Neko — Anime & Manga Tracker | Effective date: May 25, 2026
Neko ("we", "our", or "the app") is a free mobile application that helps you track anime and manga using the AniList platform. This policy explains what data we collect, why we collect it, and how we handle it.
Neko operates a small backend on Cloudflare Workers to deliver push notifications, receive in-app feedback, and record anonymous aggregate usage events. Everything else — your anime/manga lists, search index, image cache, and reading progress — stays on your device. This policy distinguishes the two clearly.
| Data | Source | Purpose |
|---|---|---|
| AniList profile (username, avatar, ID) | AniList OAuth | Authentication & displaying your profile |
| Anime & manga list data | AniList API | Core app functionality — tracking your lists |
| OAuth access token | AniList OAuth | Authenticating API requests on your behalf |
| Anime metadata cache & cover images | AniList API | Offline browsing of titles you've already loaded |
| Smart Search index (on-device AI model) | Downloaded once on enable | "Search by meaning" without sending queries to a server |
The following data is sent to and stored on our Cloudflare Workers backend so that push notifications, in-app feedback, and aggregate usage analytics can work. Each item is listed separately because each is optional in its own way.
| Data | When sent | Purpose |
|---|---|---|
| Anonymous device identifier (random UUID generated on your device) | The first time you enable push notifications, submit feedback, or open the app | Identifies your device for the duration of its install. Not linked to your Google account, phone number, IMEI, or any advertising ID. |
| Firebase Cloud Messaging (FCM) push token | When you enable push notifications | Required to deliver notifications to your device via Google's FCM service. |
| Subscription list (which anime/manga IDs you've turned the bell on for) | When you tap the bell on a title | So our hourly job can check whether those titles have aired a new episode or changed status, and notify you. |
| Notification history (last ~90 days of notifications we sent you) | Server-side, after each notification we send | So you can review past notifications inside the app, even on a freshly installed device. |
| Feedback message (up to 2,000 characters) | Only when you tap Settings → Help & feedback → Send feedback | So we can read and act on your bug report or suggestion. |
| Email address (optional, on the feedback form) | Only if you enter one and tap Send | So we can reply to your feedback. Leave it blank and your submission is anonymous to us. |
| Diagnostic context (app version, Android OS version, device model) | Attached to feedback submissions only | So we can reproduce bugs accurately. Not sent at any other time. |
| AniList user ID (optional, on the feedback form) | Only if you tick the "Include my AniList handle" toggle (default off) | So we can match your feedback to your account if needed. |
| Country (2-letter ISO code, e.g. "US", "IN") | Attached to feedback submissions, derived from the request edge by Cloudflare | To analyse abuse patterns at a coarse level. We never log full IP addresses. |
Anonymous usage events (app_open, list_view, details_view, smart_search_run, list_import_complete) |
Periodically during app use — see §8 for the full event list and what each contains | Aggregate product analytics. No personally identifiable information, no search query text, no title names — bucketed counts and success/error flags only. |
smart_search_run analytics event records only a bucketed result count (e.g., "1-5", "6-20") and a success flag; the query text itself is never sent.Neko uses AniList OAuth (Implicit Grant) to authenticate you. When you tap "Login with AniList", you are redirected to AniList's website where you enter your credentials directly. Neko never sees or stores your AniList password. We only receive a temporary access token that allows us to read and update your anime/manga lists.
Local data (your lists, cached metadata, OAuth token, Smart Search index, image cache) is stored only on your device using the platform's secure storage and SQLite database. It never leaves your device unless you take an action that explicitly sends it (e.g., subscribing to notifications, submitting feedback, opening the app for the periodic app_open analytics event).
Server-side data (listed in §1.2 above) is stored on Cloudflare D1, Cloudflare's edge-distributed SQLite database, or, for the aggregate usage events in §8, on Cloudflare Workers Analytics Engine. The infrastructure is operated by Cloudflare, Inc. and inherits Cloudflare's security and certifications. We do not run our own physical servers.
If you enable push notifications, Neko polls the AniList API on a fixed schedule (hourly for new episode airing, every 6 hours for status changes such as a series returning from hiatus) and sends a push notification through Google's Firebase Cloud Messaging service to the devices that have subscribed to that title.
You can disable notifications at any time from your device's system settings or from Neko's Settings → Notifications screen. You can also turn off individual subscriptions one at a time from the bell icon on each title's detail page.
