سياسة الخصوصية

RuneManga ("we", "us") is a RuneTranslate product operated from Türkiye, and decides how the data described here is used. This policy is the same for everyone, wherever you live: you get the protections and rights below whether or not a local law requires them, and where your local law gives you more, it applies too. Privacy questions, requests about your data and account deletion: [email protected].

• We do not sell, rent or share your data with advertisers or data brokers.
• We do not use your pages to train models.
• We do not run ad networks or tracking pixels. The website's only analytics is Google Analytics, without its advertising features, and you can turn it off at any time.
• We do not send your images to the translation provider: only the text found on them.
• We do not ask for a password, and we never see your card: payments are processed by Whop.

Pages you translate

• The page images you add on the website, or the pages the browser extension sends for you, and the options you pick: mode, source language and target language.
• The finished pages we produce for you.
• Both are deleted automatically about an hour after the job finishes. Download what you need before then.
• The IP address a job came from, kept with the job to limit how many jobs one person can run at once, and deleted with it.
• What you change on a page in the WebApp's Edit mode (text boxes, brush strokes and pictures you add) stays in your browser and is never sent to us. The Cookie Policy says where it is kept and for how long.

Account data

• Your email address, which identifies the account. The WebApp needs an account; the browser extension works without one.
• From Google, if you sign in with Google: your Google account id, your email address and whether Google has verified it, your name and your profile picture link. We do not keep any Google token after the sign-in.
• From Discord, if you sign in with Discord or connect it on your account page: your Discord user id, your username and display name, your avatar and your email address with whether Discord has verified it. We use them to sign you in (only a verified email can open or join an account) and so that our Discord server's bot can show your plan and credits when you ask it (/account). We do not keep any Discord token after the sign-in.
• Sign-in links, if you sign in by email: the address, a hash of the one-time link (never the link itself), when it was asked for and used, and the IP address that asked. They are deleted after a day.
• Your subscription, from Whop's notifications: its membership id and your Whop user id, the plan, its status, renewal and end dates, and whether it was made in test mode; the credit packs you bought (payment id and credits); and any refund or dispute of those payments. Whop has your billing details; we never see your card. We keep a short record of each notification (event, result), not its content.
• A purchase made on Whop's own store page, or with a different email address than your RuneManga account's: we find your account by the email address of your Whop account. If no RuneManga account has that address yet, we keep the purchase (what was bought, its Whop ids and that address) until an account with that address signs in, then it is added to that account.
• Your credits: the plan and purchased balances and their history (credits granted, expired, bought, spent, refunded or changed by our staff, with the time and a short note).
• Your sessions: one record per signed-in browser and per connected browser extension, with the IP address and browser (user agent) it came from, when it was created and last seen, and for an extension the install id it generated for itself.
• Where your account was made: the browser id cookie (rm_browser) and the network of the IP address (its first three numbers, for example 85.105.12.0/24), kept with the account so the free credits for new accounts are given only a few times a day per browser or network. They are deleted with the account.
• Gift codes you redeemed, the plan they unlocked, and any plan or credits our staff set for your account.
• Your activity: how many pages you translated per day while signed in, split by mode and by where (the browser extension or the WebApp). Only these counts are kept, no pages, images, page addresses or file names, and they are shown to you on the Account page.

The browser extension

• The extension works only on sites you switch it on for. There it reads the manga images on the page, fetches them the way the page itself would, and sends those images to our translation service. It does not send the page address, the image's file name, your browsing history or the site's cookies.
• A random install id, created on first use, identifies the install: it ties a sign-in and the page counter or credits to it, and lets us ban an install that abuses the service.
• The page counter: after each job the extension reports how many pages it translated, with its install id. Signed in, those pages are taken from your account's credits; signed out, we keep one number per calendar month per install.
• When you connect the extension to your account, the website issues it a signed token (valid 7 days) that carries your plan.

Problem reports

• From the Support page (signed in): your report, its type and area, the images you attach (up to 3, 4 MB each), and the whole thread of messages between you and us, linked to your account.
• From "Report a problem" in the extension, signed in or not: your message, its type and the part of the extension it is about, the extension version and browser, the install id, a reply-to email address if you type one (we do not verify it), and images if you attach them or capture the tab (up to 3: 4 MB each when the extension is signed in; when it is not, 1.5 MB each, and none if they would take all reports without a sign-in past 100 images or 150 MB in 24 hours; the report itself is always kept). Unless you untick "Include diagnostics", it also sends the host name of the site you were on (for example reader.example.com, never the full address), your browser version and operating system, and the extension's last warning and error lines with every web address cut down to its host. A signed-in extension links the report to your account.

