Privacy Policy
2026-09-28
ShortBox works without an account and never asks for a name, phone number or email address. It does process the following to keep ratings and comments fair and to improve the service.
1. What is processed, why, and for how long
| Data | Purpose | Kept |
|---|---|---|
| Device cookie | One rating per device per title; links a nickname | 1 year (in your browser) |
| Hashed IP address, hashed browser signature | Blocks bursts of ratings, reactions, votes and recovery attempts, and repeat voting after clearing cookies | Until the rating, reaction or vote is deleted |
| Nickname | Shown as the comment author | Until you ask for removal |
| Ratings, comments, timestamps | The service itself | Until you delete them or ask us to |
| Comment likes and dislikes | One per device | Until withdrawn or the comment is deleted |
| “Worth watching past the free episodes?” votes | One per device | Until withdrawn or you ask us to delete it |
| Comment reports (device id, hashed IP and browser signature, reason) | One report per device; deciding when a comment reported from several places is hidden | Until the operator has reviewed it or the comment is deleted |
| Write-limit log (hashed IP and browser signature, kind, time) | Blocks bursts of comments, new nicknames, reports and changed ratings or votes | 2 days |
| Hashed recovery code | Reusing a nickname on another device | Until you ask for removal |
| Recovery attempts (hashed IP) | Rate limiting | 2 days |
| Outbound clicks (hashed browser signature, referrer, which button) | Popularity ranking | Hash and referrer cleared after 40 days; the count remains |
| Searches (the query, language, number of results, the first result, time). Nothing about who searched | Improving search, finding questions it could not answer | 180 days |
| Search feedback (yes / no, the query, the title, hashed IP and browser signature) | Improving search, one answer per person | Answers 180 days, hashes deleted after 2 days |
| Searches and what they found (the query, the title clicked or named at the end of it, the earlier queries in the same tab in the last 15 minutes that found nothing, and how often). Nothing about who searched. The earlier queries stay in browser storage that ends with the tab until a title is found | Showing people who ask the same question what others picked | 180 days after the last record; hashed IP and browser signature, kept apart to stop repeats, 2 days |
| Visit statistics (page, referrer, country and region, device and browser type) | Understanding use, improving performance | Visitor hash discarded within 24 hours; only aggregates that cannot identify anyone are kept |
| Visit journeys (a random number made per tab, which kinds of page and titles were viewed, time on page, buttons pressed, the kind of referrer, country, device type, and the first-visit date and visit count kept in your browser). No IP address, browser signature or cookie, and nothing that links one visit to another. Not recorded when Do Not Track or GPC is on | Understanding how the site is used, improving it | 90 days; daily totals afterwards |
2. IP and browser data are not stored as they arrive
An address is reduced to the network it belongs to — the first three octets for IPv4, a /48 for IPv6 — before anything is stored, then hashed together with the browser signature and a server-side secret. The full address is never written, and the stored value cannot be turned back into one. Visit statistics use no cookies; visitors are told apart by a hash of the request that is discarded within 24 hours.
3. Third parties
Personal information is not provided to third parties, except where the law requires it through due process.
4. Processors and overseas transfer
The processors below are US companies, so this is also an overseas transfer. Data moves over the network as you use the site. Hosting and the database are needed to run the service; visit statistics can be refused with your browser's tracking or script blocking, with no loss of function.
| Processor (country) | Role | Data | Location · retention |
|---|---|---|---|
| Supabase Inc. (US) | Database | Everything in table 1 that is stored on the server | Seoul region · as in table 1 |
| Vercel Inc. (US) | Hosting, visit statistics, performance measurement | IP address and browser details of each request; visit statistics | Server functions in the Seoul region, static files over Vercel's global network · statistics as in table 1 |
5. Destruction
Data past its retention period is deleted automatically every day, and data you ask us to delete is deleted without delay, in a way that cannot be recovered. Nothing is kept on paper.
6. Your rights
You can delete your own ratings and comments on the page itself. For access, correction, deletion or suspension of anything else, contact us below and it will be handled within 10 days. Because there are no accounts, requests are matched to the device cookie or recovery code you contact us with.
7. Cookies
One device cookie stands in for a login. You can block or clear it in your browser settings. Blocking it means you cannot rate or comment; clearing it disconnects your past ratings and nickname, which only the recovery code you were shown once can restore.
8. Security measures
- IP and browser data are stored only as hashes mixed with a secret.
- All traffic is encrypted with HTTPS.
- The database separates public and private data with row-level policies and column grants; identifying data is visible to administrators only.
- Administrator sign-in works only for registered administrator emails.
9. Children
The site does not ask for age and is not aimed at children under 14. If we learn that such a child's information has been processed, it is deleted without delay.
10. Person responsible
Privacy officer: the operator of ShortBox. Send questions, complaints and requests for remedy to the address below.
11. Remedies (Korea)
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
12. Changes
This policy applies from 18 September 2026. Changes will be posted on this page with their date. 23 September 2026: added searches and search feedback. 27 September 2026: added the “worth watching past the free episodes?” vote and visit journeys. 28 September 2026: added searches and what they found.