Privacy Policy
2026-09-19
ShortBox works without an account and never asks for a name, phone number or email address. It does process the following to keep ratings and comments fair and to improve the service.
1. What is processed, why, and for how long
| Data | Purpose | Kept |
|---|---|---|
| Device cookie | One rating per device per title; links a nickname | 1 year (in your browser) |
| Hashed IP address, hashed browser signature | Blocks bursts of ratings, reactions and recovery attempts, and repeat voting after clearing cookies | Until the rating or reaction is deleted |
| Nickname | Shown as the comment author | Until you ask for removal |
| Ratings, comments, timestamps | The service itself | Until you delete them or ask us to |
| Comment likes and dislikes | One per device | Until withdrawn or the comment is deleted |
| Hashed recovery code | Reusing a nickname on another device | Until you ask for removal |
| Recovery attempts (hashed IP) | Rate limiting | 2 days |
| Outbound clicks (hashed browser signature, referrer) | Popularity ranking | Hash and referrer cleared after 40 days; the count remains |
| Visit statistics (page, referrer, country and region, device and browser type) | Understanding use, improving performance | Visitor hash discarded within 24 hours; only aggregates that cannot identify anyone are kept |
2. IP and browser data are not stored as they arrive
They are hashed with a server-side secret before being written, and the stored value cannot be turned back into an address. Visit statistics use no cookies; visitors are told apart by a hash of the request that is discarded within 24 hours.
3. Third parties
Personal information is not provided to third parties, except where the law requires it through due process.
4. Processors and overseas transfer
The processors below are US companies, so this is also an overseas transfer. Data moves over the network as you use the site. Hosting and the database are needed to run the service; visit statistics can be refused with your browser's tracking or script blocking, with no loss of function.
| Processor (country) | Role | Data | Location · retention |
|---|---|---|---|
| Supabase Inc. (US) | Database | Everything in table 1 that is stored on the server | Seoul region · as in table 1 |
| Vercel Inc. (US) | Hosting, visit statistics, performance measurement | IP address and browser details of each request; visit statistics | Server functions in the Seoul region, static files over Vercel's global network · statistics as in table 1 |
5. Destruction
Data past its retention period is deleted automatically every day, and data you ask us to delete is deleted without delay, in a way that cannot be recovered. Nothing is kept on paper.
6. Your rights
You can delete your own ratings and comments on the page itself. For access, correction, deletion or suspension of anything else, contact us below and it will be handled within 10 days. Because there are no accounts, requests are matched to the device cookie or recovery code you contact us with.
7. Cookies
One device cookie stands in for a login. You can block or clear it in your browser settings. Blocking it means you cannot rate or comment; clearing it disconnects your past ratings and nickname, which only the recovery code you were shown once can restore.
8. Security measures
- IP and browser data are stored only as hashes mixed with a secret.
- All traffic is encrypted with HTTPS.
- The database separates public and private data with row-level policies and column grants; identifying data is visible to administrators only.
- Administrator sign-in works only for registered administrator emails.
9. Children
The site does not ask for age and is not aimed at children under 14. If we learn that such a child's information has been processed, it is deleted without delay.
10. Person responsible
Privacy officer: the operator of ShortBox. Send questions, complaints and requests for remedy to the address below.
11. Remedies (Korea)
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
12. Changes
This policy applies from 18 September 2026. Changes will be posted on this page with their date.