1. Who we are
Ota is a social app for anime fans. This policy explains what we collect, why, and what you can do about it. It covers the Ota mobile app and socialota.com.
The data controller is Emilia Vasileva, based in Bulgaria. You can reach us at ota@socialota.com about anything in this policy.
2. What we collect
Account information
- Your email address and password. Passwords are handled by Firebase Authentication and stored hashed — we never see or store your actual password.
- Your username, bio, profile picture, cover photo and favourite anime genres.
- Whether your account is public or private, and when it was created.
Things you create
- Posts, photos, videos and stories you upload.
- Comments and likes.
- Quizzes you make and your results on quizzes you play.
Your connections
- Who you follow and who follows you, and any pending follow requests.
- Accounts you have blocked.
- Reports you submit about other people's content. These are not anonymous to us — we record who filed them — but they are never shown to the person being reported.
Messages and calls
- Direct messages you send, so they can be delivered and shown in your chats. They are stored on our servers and are not end-to-end encrypted.
- For voice and video calls we keep a record that a call happened — who took part, when, and how long it lasted. We do not record or store call audio or video.
Technical and safety data
- A push notification token for your device, so we can notify you about follows, likes, comments and calls.
- If an upload is rejected by our automated scanning, we record your user ID, the file location and the scores that caused it. This lets us spot people who repeatedly try to post banned material.
We do not use advertising trackers, and we do not have analytics SDKs in the app.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and showing you the app | Performance of a contract |
| Delivering messages, calls and notifications | Performance of a contract |
| Moderating content, handling reports, preventing abuse | Legitimate interests — keeping people safe |
| Sending account emails such as verification | Performance of a contract |
| Push notifications | Your consent, which you can withdraw in your device settings |
4. Automated content scanning
When you upload a photo or video to a post, a story, your profile picture or your cover photo, it is checked automatically before it is published.
- Photos are sent to Google Cloud Vision, which returns likelihood scores for adult, violent and suggestive content.
- For videos, still frames are sampled from the file and those frames are checked the same way.
- If the check fails, the upload is deleted immediately and the post is never created.
This is fully automated — no person looks at your uploads as part of it. A human only reviews content if somebody reports it. If you believe something of yours was rejected wrongly, email ota@socialota.com and we will look at it.
5. Who we share data with
We do not sell your data and we never share it with advertisers. We use these providers to run the service:
| Provider | What it handles |
|---|---|
| Google Firebase | Sign-in, database, file storage, server functions and push notifications |
| Google Cloud Vision | Automated scanning of uploaded images and video frames |
| Google Gemini | Only when you use AI quiz creation — your quiz topic and settings are sent to generate questions |
| Agora | Carrying voice and video calls between participants |
| Resend | Delivering account emails such as address verification |
We may also disclose data if we are legally required to, or where it is necessary to protect someone's safety.
6. Where your data is stored
Your account data, posts and messages are stored in Google Firebase data centres in the European Union. Some processing — including our server functions and the automated image scanning — runs in the United States, so your data may be transferred there. These transfers rely on the standard contractual clauses Google applies to its cloud services.
7. How long we keep it
- Your account data and content are kept until you delete them or delete your account.
- Deleting your account removes your profile, posts, comments and stories. You can do this yourself in Settings → Delete Account.
- Messages you sent may remain visible to the person you sent them to.
- Reports and automated moderation records are kept longer, so that repeat behaviour stays visible even if an account is deleted and recreated.
8. Your rights
If you are in the UK or the European Economic Area you have the right to:
- Ask what personal data we hold about you, and get a copy of it.
- Correct anything inaccurate — most of it you can edit yourself in the app.
- Delete your data, which you can do at any time from Settings.
- Ask us to restrict or stop certain processing.
- Receive your data in a portable format.
- Withdraw consent where we relied on it.
- Complain to your national data protection authority. In Bulgaria this is the Commission for Personal Data Protection (cpdp.bg).
To exercise any of these, email ota@socialota.com. We aim to respond within 30 days.
9. Children
Ota is not for children under 13, and you must confirm you are 13 or older when you sign up. Some countries require a higher age for consent to data processing — up to 16 — and where that applies you must meet the higher age.
We do not knowingly collect data from children under 13. If you believe a child has created an account, email ota@socialota.com and we will remove it.
10. Security
Traffic between the app and our servers is encrypted. Access to stored data is restricted by security rules that stop one account reading another's private content. No service can promise perfect security, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.
11. Changes
If we change this policy we will update the date at the top, and tell you in the app when the change is significant.
12. Contact
Questions, requests or complaints: ota@socialota.com.