Privacy Policy

Last Updated: November 14, 2025

NURUPO Studio ("we," "us," or "our") operates Kemono Games, a furry-themed game discovery platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

By using Kemono Games, you consent to the data practices described in this policy. If you do not agree with this Privacy Policy, please do not access or use our services.

1. Information We Collect

1.1 Information You Provide

When you create an account or use our services, we may collect:

Account Information: Email address, phone number (for SMS verification), username, profile picture
Authentication Data: Firebase authentication credentials, OAuth provider information (Google, etc.)
User-Generated Content: Comments, ratings, game favorites, votes on comments
User Preferences: Display settings (blur sensitive content, video quality preferences, dark mode, language preference)

1.2 Automatically Collected Information

When you access our services, we automatically collect:

Usage Data: Pages visited, games viewed, search queries, interaction patterns
Device Information: IP address, browser type, operating system, device identifiers
Cookies and Similar Technologies: Session cookies, preference cookies, analytics cookies (detailed in Section 4)
Log Data: Access times, error logs, referring URLs

1.3 Information from Third Parties

OAuth Providers: When you authenticate via Google or other OAuth providers, we receive your email, name, and profile picture
Analytics Services: Aggregate data from Google Analytics and Umami Analytics

2. How We Use Your Information

We use the collected information for the following purposes:

Service Provision: Create and manage your account, display personalized content, save your preferences
Authentication and Security: Verify your identity, prevent fraud, detect and prevent abuse
Communication: Send service-related notifications, respond to your inquiries
Analytics and Improvement: Analyze usage patterns, improve our services, develop new features
Compliance: Comply with legal obligations, enforce our Terms of Service
Anti-Spam Protection: Use reCAPTCHA to prevent automated abuse

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

3.1 Service Providers

Firebase (Google): Authentication services, user management
Alibaba Cloud: CDN services (global distribution), Object Storage Service (OSS) in Shenzhen for non-personal static assets (public game images, videos), OSS in Singapore for media storage, OSS in Japan for encrypted database backups, and SMS services exclusively for verifying phone numbers with the +86 country code. No other personal data is processed through these services
Self-hosted Infrastructure (Japan): Our primary application servers and databases are hosted in our own data centers in Japan
Self-hosted Sentry (Japan): Error tracking, performance monitoring, and session replay for debugging purposes. Session Replay may capture rendered page content and user interactions. Sensitive fields (such as passwords or payment information) are automatically masked and never recorded. Only authorized personnel can access Sentry logs and session replay data for debugging purposes. All data stored in Japan

3.2 Analytics Partners

Google Analytics: Website traffic analysis, user behavior tracking
Self-hosted Umami Analytics (Japan): Privacy-friendly analytics, data stored in Japan

3.3 Security and Anti-Fraud

Google reCAPTCHA: Bot detection and spam prevention. Google reCAPTCHA may collect device and behavioral data such as IP address, browser characteristics, and user interaction patterns to distinguish humans from bots. Data collected by Google reCAPTCHA is processed and stored by Google according to their Privacy Policy and Terms of Service

3.4 Legal Requirements

We may disclose your information when required by law or to:

Comply with legal processes, court orders, or government requests
Enforce our Terms of Service
Protect the rights, property, or safety of Kemono Games, our users, or the public
Prevent illegal activities or security threats

3.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you via email or prominent notice on our website before your information becomes subject to a different privacy policy.

4. Cookies, Local Storage and Tracking Technologies

We use cookies and browser storage to enhance your experience and provide essential functionality.

4.1 Cookies We Use

Necessary Cookies (Always Active)

These cookies are essential for the website to function and cannot be disabled:

locale: Stores your language preference (en, zh-Hans, zh-Hant, ja)
gdpr_consent: Stores your cookie consent choices (expires after 365 days)
chakra-ui-color-mode: Stores your UI theme preference (dark/light mode)
Google reCAPTCHA: Anti-bot protection cookies set by Google. These cookies collect device and behavioral data such as IP address, browser characteristics, and user interaction patterns to distinguish humans from bots. Data collected by Google reCAPTCHA is processed and stored by Google according to their Privacy Policy and Terms of Service

Analytics Cookies (Your Choice)

You can enable or disable these cookies in Settings > Cookie Settings:

Google Analytics (_ga, _gid): Tracks website usage and performance to help us improve our services

4.2 Browser Local Storage

We use your browser's local storage (not cookies) to save:

credential-v2: Authentication refresh token for keeping you logged in
user_settings: Display preferences for non-logged-in users (blur sensitive content, video quality, etc.)

4.3 Self-Hosted Analytics

Umami Analytics: We use self-hosted privacy-friendly analytics without personal identifiers. Data is stored in our own servers in Japan. This analytics service is always active and is not controlled by your cookie preferences, as it does not use cookies and does not collect any personally identifiable information.