Neko has a "Send feedback" option in Settings that lets you message us directly. When you submit feedback:
The feedback flow has no "send a copy to yourself" feature, and we do not send automated email replies — any reply you receive will be from a real person.
Neko's "Coming Soon" feed shows an inline Play button on anime cards that have a publicly available trailer on YouTube. No video data is loaded until you tap Play — at that point, an embedded YouTube player is opened inside the app to stream the trailer.
The embedded player is provided by Google LLC via the publicly documented YouTube IFrame Player API. When you tap Play, the following happens:
youtube.com and googlevideo.com.Neko itself does not receive, store, or share any video playback data with Google or any other party — the data flow is directly between the embedded YouTube player and Google's servers. Neko has no analytics hook on the trailer play action.
If you do not want Google to receive this data, do not tap the Play button on a Coming Soon card. The rest of the app (browsing, tracking, reminders, smart search) works fully without ever invoking the YouTube embed.
Neko sends a small set of anonymous usage events to its own Cloudflare Workers Analytics Engine to understand how the app is used in aggregate. This data is used only to inform product decisions (e.g., "is the smart search feature actually used?", "how many users complete a MAL import?") and is never sold, shared, or used to track you individually.
The events sent are limited to the following fixed allow-list — anything outside this list is silently dropped by the server:
app_open — fired when you open the app. Deduplicated to at most once per hour per device, so foregrounding the app repeatedly does not send extra events.list_view — fired when you open your tracked-anime list screen. Deduplicated per app-launch session.details_view — fired when you open an anime or manga details screen. Deduplicated per app-launch session.smart_search_run — fired when you run a smart search. Includes a bucketed result count (one of: 0, 1-5, 6-20, 21+, error) and a success/error flag. Your actual search query text is never sent.list_import_complete — fired when a MyAnimeList → AniList import finishes. Includes a bucketed list-size category (one of: 0, 1-19, 20-99, 100-499, 500+) and a success/empty outcome.Each event is tagged with the same anonymous device identifier used for push notifications and feedback (see §1.2). The events are stored in Cloudflare Workers Analytics Engine for approximately 30 days, after which they are auto-purged by Cloudflare's retention policy. We do not use Google Analytics, Firebase Analytics, Mixpanel, Amplitude, or any third-party analytics SDK — the analytics endpoint is on the same Cloudflare backend already described elsewhere in this policy.
There is no in-app toggle to disable analytics in this version of Neko because the payload contains no personally identifiable information, no search query text, no title names, and is auto-purged within ~30 days. To stop sending events entirely, uninstall the app — uninstalling removes the anonymous device identifier and ends the data flow.
| Service | What we use it for | Privacy Policy |
|---|---|---|
| AniList | Authentication & anime/manga data | anilist.co/terms |
| Cloudflare (Workers, D1, KV, Analytics Engine, Email Routing) | Hosting our backend — the data listed in §1.2 and the aggregate events in §8 | cloudflare.com/privacypolicy |
| Google Firebase Cloud Messaging | Delivering push notifications to your device | firebase.google.com/support/privacy |
| YouTube / Google LLC | Embedded trailer playback in the Coming Soon feed (only when you tap Play — see §7) | policies.google.com/privacy |
| MyAnimeList API (Jikan) | Backup data source when AniList is rate-limited | myanimelist.net/about/terms_of_use |
| Hugging Face | Hosting the Smart Search AI model downloaded to your device | huggingface.co/privacy |
We may also display links to external streaming platforms (Crunchyroll, Netflix, etc.) but do not share any user data with them. Tapping a streaming link opens the platform in your browser or their app.
Neko is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
You can delete all of your data at any time. Different categories have different deletion paths:
EU / UK users have additional rights under the General Data Protection Regulation (GDPR), Articles 15–22: access, rectification, erasure, portability, objection, and restriction. To exercise any of these rights, email us at the address above. Our legal basis for processing the data in §1.2 is legitimate interest under Art. 6(1)(f) GDPR — specifically, operating push notifications, responding to user-reported issues, and improving the app via aggregate usage analytics. You may object at any time using the deletion paths above.
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated effective date. Continued use of the app after changes constitutes acceptance of the updated policy.
If you have questions or concerns about this privacy policy, contact us at: