Privacy Policy

We collect only what we need to operate Manifest Method. The categories are listed in plain language below.

Account information

When you sign in with Google, we receive your name, email address, profile image, and a unique Google account identifier from Google's OAuth service. We do not receive your Google password. We store these on our servers to identify your account.

Profile preferences

You may optionally provide a username, country, and timezone. Timezone is used to deliver push notifications at the times you configure for your practice.

Content you create

Your manifests — including their text, goal target dates, and the three notification times you choose — are stored so we can show them to you and deliver reminders. Manifests are visible only to you.

Subscription & payment

If you subscribe to Plus, payment is processed by Stripe, Inc. We do not see or store your full card number, CVC, or bank account details. We receive and store a Stripe customer ID, subscription ID, plan, status, renewal date, and price details so we can manage your subscription. See Stripe's privacy notice at stripe.com/privacy.

Push notification subscriptions

If you enable push notifications, your browser provides us with a push endpoint URL and cryptographic keys we use to deliver messages. You can revoke this access at any time from your browser or device settings.

Technical data

Our servers and infrastructure providers automatically log connection details (IP address, user agent, request paths, timestamps) for security, abuse prevention, and basic diagnostics. These logs are retained for a limited period and are not used to build advertising profiles.

• To create your account, sign you in, and keep you signed in.
• To store your manifests and deliver the push notifications you configure.
• To process subscription payments, manage renewals, and email you transactional notices (e.g., a reminder before an annual renewal).
• To prevent abuse, fraud, and security incidents.
• To improve the product based on aggregate usage patterns.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information. We do not use your manifests, journal-like content, or account data to train third-party advertising or machine-learning models.

We share information only with the service providers that make Manifest Method work, and only the data they need to do their job. They are bound by contract and their own privacy and security obligations.

• Google — sign-in (OAuth). You authenticate with Google and Google tells us your basic profile.
• Stripe — payment processing and subscription management.
• Amazon Web Services (AWS) — hosting, database, and email delivery (Amazon SES) in the United States (us-east-1 region).

We may disclose information if required by law, valid legal process, or to protect the rights, safety, or property of Manifest Method, our users, or the public. We will notify you when possible.

If we are ever involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction. We will provide notice before your data becomes subject to a different privacy policy.

We use a small number of cookies and similar storage mechanisms that are strictly necessary to operate the service:

• A session cookie that keeps you signed in after you authenticate with Google.
• A CSRF token that protects you from cross-site request forgery.
• Local storage of UI preferences (such as your selected billing interval on the pricing page).

We do not currently use advertising or cross-site tracking cookies.

Push notifications are off by default. When you enable them, your browser issues us a push endpoint and keys that allow us to deliver the reminders you scheduled. You may revoke push access at any time from your browser or operating-system settings, or by signing out — once revoked, your push subscription is automatically removed from our records on its next failed delivery.

We keep account, manifest, and subscription data for as long as your account is active. If you delete your account, we delete the associated data within thirty (30) days, except where we are required by law to retain it longer (for example, financial records for tax purposes). Server logs are retained for a shorter rolling window.

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal information; to object to processing; and to withdraw consent at any time. To exercise any of these rights, email us at info@manifest-method.com from the address on your account. We will respond within the timeframes required by applicable law.

You can manage your subscription, including cancellation, from the Stripe Customer Portal linked inside your account.

Manifest Method is intended for users aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete the data.

Manifest Method is operated from the United States and our infrastructure is hosted in the United States. If you access the service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

We use industry-standard safeguards — including encryption in transit (HTTPS), encryption at rest, scoped IAM permissions for our infrastructure, and least-privilege access controls — to protect your information. No system is perfectly secure; if we ever experience a breach affecting your information we will notify you in accordance with applicable law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Effective” date above and, where appropriate, notify you by email or in-app notice before the change takes effect.

Questions about this policy or your information? Reach us at info@manifest-method.com.

Manifest Method (a sole proprietorship of Shane Streator)
[REPLACE: street address, city, state, ZIP]