Novellia

Privacy Policy

Last updated: 30 September 2026.

Novellia ("we", "us", "the site") is the English-language recap guide published at https://www.novelliaapp.com. This policy explains what personal data the public site handles, why we handle it, who else can see it, how long we keep it, and how to ask us to change or delete it.

There are no accounts, no comment boxes, no uploads and no checkout on this site. Almost every page is readable without giving us anything, and the little data we do keep about visitors is stored hashed and in aggregate.

Information we collect

Pages you read

We do not ask you to identify yourself in order to read a recap. Nothing you type into the site is stored except the search terms you submit, which are used to produce results and can appear in ordinary server logs as part of the request URL.

Content-ranking signals

To decide which dramas are trending we record one "qualified view" per drama per calendar day. For each recorded view we store the drama and the date, a truncated SHA-256 hash (first 32 characters) of the request IP address taken from our proxy header, and, for visits that reach us from a search engine, which engine it was — stored only as a short label such as Baidu or Google, never the words you searched for and never the full address of the referring page. The plain IP address is never written to our database.

First-party visitor token

When a request reaches the application without a usable IP header, the drama page generates a random 128-bit identifier, keeps it in your browser's local storage under the key dr_vid, and sends it with the view event so the same browser is not counted twice in a day. That token is hashed the same way an IP address is before it is stored. It is not used for advertising, is not passed to anyone else, and disappears when you clear site data for this domain.

Affiliate click counters

If you press a "watch on DramaBox" button we store a counter for that drama and that day, so we can see which recaps actually lead to watching. The counter holds no visitor identifier, no IP address, no referrer and no destination parameters.

Server and security logs

Our hosting provider, reverse proxy and CDN record standard request metadata for the traffic they carry: IP address, user agent, timestamp, requested path, status code and bytes transferred. That is how errors, abuse and attacks get investigated. We do not control how long each provider keeps those logs.

Email you send us

If you write to [email protected] we receive your email address, your message and any attachments. We keep that correspondence only as long as needed to reply, to resolve a report, or to record how a rights request was handled.

Administration area

The private dashboard sets one cookie named dr_admin_session. It is HttpOnly, SameSite=Strict, expires after 12 hours, and is flagged Secure when the site is served over HTTPS. It exists only to keep an authorised operator signed in; visitors of the public pages never receive it.

Cookies and local storage

A standalone Cookie Policy at /cookies repeats this list for readers who want it in one place.

Who else sees data

Lawful bases

Where the GDPR or UK GDPR applies, our basis for the data above is legitimate interest: operating, securing and measuring a public editorial site, and understanding which recaps readers reach. The counters are hashed and used only for ranking, which we regard as a light touch. Email you send us is handled on the basis that you chose to contact us. When advertising is switched on, a notice bar can appear at the bottom of the page; dismissing it writes only a timestamp under the local storage key dr_ad_consent, nothing is sent to us, and the bar is an informational notice rather than a certified consent-management platform — where your law requires consent for ad cookies, the ad provider's own consent tool is what records and honours it.

How long we keep it

Hashed view and click counters stay while the site operates, because they are what make the trending lists meaningful. Ask us and we will delete the rows matching your dr_vid token or your IP hash — include the token value, or tell us your approximate IP and when you visited. Admin sessions expire on their own; the dashboard password is stored as a hash and the content import endpoint accepts only requests carrying a valid API key. Machine traffic between our own collector and this database is not a visitor dataset.

Your rights

Depending on where you live (GDPR/UK GDPR, CCPA/CPRA, PIPEDA, LGPD and similar laws) you can ask us to access, correct or delete the personal data we hold about you, to restrict or object to its processing, to port it, or to withdraw a consent you gave us by email. Because ranking data is hashed, we may need you to supply the dr_vid value from your browser, or a rough date and network, so we can find the right rows.

You can also do this yourself without us: clearing site data for www.novelliaapp.com removes the local storage token and any admin cookie, and using the site with JavaScript disabled stops view counting altogether.

We do not sell or share personal information, so there is nothing to opt out of under a "Do Not Sell or Share My Personal Information" request. Browser signals such as Global Privacy Control or Do Not Track are not read by our own code; when advertising is switched on, honouring them is up to whichever ad provider's script is running on the page.

To exercise any right, or to raise a concern, email [email protected]. If you are dissatisfied with how we handle a request you can escalate it to your local data protection authority — we would rather you wrote to us first.

Children

The site is general entertainment content and is not directed at children. We do not knowingly collect personal data from children; if a parent or a platform tells us we hold some, we delete it. The dramas we describe are catalogued and age-rated by the platforms that distribute them, and the DramaBox app applies its own age gates.

Security

The site is served over HTTPS, the dashboard requires a signed-in session, and the content import endpoint is protected by an API key. The database lives on a private volume that browsers cannot reach. No method of transmission or storage is completely secure, so we keep the personal data we hold to the minimum the site actually needs.

International transfers

Our application host, database and CDN may run in countries other than yours, so using the site means the request data described above may be processed in those locations. We apply this policy to it wherever the machine sits.

Changes and contact

The operator can update this page at any time from the dashboard, and the version you are reading is always the current one; material changes get a new "Last updated" date at the top. Questions, correction requests, rights-holder notices and rights requests all go to [email protected]. For content removal procedures, see our Terms of Use.