What we collect
When you create an account: your first name, email address, and a password (stored only in scrambled, hashed form). You can also add a mobile number in your profile.
If you sign in with Google: Google tells us your name, email address, and that it has checked the address. We keep your first name and email, and a link to your Google account so you can sign in again. We don't see your Google password or anything else in your Google account.
If you sign in with Apple: Apple tells us your name (the first time only) and an email address. If you choose “Hide my email”, that's a private relay address from Apple that forwards to you, and we never see your real one. We keep your first name and that email, and a link to your Apple ID so you can sign in again.
When you host: your place's name, kind, location and address, guest rooms, notes for guests, photos, the dates you're open or not hosting, any private notes, and your co-hosts.
When you open an invite link: the first name you enter and when you looked, so the host knows who's seen their dates. You don't need an account to look.
When you plan a visit: your dates, party size, notes, any changes or cancellations, and the reasons you give.
Technical details: your IP address, browser and device type, and basic logs, which we use to keep you signed in, keep the service secure, and fix problems.
How you use Manaaki: the screens you visit, the buttons you tap, what you do (like picking dates or sharing a link), and technical details like errors and how fast pages load, linked to your account once you sign in. We may also record sessions (a replay of what appeared on screen) so we can see where things are confusing or broken. Anything you type, addresses, phone numbers and private notes are hidden in those recordings.
How we use it
- To run Manaaki: show dates, handle visit requests, and keep everyone up to date.
- To send emails you need, like visit updates, reminders, and password resets.
- To keep accounts secure and prevent misuse.
- To understand what's broken and make Manaaki better.
We don't sell your information, we don't show ads, and we don't use advertising or cross-site tracking tools. Our usage analytics are only for us.
Who can see what
- Anyone with an invite link sees the place's name, photos, general area, guest note, and open dates. Never the street address, private notes, or other guests' names.
- Hosts and co-hosts see who opened their link (by first name), visit requests and visits, and the contact details guests have shared, so they can get in touch.
- Confirmed guests see the address of the place they're visiting.
- Private notes on dates are only ever visible to the place's hosts.
Who helps us run Manaaki
We use a small number of trusted providers, who only process data to provide their service to us:
- Railway hosts the app, its database, and photo storage (in the United States).
- Resend sends our emails.
- Google signs you in, if you choose “Continue with Google”.
- Apple signs you in, if you choose “Continue with Apple”, and forwards our emails if you hid your email address.
- PostHog stores our usage analytics and session recordings (in the United States).
- If you turn on notifications, your browser's push service (for example Apple, Google, or Mozilla) delivers them.
- If we suggest dates based on local holidays and seasons, we may send a place's general area to an AI provider (Anthropic) to generate those suggestions. We don't send names, contact details, or addresses.
We may also share information if the law requires it, to protect someone's safety, or as part of a merger or sale of Manaaki, in which case this policy would continue to apply.
Cookies
We use a few cookies and similar browser storage:
- A sign-in cookie that keeps you signed in.
- A guest cookie that remembers the first name you entered on an invite link, so you don't have to type it again. It lasts up to a year.
- An analytics ID (from PostHog) that tells us visits came from the same browser, so we can understand how people move through Manaaki. It lasts up to a year.
No advertising cookies.
How long we keep it
We keep your information while your account is open. When you delete your account (in My profile), we delete your account, your places that no one else hosts, your trips, and your activity straight away, end your Sign in with Apple link if you have one, and remove what's left in our analytics and other providers within 30 days, except where we must keep something by law. Copies in backups are removed as the backups expire.
Your choices and rights
- Update your name, mobile number, and password in your profile at any time.
- Delete your account and your information from My profile, whenever you like (how to delete your account).
- Hosts can edit or remove photos, dates, and places, and make a new invite link whenever they like.
- Ask us for a copy of your information, to correct it, or to delete your account, by emailing hello@manaaki.app.
Depending on where you live (for example the EU, UK, or California), you may have extra rights, such as objecting to how we use your information or complaining to a data protection authority. We'll honour them. Our legal basis for using your information is providing the service you asked for, our legitimate interest in keeping it safe and working, and your consent where we ask for it.
Security
Connections to Manaaki are encrypted, passwords are hashed, and access to our systems is limited. No service can promise perfect security, so please use a strong password you don't use anywhere else.
Children
Manaaki isn't meant for children under 16, and we don't knowingly collect their information. If you think a child has given us information, email us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top, and for meaningful changes we'll let you know in the app or by email. See also our Terms of Service.
Contact
Questions about your privacy? Email hello@manaaki.app.