Analytics on the website

• The website runs Google Analytics unless you turn it off. In the EU and EEA, the UK, Switzerland and Türkiye, and wherever we cannot tell your country, it runs only after you press Accept in the cookie notice; everywhere else it runs from your first page, and the cookie notice says so. It records the pages you open on runemanga.com (the address without anything after a ? or #), the page title, the page that sent you there, scrolling to the bottom of a page, clicks on links that leave the site, file downloads and that a form was started or sent (never what you typed), your browser, device, screen size and language, and your rough location (country and city), which Google works out from your IP address without keeping the address. It ties these to a random id kept in its cookies (listed in the Cookie Policy).
• It never receives your pages, their images or text, your account, your email address or your plan. Nothing is sent once you decline, before you accept where a yes is needed first, or from the Control Room, Support and sign-in pages. To know which rule applies, the website asks our server for the country Cloudflare sees for your connection; it is not stored. The browser extension has no analytics.
• Cookie settings at the bottom of every page turns it on or off at any time: Decline stops it and deletes the Google Analytics cookies.

Where visits come from

• Our own server also counts visits by where they came from, without Google: when a tab opens its first page on runemanga.com, the website sends us the address of the page that sent you there (if your browser shares it), the campaign tags of the link (utm_source, utm_medium, utm_campaign) or an invite code, and the page you landed on. We keep only a count per day of the kind of source (for example a search engine, an AI assistant, a social site, or "direct"), the name of a referring website, the campaign tag and the kind of landing page. No address with its query, no IP address, no id and nothing about you is stored with these counts, and they are not sent to anyone.
• With the same answer as Google Analytics (above), the source of your first visit is also kept in the rm_src cookie for 30 days. If you create an account, that source (for example "google, search") is saved on the account once, so we can see which sources bring people who sign up, connect the extension and buy. If you sign in from the browser extension without it, the account is marked as found through the extension.

Google's quick sign-in on the website

• While you are signed out, the website can show Google's quick sign-in prompt ("Sign in as …", Google One Tap) on its pages, but not on the Account, Translate, Support, Control Room or extension pages. It follows the same answer as analytics: in the EU and EEA, the UK, Switzerland and Türkiye, and wherever we cannot tell your country, it shows only after you press Accept in the cookie notice; everywhere else it shows from your first page, and the cookie notice says so.
• To show it, your browser loads Google's sign-in script from accounts.google.com, so Google receives your IP address, your browser details and the address of the page, and can see whether you are signed in to Google in this browser; Google's privacy policy applies to that. We receive nothing from it unless you choose an account in the prompt: then Google sends us the same details as "Continue with Google" (listed above), we check them against Google's signature and sign you in. If you signed in here with Google before and this browser has one Google account signed in, Google may sign you in by itself, without a tap, and shows "Signing in as …" while it does. Signing out turns that off in this browser until you next sign in by choosing your account.
• Cookie settings at the bottom of every page turns it off together with analytics: Decline closes the prompt, deletes Google's g_state cookie, and from the next page the script no longer loads.

Records we keep to run and protect the service

• Server logs: time, request size, errors and the IP address a request came from. They do not contain your images.
• An audit log of sign-ins, failed sign-in attempts, sign-outs, account changes (gift codes, extensions connected or disconnected, checkouts started, deletion), problem reports and our staff's actions in the Control Room (our internal admin area), with the IP address and email address involved.
• The list of banned extension installs, with the reason.

A page goes through our own software: it finds the text, reads it, erases the original lettering, fills in the background and writes the translation back. Colorizing pages is planned and not available yet. This runs on our servers and on GPU machines we operate.

Only the text found on a page is translated, never the image. On every plan it is translated by RuneLingua, our own translation engine, on the same GPU machines that process the page (see RunPod below), so it does not leave our processing. For the few target languages RuneLingua does not cover yet, and for a page translated while it is unavailable, the text is sent from your own browser (the extension, or the WebApp's page) to Google's translation service instead: our server hands the text to your browser, your browser asks Google for the translation and sends the result back to our server, which letters it onto the page. Google then receives that text and your IP address, as with any request your browser makes, but never your images, your account or which site you read. If you connect your own AI key in the extension, the text goes from your browser to that provider under its terms. Your browser keeps recent translations in memory so the same line is not sent twice; they are gone when it closes.

