identifier received through Google sign-in. A notification email address entered directly is an exception.
• Original IP addresses and long-term reading history linked to accounts. Episode views count requests; daily deduplicated visit analytics is explained separately below. Reading data used to detect bulk collection is retained for one hour (section 2-2).
• Passwords. The service uses only Google sign-in and has no separate password.
• Payment information. Payments are not yet available.

Visit analytics and opting out

A secret hash of the connection address and browser information changes daily for deduplication. Visit analytics stores no raw IP, user-agent string, account data or search terms and adds no tracking cookies.

Country is estimated using an IP database on the server. It is not nationality or residence and may differ with VPNs or carrier routing.

Daily visitor hashes, country, device, first/last times, counts and separate public-page totals are kept for the latest 30-day window and pruned by scheduled maintenance. They are not linked to accounts or tracked across dates.

Visit collection is skipped when the browser sends Do Not Track (DNT) or Global Privacy Control (GPC).

2-1. Marks added to the reading screen

For signed-in readers, we add an eight-digit mark (32 bits) derived from the account hash as a faint brightness pattern. Its default strength is 0.4% (4‰); an operator may adjust or disable it. Visible text watermarks are off by default. Marks are added when sending the response and do not change the stored original episode.

All hidden marks in signed-out previews use the same value, 00000000. When text watermarks are enabled, signed-out screens show guest. These shared values do not identify individual visitors.

Marks in leaked screenshots are used only as investigative clues. Different accounts can share a 32-bit value, and damage or forgery can cause incorrect readings. The current lookup tool returns registered creators with the same value as candidates; ordinary readers who have not registered as creators are outside its scope. Even a single candidate does not identify a leaker, and a shared value does not prove that the screenshot came from a signed-out session.

2-2. Temporary data for detecting bulk collection

To detect automated bulk collection, we retain account hashes and the episodes read for one hour only and then delete them. When thresholds are met, such as reading eight distinct episodes in ten minutes or making three original-file requests outside the viewer, numerical detection records remain while the episode list is deleted. Reading is restricted for one hour for the flagged account; an administrator can lift the restriction.

2-3. Optional notification email

We store only the email address you enter yourself on the notifications page in the creator studio. When email delivery is enabled, it is used for supported episode-review notifications. Codex automated approval and hold results are available in site notifications. Saving an empty address removes the notification address from the service. We do not automatically import or store an address from Google sign-in.

Emails contain the work title, episode number, review notice or reason, and a link to the relevant site page. They do not include episode files or sign-in credentials. Site notifications remain available even if email delivery fails.

2-4. Reading quality measurements

Timing starts when the first page is requested and ends when its image is displayed. It excludes navigation and preparation of the reader screen itself.

Counts actual image displays and error signals in the paged reader. Original HTML mode is excluded. Time while the page is hidden is excluded from first-image timing.

Only totals by date, interface language, measurement type and time bucket are retained for 30 days. These aggregates do not retain raw events, account, work or episode identifiers, addresses or browser information.

Numbers count received signals, not unique readers. Displaying the last page does not prove completion. Blocking or disconnections can lose signals; restarts or multiple servers can duplicate them. These are not definitive conversion rates.

3. Identifying operators

Only at sign-in, we compare the email address with the operator list and place only the hashed result in the sign-in cookie. It is not stored in the database.

4. Information sent to external services

When an episode is published, its identifier, SHA-256 hash and publication time are sent to smartapex.uk as a public record for file-integrity comparison. This request does not include the file contents or pen name. When a reader requests an external comparison on the original-verification page, the server retrieves that public record again.

Original-verification records compare the stored file hash with publication records. They do not guarantee copyright registration, ownership or the truth of the story content. Cinetoon and smartapex are run by the same operator.

When sending optional notification emails, we send the recipient address and the notification content described above to the configured mail server. If an operator enables Codex automated review, embedded episode images, subtitles and HTML text in all languages, and work and episode titles are sent to OpenAI Codex. Review uses the subscription account connected by the operator; site sign-in cookies and creators’ Google account information are not sent.

