Privacy Policy

Last updated: September 15, 2026

This Privacy Policy explains how Manamancer ("we", "us", "our") collects, uses, and shares information when you use Manamancer (the "Service"). By using the Service you also agree to our Terms of Service.

Manamancer is operated as a sole proprietorship established in the Province of Québec, Canada. The person in charge of the protection of personal information can be reached at support@manamancer.com. The operator's full legal name and business address are available on request at the same address.

1. Information we collect

Account information. When you register we collect your email address, a username, and a password. Your password and the core account record are managed by our authentication provider, Supabase Auth; we store your password only in hashed form.

Profile and preferences. Settings that follow you across devices — display name, avatar (if you upload one), theme, price source, and similar preferences.

Your content. The decks, deck folders, card collection, binders, and AI agent conversations you create in the Service. Agent conversations are retained on your account until you delete them.

AI feature data. If you use an AI feature, the deck contents, agent prompt and conversation history, generation preferences, and local card-search results needed for that request are processed to generate suggestions, decklists, primers, or commander ideas.

Billing information. If you subscribe to a paid plan, our payment processor (Stripe) collects and processes your payment details. We do not receive or store your full payment card number; we keep a record of your subscription status and plan.

Feedback. If you submit in-app feedback, we store your message, any screenshots you attach, and a snapshot of your username/email so we can follow up.

Support tickets. If you use the support ticket portal included with the Pro and Max plans, we store your identity snapshot, category, impact, subject, messages, screenshots, affected URL, ticket history, and the app/build, route, locale, browser, and platform context disclosed in the form. We do not automatically attach deck contents or Agent conversations.

Consent and eligibility records. We record that you accepted these policies, the version you accepted, and when — and that you confirmed you meet the minimum age requirement, and when. We do not collect your date of birth.

Technical and usage data. Basic information needed to operate the Service securely and reliably, such as your IP address (used for rate limiting and the sign-up bot check) and standard request logs.

Advertising data. When advertising is enabled, Google AdSense and its partners may collect or receive browser or device information such as your IP address, advertising cookies or local-storage identifiers, and information about the ads served and your interactions with them, as described in Section 5.

Connection history. Each time you open Manamancer while signed in, we record that connection: your account, the date and time, your IP address, and your browser's user-agent string (which identifies your browser and operating system). Repeat opens within a short window are recorded once. We use this to secure accounts, investigate suspicious access and account sharing, and understand how much the Service is used. This history is visible only to Manamancer administrators, is kept for 90 days, and is deleted automatically after that — as well as immediately if you delete your account. We do not use it to build advertising profiles, and we do not derive your physical location from it.

2. How we use information

We use your information to:

• provide, maintain, and secure the Service and your account;
• confirm your eligibility to use the Service;
• sync your decks, collection, and preferences across your devices;
• generate AI suggestions when you request them;
• process payments and manage subscriptions;
• respond to your feedback and support requests;
• deliver contextual advertising and, where you consent, personalized advertising, and measure ad performance;
• detect, prevent, and address abuse, fraud, and security issues; and
• comply with legal obligations.

We do not sell your personal information.

Advertising does not influence suggestions produced by our AI features.

3. How information is shared

We share information only with service providers ("processors") and, when advertising is enabled, advertising partners that help us run and fund the Service, and only as needed:

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users and the Service. If we are involved in a merger or acquisition, information may be transferred as part of that transaction.

4. AI processing

AI features are available on every account, free and paid alike. Each plan carries a recurring AI usage allowance, and a larger allowance is one of the things a paid subscription buys. Whenever you use an AI feature, the data described below is sent to our AI provider — on a free account exactly as on a paid one.

The AI and generation features send the request data described above to OpenAI for processing. Multi-round reviews and deck-generation runs use the OpenAI Responses API's stored response state only for a response chain within that single Manamancer request. OpenAI states that this application state is retained for at least 30 days. Single-shot calls, such as a primer, archetype, or commander suggestion, request store: false and do not intentionally create that stored application state.

OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. Under OpenAI's ordinary API data controls, abuse- monitoring logs may contain prompts and responses and are generally retained for up to 30 days, with longer retention possible where legally required or reasonably necessary to protect OpenAI's services or third parties. Please do not enter personal or confidential information into the agent. OpenAI's handling of that data is also governed by its own terms and privacy commitments.

5. Cookies and local storage

We use cookies and your browser's local storage for essential purposes — keeping you signed in (session tokens) and remembering device-local interface preferences such as panel layout.