Each service below receives only what it needs for its part:

• Our hosting provider, with servers in France (EU): hosts our website, our Postgres database and the translation service, so everything we store on our side, including logs, is stored there.
• Cloudflare: carries the traffic of runemanga.com in front of our servers, so it sees your IP address and the requests you make, and tells our server the country of a connection.
• RunPod: runs the GPU step that reads and cleans your page images and translates the text found on them (RuneLingua). It receives the images of a job and that text only, never your account details, and they are deleted after the job; its machines may be outside the EU.
• Google: sign-in, if you choose "Continue with Google". You go to Google directly, and Google's privacy policy applies to anything that happens there; Google tells us your account id, email address, name and profile picture. Also Google's quick sign-in prompt on our pages while you are signed out, unless you decline it (in the EU and EEA, the UK, Switzerland and Türkiye, only after you accept it): Google's script receives your IP address, browser details and the page address, and Google tells us your account details only if you choose an account in it.
• Discord: sign-in, if you choose "Continue with Discord" or connect Discord on your account page, and our Discord server's bot (support tickets, /account). You go to Discord directly, and Discord's privacy policy applies there; Discord tells us your user id, username, avatar and verified email address.
• Our email provider: sends the sign-in emails and the thank-you email after a purchase (what you bought, no payment details), so it receives your email address and the message.
• Whop (whop.com): processes the payments for plans and credit packs and sends the receipts. The checkout and the billing page where you manage or cancel a subscription are Whop's own pages: Whop receives there what it needs to process the payment, such as your name, email address, payment details, country and IP address, under its own privacy policy (https://whop.com/privacy). We send it only our account id for you and the language of the page you bought from, so the purchase reaches your account and our thank-you email is in your language; it sends us the subscription and payment details listed above, and the email address of your Whop account, so a purchase reaches your RuneManga account. Your card details never reach RuneManga.
• Google's translation service: the text found on your pages, for the few languages RuneLingua does not cover and when it is unavailable, as described above.
• Google Analytics, unless you decline it (in the EU and EEA, the UK, Switzerland and Türkiye, only after you accept it): the visit data described above. Google processes it for us to count visits and pages; its advertising features are off (no advertising storage, ad user data or ad personalization), so it is not used to show you ads.
• Google Fonts: when a page you edited in the WebApp has Japanese, Chinese or Korean text in a text box, your browser loads that lettering font, to show it in Edit mode or to draw it into a download, the ZIP or the history card, from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Google sees your IP address and browser, as with any request, but not the text or the page, and the requests carry no cookies. The other lettering fonts come from runemanga.com.
• Your own AI provider, if you choose Use your own AI key in the WebApp's settings: the text found on your pages goes from your browser straight to the provider you chose (such as OpenRouter, Google Gemini, OpenAI, Anthropic, DeepSeek, xAI or a server you name), under its terms and billed to you. Your key stays in your browser and is sent only to that provider, never to us.
• No one else. We may disclose data if the law requires it, or to protect the service and its users from abuse.

Problem reports are seen only by RuneManga staff, in the Control Room. No email is sent automatically; if you gave an address, we may answer you there by hand.

The website sets only strictly necessary cookies: rm_session keeps you signed in (14 days, set only when you sign in), rm_browser is a random id for this browser that limits how often new accounts get free credits (2 years, set when you first sign in), rm_oauth_nonce protects a Google or Discord sign-in while it is in progress (10 minutes), rm_onetap_nonce does the same for Google's quick sign-in while its prompt is offered (10 minutes), rm_lang remembers the language you picked in the menu (1 year, set only when you pick one), and rm_ref remembers the invite link you opened (30 days, set only when you open one). With the same answer as Google Analytics, rm_src remembers where your first visit came from (30 days, no id). When Google Analytics runs (see above), it also sets two cookies (_ga and _ga_2HL2YZJP9Q, 13 months); if you decline it sets none, and where a yes is needed first it sets none before you accept. Google's quick sign-in script follows the same answer and may set its own g_state cookie. There are no advertising cookies. The Cookie Policy lists every cookie and every other thing the website keeps in your browser, including your translation history on the Translate page and the edits you make in its Edit mode.

The extension keeps its settings in your browser's extension storage: the API address and an API key field (empty unless you enter one), mode and languages, the lettering font, its theme, the sites you switched it on for and the image addresses you approved there, where you left its on-page controls on each site (so this also amounts to a list of the sites you used it on), its install id, your sign-in (name, plan, token and when it expires) and your latest page count. It also keeps the language, mode and font lists it read from our translation service, and, after the service said it is busy or refused new pages, the time until which it waits before starting new ones. While the browser is open it also keeps the last 20 warning lines and a tab capture you are about to attach to a report. It also keeps its display choices (which popup tab was open, the corner for the on-page button, the smallest image to translate, your translation options) and whether you allowed it on every site. Its History keeps your last translated pages in your browser only: the translated image, the original, a small preview, the site name (never the page address), the languages, the settings used and the time, up to 500 pages or 200 MB. Nothing in History is uploaded, nothing is kept from private windows, and it deletes itself after 1 week unless you choose 1 day, 1 month or never; you can clear it or turn it off in the extension. If you turn on auto-save, finished pages are also saved into the Downloads folder you name. Removing the extension deletes all of it, except files it already saved to your Downloads.

