Privacy Policy

Last updated: March 2026 · Version 1.0

This policy explains what MILO collects, why, and what we do with it. It's written in plain language because we think you should actually be able to read your privacy policy.

The Short Version

What We Collect

Account Data

• Email address — for authentication, account recovery, and service notifications.
• Password — securely hashed. We cannot read your password and never store it in plain text.
• Display name, bio, avatar — optional. You choose what to share.

Interaction Data

• Search queries — logged with a hashed IP address and truncated user agent. Used to improve search quality.
• Library data — works you save, rate, or track. This is yours and fully visible to you.
• Click and dwell data — anonymous, aggregated signals used to improve ranking. No personally identifiable information is stored.
• Feedback — messages you submit through the feedback form, including optional contact email.

Technical Data

• IP address — used for rate limiting and abuse prevention. IPs in search logs are one-way hashed. Raw IPs in security audit logs are retained for up to 90 days.
• User agent — truncated browser identifier, used for abuse detection.
• Cookies — see the Cookies section below.

How We Use Your Data

We do not use your data for advertising, profiling for third parties, or automated decision-making with legal effects.

Data Retention

You Choose How Much MILO Knows

MILO offers three personalization tiers. You pick what feels right:

Switching tiers takes effect immediately. Moving from Cloud to Local or Anonymous deletes your server-side personalization data.

Cookies

MILO uses a minimal set of cookies:

No third-party tracking cookies. No advertising pixels. We use Plausible Analytics, a privacy-focused, cookie-free analytics tool. Plausible does not use cookies, does not collect personal data, and is fully compliant with GDPR, CCPA, and PECR without requiring consent. All data is aggregated and never tied to individual users.

Third Parties

MILO does not sell, rent, or share your personal data with third parties for their own purposes.

We work with a small number of service providers who process data on our behalf:

• Infrastructure — hosting, database, and caching providers. Your data stays within the service.
• Email delivery — for verification and password reset emails only.
• Analytics — Plausible Analytics (EU-based, cookie-free). No personal data is collected or sent. Plausible data policy.
• Error tracking — Sentry (error reports only, no personal data). Helps us fix bugs quickly.
• Search processing — search queries may be processed by third-party services to generate search vectors. No user identity is sent, only the query text. These providers do not use query data for training.
• Metadata sources — AniList, MangaDex, Kitsu, and MangaUpdates provide work metadata. No user data is sent to these providers.

When you click an affiliate link, you leave MILO. Your interaction with the retailer is governed by their privacy policy. We do not share your personal information with affiliate partners.

Your Rights

Regardless of where you live, you can:

• Access your personal data — see exactly what we store about you.
• Export your data in a portable format.
• Delete your account and all associated data.
• Correct inaccurate personal data.
• Object to processing based on legitimate interest.

EU/EEA Residents (GDPR)

Under the GDPR, you additionally have the right to restrict processing (Article 18), data portability in a machine-readable format (Article 20), and the right to lodge a complaint with your local data protection authority. Where processing is based on consent, you may withdraw it at any time. Legal bases for each processing purpose are listed in the table above.

California Residents (CCPA)

MILO does not sell personal information. We do not and will not sell your data. You have the right to know what we collect, request deletion, and opt out of any future sale. To exercise these rights, email privacy@milocomic.com.

Children

MILO is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you are under 13, please do not create an account. If we learn we have collected data from a child under 13, we will delete it promptly.

Users must be at least 18 to access mature or explicit content.

Data Security

We take the security of your data seriously. Passwords are securely hashed and never stored in plain text. All connections are encrypted in transit. We apply industry-standard measures for authentication, session management, and abuse prevention, and we regularly review our security practices.

No system is perfectly secure. While we work to protect your data, we cannot guarantee absolute security.

Changes to This Policy

If we make material changes, we'll notify you by email at least 30 days before they take effect. We won't bury changes and hope you don't notice.