Privacy policy

What Made By Days collects

Today, an account holds: your email address; your password, in a form that cannot be read back; your date of birth; the version of the terms you accepted and when; the consents you gave or withdrew and when; your sign-in sessions; and records of the requests you make about your data (a deletion request, an export, a password reset), by their times. Once you agree to it on the path page, the account also holds your goal record: the goal in your words, its kind, horizon, start day, time zone and the place you name, the stops with their states and lift lines, the steps, and the evidence you log. When you write to the contact address, the mailbox keeps what you wrote. Once you agree to it on the guide page, the account also holds your conversations with the guide and the drafts your team writes for you, a count of the messages you send each month, and the check-in cadence you set. Once you agree to it on the money page, the account also holds the money figures you enter for your goal: what you can put toward it per year, for how many years, and each stop's cost range. As each later part opens, the account will also hold the picture of your place, asked for before it is collected.

If you sign in with Google, Made By Days receives your Google account's email address and Google's identifier for you. It keeps the address and a scrambled form of the identifier, which it uses to recognise your sign-in. It does not receive your Google password, your name or your contacts.

From 10 November 2026: if you buy a plan, the account also holds the record of your plan and its payments: the plan, its status and its dates, the amounts, and Stripe's references for them. Your card never reaches Made By Days: you enter it on Stripe's own page.

To limit abuse of the sign-up, sign-in and password forms, Made By Days also counts requests under a keyed hash of the network address they come from and of the address typed into the form. Those counts are kept for up to two days, cannot be turned back into an address without a key that lives only on the server, and are left out of backups. When Cloudflare, which carries the site, serves a challenge page, it sets cookies of its own for that purpose. The sign-up form reads the country Cloudflare reports for your network address and takes sign-ups only from the United States; the country is not kept.

The demo. Opening the demo makes a demo account seeded with a sample goal. It holds that seed and what you type into it (messages to the demo's guide, steps, entries) until it ends 24 hours after it was opened; the daily sweep then removes its rows, and the daily encrypted backups keep a copy for 180 days as the backups line below says. The limit on opening demos keeps a keyed hash of your network address for up to two days, as the request counts above. The demo's guide answers from a recording: no model reads what you type there, and nothing of a demo is sent to a provider.

As further parts of Made By Days open, each asks for the data it needs before collecting it, one kind at a time, as the consumer health data privacy policy describes.

What it is used for

To run your account and sign you in; to send you the mails the service needs (a confirmation link, a password reset, the written answer to a deletion request, a notice of a change to the terms or to this policy); to answer your requests; and to keep the forms from being abused. The guide, the planner and the researcher will read what you give them to plan your goal with you and to do the legwork you asked for, except the money figures, which no model and no mentor reads. Made By Days sends no marketing mail.

Who receives it

The companies that carry and host the service and the mail it sends. Each is named here with what it receives and how to reach its privacy contact:

• Resend (Plus Five Five, Inc.), which delivers the mail this product sends you. It receives your email address and the messages sent to it. Its privacy contact is privacy@resend.com.
• Cloudflare, which carries the connection between you and our server, and stores our encrypted backups. It receives everything you send to and receive from the product, on its way, and the backups, which it cannot read. Its privacy contact is privacyquestions@cloudflare.com.
• Akamai Cloud (formerly Linode), which runs the server the product and its database are on. It receives everything the product stores, on the disk of the server it runs. Its privacy contact is https://www.akamai.com/legal/dpr.
• Google Workspace (Google LLC), which hosts the mailbox behind our contact address. It receives the messages you send to our contact address, and our replies. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• Google sign-in (Google LLC), which signs you in with your Google account, if you choose that. It receives that you signed in to this product with your Google account, and when. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• From 10 November 2026: Stripe (Stripe, Inc.), which takes your payment when you buy a plan. It receives your email address, the amount, a reference to your account that is not your name, and, on its own page, your billing address and card details; with each payment's record Stripe shows us the billing name and address and the card's brand and last digits, which we read and do not keep; the card's number never reaches us. Its privacy contact is privacy@stripe.com.
• OpenAI, L.L.C., which when the guide opens: answers as your guide and your planner, and reads your messages for the crisis check. It receives the words you send your guide, and what your guide reads of your path and your week; never your address, your name or your date of birth. Its privacy contact is privacy@openai.com.
• Anthropic, PBC, which when the guide opens: a second model provider, used for a turn only when the operator switches your guide to it. It receives when it is used, the same as OpenAI: the words you send your guide and what your guide reads of your path and your week; never your address, your name or your date of birth. Its privacy contact is privacy@anthropic.com.