• Your data is stored on our hosting provider's servers in France (EU).
• Uploaded pages and results: deleted about an hour after the job finishes, and whenever the translation service restarts.
• Web sessions last 14 days and at most five are kept per account; extension tokens are valid for 7 days. Signing out ends that session.
• Your account (with the source of the visit it was created from), subscription records, credits and their history, connected extensions, gift code redemptions and daily activity counts: kept until you delete your account, then removed at once. Whop keeps its own payment records under the law that applies to it.
• Sign-in links: deleted a day after they were asked for, used or not.
• Whop purchases waiting for an account: kept with the buyer's email address until an account with that address signs in; from then on they are part of that account and are removed with it. To have one that was never claimed deleted, write to [email protected].
• Images attached to problem reports: deleted automatically about 90 days after they were added. Reports and their threads are kept for now; we plan to delete them 12 months after the last message, and this page will say so once that happens automatically.
• Page counters: one number per month, per install or account.
• Analytics: Google Analytics keeps the visit data for 2 months. Its cookies last 13 months in your browser, and taking your answer back deletes them. Our own visit counts by source hold nothing about a person and are deleted after 400 days; the source saved on an account is deleted with the account.
• Server logs: kept only as long as we need them for troubleshooting and abuse prevention.
• The audit log and the record of payment notifications are kept to protect the service against abuse. After you delete your account they keep your email address but are no longer linked to an account. Reports you filed are kept so we can finish handling them, without the link to your account.

Our servers are in the EU. Some processing happens elsewhere: Google, Whop and our email provider may process data in the United States (Google receives the text found on some pages, from your own browser, never the images, the visit data of Google Analytics unless you decline it, and your IP address and browser details while its quick sign-in prompt is offered), and our GPU machines (RunPod) may be outside the EU. Wherever data leaves the EU, we rely on the safeguards these providers offer for international transfers, such as the EU Standard Contractual Clauses.

We use your data only for these reasons, wherever you live. They are also our legal bases where laws such as the GDPR, the UK GDPR, Türkiye's KVKK or Brazil's LGPD ask for one:

• to provide what you asked for: translating your pages, your account, your plan and answering your reports (performing our agreement with you);
• to keep the service secure and fair: logs, the audit log, rate limits and bans (our legitimate interest in protecting the service and its users);
• to fix problems: the diagnostics you choose to include in a report (our legitimate interest, and you can untick them);
• to see how the website is used (Google Analytics): your consent in the EU and EEA, the UK, Switzerland and Türkiye, and elsewhere our legitimate interest in improving the website; either way you can turn it off at any time with Cookie settings at the bottom of every page;
• to count visits by where they came from (our own counts, which hold nothing about a person): our legitimate interest in knowing which sources bring visitors; and to remember the source of your first visit for your account (the rm_src cookie): the same as Google Analytics, your consent in the EU and EEA, the UK, Switzerland and Türkiye, and elsewhere our legitimate interest, which Cookie settings turns off;
• to offer Google's quick sign-in on our pages while you are signed out: your consent in the EU and EEA, the UK, Switzerland and Türkiye, and elsewhere our legitimate interest in making sign-in easy; Cookie settings at the bottom of every page turns it off with analytics;
• where the law requires us to keep or disclose data (legal obligation).

• Sign out at any time from the Account page. Signing out ends that session.
• Delete your account on the Account page, under Delete account. Your profile, subscription records, credits, sessions, connected extensions, gift code redemptions and daily activity counts are removed at once. Deleting your RuneManga account does not cancel a running subscription: cancel it under Manage subscription first.
• Ask for a copy of your data, a correction, a deletion of something else (for example a report), or object to how we use it: email [email protected] from the address tied to your account. We answer within 30 days.
• Cancel your subscription at any time under Manage subscription on the Account page (it opens Whop's billing page for your subscription).
• Accept or decline analytics and Google's quick sign-in prompt, and change your answer at any time, with Cookie settings at the bottom of every page.
• We never sell or share your personal information for advertising, so there is nothing to opt out of (as the California CCPA/CPRA would require), and we treat every request the same way, whatever country you write from.
• If you think we handle your data unlawfully, you can complain to the data protection authority where you live.

• Session cookies are random, and our database stores only their hashes.
• Sign-in links are stored only as hashes, work once and expire after 15 minutes; Google sign-ins are checked against Google's signature.
• Connections to runemanga.com are encrypted (HTTPS).
• Only RuneManga staff can open the Control Room, and every change they make there is recorded in the audit log.

You must be at least 13 and old enough to agree to our Terms where you live, or have a parent's or guardian's permission. Paid plans need you to be 18 or have that permission. We don't knowingly collect data from anyone under 13. If you believe we have, email us and we'll delete it.

When we make a material change to this policy, for example how pages are handled or which services receive data, we update the "Last updated" date at the top of this page before the change applies.

Privacy questions, data requests, or anything else: [email protected].