4.4 Your Choices

Managing Cookie Preferences

Visit Settings > Cookie Settings to enable or disable Google Analytics cookies
Your preferences are saved in the gdpr_consent cookie and will be remembered for 365 days
Umami Analytics operates independently of cookie preferences as it is privacy-friendly and does not track individuals

Browser Settings

You can also control cookies through your browser settings. However, disabling necessary cookies may prevent the website from functioning properly. Most browsers allow you to:

Block all cookies
Delete existing cookies
Set preferences for specific websites

Please refer to your browser's help documentation for instructions.

5. Your Rights and Choices

Depending on your location, you may have the following rights:

5.1 GDPR Rights (European Union Users)

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure: Request deletion of your account and personal data
Right to Data Portability: Receive your data in a machine-readable format
Right to Object: Object to processing of your personal data
Right to Restrict Processing: Request limitation of data processing
Right to Withdraw Consent: Withdraw consent for data processing at any time

5.2 CCPA Rights (California Users)

Right to Know: Know what personal information we collect, use, and share
Right to Delete: Request deletion of your personal information
Right to Opt-Out: Opt-out of the sale of personal information (we do not sell personal information)
Right to Non-Discrimination: Not be discriminated against for exercising your rights

5.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

You can also delete your account directly through the settings page, which will immediately remove all your personal information from our systems (comments may be anonymized and retained).

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

Encryption: All data transmission uses HTTPS/TLS encryption
Authentication: JWT-based authentication with refresh token mechanism
Access Control: Role-based access control for administrative functions
Monitoring: Sentry monitoring for security incidents and errors
Infrastructure Security: Secure cloud infrastructure with regular security updates

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services:

Account Data: Retained while your account is active
After Account Deletion: Personal information is immediately deleted from active databases. Comments may be anonymized and retained for community continuity. Encrypted backup copies may persist for up to 30 days before being automatically purged
Legal Requirements: Some data may be retained longer if required by law
Analytics Data: Aggregated analytics data may be retained indefinitely as it cannot identify individuals

8. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will delete such information promptly.

In compliance with the Children's Online Privacy Protection Act (COPPA), we require users to be at least 13 years old to create an account. By creating an account, you represent that you meet this age requirement.

If you are between 13 and 18 years of age (or the age of majority in your jurisdiction), you confirm that you have obtained permission from your parent or legal guardian to use our Services and that they have read and agreed to this Privacy Policy on your behalf. We may request verification of parental consent at our discretion.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country:

Japan (Primary): Our own data centers host application servers and databases. Self-hosted Sentry and Umami Analytics services. Alibaba Cloud OSS for encrypted database backups
Singapore: Alibaba Cloud OSS for media storage (images and videos)
United States: Firebase (Google) for authentication and Google Analytics for website analytics
Mainland China (Shenzhen): Alibaba Cloud OSS for non-personal static assets only (public game images, videos) for CDN purposes
Global: Alibaba Cloud CDN services may cache content in various locations globally for performance optimization

Except for non-personal static assets stored in the Alibaba Cloud OSS Shenzhen region solely for content delivery purposes, Kemono Games does not store, process, or transfer any user personal data to Mainland China. All user personal data and application databases remain strictly within our own data centers in Japan. Media files are stored in Singapore, and authentication services operate in the United States.

For EU users, we ensure adequate safeguards are in place for international transfers, including:

Standard Contractual Clauses (SCCs) with service providers
Adequacy decisions by the European Commission where applicable
Additional safeguards as required by GDPR

10. Third-Party Links

Our services may contain links to third-party websites, games, or services that are not operated by us. This Privacy Policy does not apply to third-party sites. We recommend reviewing the privacy policies of any third-party sites you visit.

We are not responsible for the privacy practices or content of third-party websites.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:

Posting the new Privacy Policy on this page
Updating the "Last Updated" date at the top of this policy
Sending a notification email to registered users at least 30 days before the changes take effect (for material changes that affect your rights)
Displaying a prominent notice on our website

Material changes include modifications to data collection practices, data sharing with third parties, user rights, or data retention policies. For non-material changes (such as clarifications or formatting updates), we will update the "Last Updated" date without advance notice.

Your continued use of our services after the effective date of changes indicates your acceptance of the updated Privacy Policy. If you do not agree to the changes, you must stop using our Services and may delete your account.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Japan, without regard to its conflict of law principles. Any disputes arising from this Privacy Policy will be subject to the exclusive jurisdiction of the courts of Japan.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

NURUPO Studio

Email: [email protected]

Website: https://kemono.games

For GDPR-related inquiries, please include "GDPR Request" in your email subject line. For CCPA-related inquiries, please include "CCPA Request" in your email subject line.