When advertising is enabled, Google and its advertising partners may place or read advertising cookies and similar data in local storage. They may use web beacons, IP addresses, browser or device information, and other identifiers to serve and secure ads, limit how often they appear, prevent fraud, and measure their performance. Depending on your choices and applicable law, ads may be contextual (based on the page you are viewing and your general location) or personalized (based on prior visits, interests, or activity).

When advertising is enabled, users in the European Economic Area (EEA), the United Kingdom, and Switzerland will be shown a Google-certified consent management platform (CMP) before technologies that require consent are used. The CMP lets you accept, reject, or manage advertising purposes and partners, and later change or withdraw your consent through its privacy-choices control.

You can review or change Google's ad-personalization choices at Google Ads Settings. Learn more at How Google uses information from sites or apps that use its services.

When third-party ad serving is enabled, other third-party vendors and ad networks may also serve ads on Manamancer. You can opt out of some of those vendors' use of cookies for personalized advertising through YourAdChoices.

6. Data retention and deletion

We keep your information for as long as your account is active. When you delete your account, the personal data and content associated with it are deleted, and related records (decks, collection, conversations, subscription) are removed by cascade. Some records may be retained where required for legal, accounting, or security reasons (for example, billing records and abuse logs). Connection history, described in Information we collect above, is kept for 90 days and then deleted automatically. Feedback you submitted may be retained in de-identified form after account deletion. Deleting your account immediately deletes its application support tickets, events, and email jobs. Otherwise, closed ticket text and audit events are deleted after 24 months, screenshots after 90 days, and sent email-job records after 30 days. We seek to align the support mailbox with the same retention periods. Deleting your Manamancer account does not accelerate the provider-retention periods for AI requests already processed by OpenAI, as described in AI processing above.

7. Your rights

Depending on where you live, you have some or all of the following rights over your personal information. Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) apply to us; residents of other regions may have comparable rights under their own law.

• Access and rectification — obtain a copy of the personal information we hold about you and have inaccurate information corrected.
• Deletion — delete your account and the personal information associated with it, subject to the retention exceptions in Data retention and deletion above.
• Withdrawal of consent — withdraw your consent to processing that relies on it, and object to or ask us to restrict certain processing.
• Portability — receive the computerized personal information you provided to us in a structured, commonly used technological format, or have it communicated to another organization where technically feasible.
• De-indexing and cessation of dissemination — ask us to stop disseminating personal information about you, or to de-index a link to it, where the conditions in the law are met.
• Automated decision-making — we do not make decisions about you based exclusively on automated processing that produce legal effects or similarly significant effects. AI output in the Service is advisory only and is always shown to you for review.

You can update much of your information in Account settings or delete your account directly. To exercise any other right, contact us at support@manamancer.com.

You also have the right to lodge a complaint with a data-protection authority — in Québec, the Commission d'accès à l'information du Québec (CAI); elsewhere in Canada, the Office of the Privacy Commissioner of Canada (OPC); and, if you are in the EEA or the UK, your local supervisory authority.

8. Security

We use industry-standard measures to protect your information, including encrypted connections, hashed passwords, row-level access controls, and server-side authorization on every request. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

9. Privacy incidents

If a confidentiality incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information with reasonable diligence, and take reasonable measures to reduce the risk of injury and prevent a recurrence. We maintain a register of confidentiality incidents as required by law.

10. International transfers

Your account, profile, deck, and collection data is stored in the United States (Supabase and Render, US West region). Our other processors (OpenAI, Stripe, and Resend) and, when advertising is enabled, Google AdSense also process data in the United States, and their infrastructure may extend to other countries.

Before communicating personal information outside Québec we assess whether it would receive adequate protection, taking into account the sensitivity of the information, the purpose of its use, the protections it would receive, and the legal framework of the destination — including applicable personal-information principles. Where required, we rely on contractual safeguards with our providers for such transfers.

11. Children's privacy

The Service is not directed to children under 13 (or the minimum age of digital consent in your country, if higher). Creating an account requires a confirmation that the account holder is at least 13 years old, and we do not knowingly collect the personal information of anyone below that age. In Québec, personal information about a person under 14 is collected only with the consent of a person having parental authority. If you believe a child has provided us information, contact us at support@manamancer.com and we will delete it.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the version and the "Last updated" date and, where appropriate, ask you to re-accept.

13. Contact

Questions about this Policy or your data? Contact the person in charge of the protection of personal information at support@manamancer.com.