AI approves and publishes episodes that pass the complete review and specification checks. Incomplete reviews or detected issues are held for administrator review. Hold notifications are sent to the administrator through Telegram and include only an episode-management link and notification-record identifier. Episode files, subtitles and sign-in credentials are not included in Telegram notifications.

Changes to public work information are also reviewed. Submitted covers, titles, descriptions, genres, exclusive labels and supplied translations may be sent to Codex for review. Administrator Telegram alerts for reports and privacy requests contain only a request-page link and notification ID, without messages, references or contact details.

5. Running episode files

Original episodes run in an isolated browser sandbox. They are isolated from direct access to site sign-in cookies and the outer page, and episode-code network connections such as fetch and WebSockets, and form submissions, are blocked. Signed-out previews are static reconstructions of part of the original and do not execute episode scripts.

The isolated episode and the site viewer exchange language codes and supported-language lists needed for subtitle switching. These messages do not contain sign-in cookies or original-file access tickets. Isolation limits the privileges of episode code; it does not guarantee safe content or prevent all screenshots and copying.

6. Deletion

Access to a deleted episode is blocked first. Its original and preview/reader files become eligible for cleanup. Originals held for a dispute with a recorded reason and deadline remain under restricted access until that deadline. Failed file checks or deletion are retried.

Retired work descriptions and covers are cleaned up after 90 days. Current approved versions, ongoing reviews and evidence with a specified hold deadline are protected. Report and privacy-request message bodies are cleared after their displayed retention deadlines; minimal records of the actions remain.

For on-server recovery copies, dumps older than 30 days are cleaned up after a successful backup verification. A copied file is cleaned up 30 days after it is first confirmed to be outside the current retention set. Interruptions, failed checks or evidence holds can extend retention and require administrator attention. Restores must be reconciled with the latest deletion and hold state before publication.

Existing public records and approval/administrator histories remain after file deletion so decisions can be traced. Review histories do not store copies of episode images or OAuth tokens.

7. Cookies and browser storage

We use an encrypted sign-in cookie (7 days), temporary sign-in cookies, and a functional cookie that remembers your interface language (cinetoon-locale, up to one year). The language cookie stores only the selected code: ko, en, ja or vi. We do not use advertising or tracking cookies.

The site opens in English on your first visit. You can choose Korean, English, Vietnamese or Japanese from the top menu. We remember your choice for future visits.

Captions start in your site language unless you choose a different caption language. Your choice is stored separately in this browser as a language code in a cookie for one year, and is kept across next and previous episodes and page reloads. Episodes without that translation use an available language without changing your saved choice. Old localStorage caption settings are not used. You can remove language cookies and old caption settings by clearing this site’s data in your browser.

Continue reading stores the last episode ID, episode number, page and reading time for up to 50 works, plus the library visit time, in this browser. Records expire after 90 days without use and are not synchronized to the server. No manuscript text, names, account details or reading tickets are stored. Clear them in My library or through your browser's site-data controls.

Expired reading records are removed from browser storage the next time the site accesses reading records. People sharing the same browser may see them, so clear records on shared devices.

8. Privacy requests and account closure

After signing in, use My information to request access, correction, deletion, restriction of processing or account closure, and view the outcome. Downloads contain a summary of the displayed page; request access to any additional material you need.

Account closure requires sign-in within the last 15 minutes and explicit confirmation, and is processed by an administrator. Closure revokes old sessions, blocks publication access and clears the pen name, optional email, likes and follows. Manuscript cleanup runs in stages; check the request page for progress, completion and retention exceptions.

Links between an account and terms acceptances become eligible for cleanup 90 days after closure, except for time-limited dispute holds. Accepted document and file fingerprints, publication records, token ledgers and minimal action history remain as evidence. Completed privacy requests are detached from the account after 90 days. This does not mean every record is immediately deleted or fully anonymized.

Ending all sessions invalidates existing Cinetoon sign-ins; it does not sign out your Google account or close your service account. Settings and reading records stored only in your browser can be cleared separately.

My information and requestsMy terms acceptance historySupport and reports