Privacy Policy

1. What we collect

Your account

Your email address and password (stored securely by our authentication provider; we never see it in plain text), the name you want to be called, your time zone and display preferences, and the avatar you choose.

What you add

Life areas, goals, projects, tasks, routines, calendar events, check-ins, weekly reviews, notes you capture, focus sessions, and payments you track. This is your content; we keep it so the app works.

Voice notes

When you record a voice note, the audio is sent to our AI provider to turn it into text. We keep the text you choose to save, not the recording.

The Agent (optional)

• Website monitoring: the addresses you add, and the results of each check (up, slow or down, response time).
• Telegram: if you link Telegram, your chat ID and Telegram username, so alerts reach only you.
• Device notifications: if you turn them on, the push address your browser gives us and a short description of the browser.
• Gmail: see How we use Gmail below.

Technical data

Sign-in cookies that keep you logged in, and small settings saved in your browser (theme, sidebar, focus timer). We don’t use advertising or third-party tracking cookies.

2. How we use Gmail

Connecting Gmail is optional. If you connect it:

• We ask Google for read-only access (gmail.readonly) and nothing else. Manu can’t send, delete, label or change any email.
• About every 15 minutes, Manu reads new messages in your inbox to spot emails that need your reply, and looks for invoices, payment confirmations and payment promises in your inbox and sent mail (the first time, the last two weeks) to suggest who owes you money.
• Promotions, social updates, mailing lists and automated mail are skipped without being analysed. Other messages may be sent to our AI provider, which returns a short decision. Under its terms, the provider doesn’t use them to train its models.
• We store only what the feature needs: for an alert, the sender, subject and a one-line summary; for a payment suggestion, who, how much, the due date and a short quote from the email. For everything else we keep only Gmail’s message ID so we don’t read it twice. We never store full email bodies.
• Your Google access token is encrypted in a secure vault and is only used by the background agent. Disconnecting revokes it at Google and deletes it from our systems.
• People don’t read your email, except if you ask us to (for support), for security, or where the law requires it.

Manu-OS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We don’t use Gmail data for advertising, don’t sell it, and don’t use it to train AI models.

3. How we use your information

• To run Manu-OS for you: show your plan, save your changes, and send the reminders and alerts you set up.
• To offer AI suggestions when you ask for them (structuring a note, wording a goal, reviewing your week). Suggestions are only saved if you confirm them.
• To keep the service secure and working: preventing abuse, fixing problems, and enforcing limits.
• To contact you about your account (for example, a password reset or an important change to the service).

4. Who helps us run Manu-OS

We share data only with the providers needed to run the service, and only for that purpose:

• Supabase: database, sign-in and background jobs. Your data is stored in their Sydney, Australia region.
• Cloudflare: AI features and voice transcription.
• Google: Gmail access, only if you connect it.
• Telegram: alert messages to your own chat, only if you link it.
• Your browser’s push service (for example Google, Apple, Mozilla or Microsoft): device notifications, only if you turn them on.
• Our hosting and email providers: to serve the website and send account emails.

These providers may process data in countries other than yours. We don’t sell personal information and don’t share it with advertisers. We may disclose information if the law requires it.

5. How long we keep it

• Your account and content: until you delete them or ask us to delete your account.
• Website check history: 30 days.
• Email alerts: 90 days. Records of skipped emails (message IDs only): 14 days.
• Records of emails checked for payments (message IDs only): 30 days.
• Removed items are archived rather than erased right away so you can recover them; they’re deleted with your account.

6. Your choices and rights

• Disconnect Gmail or Telegram, or turn off device notifications, at any time from the Agent page and the bell menu.
• Edit or remove anything you’ve added.
• Ask for a copy of your data, a correction, or deletion of your account by writing to [email protected]. We’ll reply within 30 days.

Depending on where you live, you may have further rights under data protection law, including the right to complain to your local data protection authority.

7. Security

Data travels over encrypted connections. Each account can only reach its own data (enforced in the database itself), access tokens are kept in an encrypted vault, and background jobs only ever write to the account they belong to. No system is perfect; if something goes wrong that affects you, we’ll tell you.

8. Children

Manu-OS isn’t meant for anyone under 16. If you believe a child has created an account, contact us and we’ll remove it.

9. Changes to this policy

If we change this policy, we’ll update the date at the top. For important changes we’ll let you know in the app or by email before they take effect. See also our Terms of Service.