No company receives what you send us for its own purposes. Cloudflare keeps its own record of the traffic it carries, such as your IP address, under its own privacy policy.

The conversations you choose to have with the guide, and what you give it to work with, are sent to the model providers named here under written contracts that forbid training on them, from 9 October 2026: OpenAI (abuse logs kept up to 30 days, none under zero data retention) and Anthropic (deleted within 30 days; flagged inputs and outputs kept up to two years). Nothing is sent before you agree to it on the guide page.

Page views, and three events (a demo opened, an account created, an address confirmed), are counted by the maker's own analytics instance (Plausible, self-hosted, no cookie and no identifier that follows you across sites). An event carries the page, your address and your browser, as a page view does, and nothing about the account; no third party receives any of it.

Your health data

Health data, such as the goal record and your conversations with the guide, where they touch your body or your mind, is covered by the consumer health data privacy policy, which says what is collected and why, with whom it is shared, and how you use your rights. Nothing of it is collected before you agree.

What Made By Days does not do

Made By Days does not sell personal information and does not share it for advertising. It shows no advertising. Its only analytics is the maker's own counter named above, and no advertising, analytics or tracking company collects data about you across sites when you use Made By Days. Because nothing is tracked across sites, Made By Days does not respond to "do not track" signals: there is nothing to turn off.

Made By Days is not for anyone under 18 and does not knowingly collect information from anyone under 18.

Your choices and your rights

In your account you can see and download everything in it, change your password, withdraw a consent, and delete your account. To correct your email address, or for anything you cannot do in your account, write to team@manic.agency from the address of your account. Made By Days answers within 45 days, or tells you why inside them and finishes within 45 more; a deletion is carried out within 30 days, usually within minutes, and is never extended. If you disagree with how a request was handled, write again and say so: Made By Days reviews it and answers in writing, with its reasons, within 45 days, and tells you how to reach the Attorney General of your state if it did not do what you asked.

Nevada residents

Nevada law lets you direct a website operator not to sell your covered information. Made By Days sells none, and will not. You can still send that direction to team@manic.agency, the address designated for such requests, and Made By Days confirms it within 45 days.

How long it is kept

Your account, for as long as you keep it. A sign-up that is never confirmed, for 7 days after its confirmation link expires (a link works for 24 hours). Ended sessions, 30 days. Request counts, up to two days, and never in backups. Backups, 180 days: the consumer health data privacy policy says what a restore from a backup does. The records that show a deletion or another request was answered in time are kept without the wording of the request. When your account is deleted, our correspondence with you is deleted from the mailbox within the same 30 days.

Conversations and the team's drafts and reports, until you delete them or three years after your last sign-in.

The delivery log and job payloads, erased with your account.

The record of your plan and its payments (the plan, its status and dates, the amounts, Stripe's references, the ids of the events Stripe delivered), erased with your account; what we did on it (a refund, a cancellation, a reconcile) is kept without your name, with Stripe's reference of the charge or customer it concerned, as the record that it was done.

The time a crisis referral was shown, erased with your account.

The count of referrals with no identifier, kept.

The crisis referral record

When the guide shows a crisis referral, your account will keep only that it was shown and when. The message will not be stored, will not be shown to your mentor and will not be read by anyone at Made By Days. The record will be deleted with your account.

The yearly report

A count of crisis referrals with no name, address or account on it will be kept for the report California requires each year from 1 July 2027. It will identify no one.

Accounts nobody signs in to

An account nobody has signed in to for three years is deleted, after a notice to its address 30 days before. Signing in keeps it.

Security

Passwords are stored as hashes that cannot be read back. Connections are encrypted. Backups can be read only with a key that is not on the server. Access to the server is by key only.

Changes to this policy

Made By Days emails account holders about a material change at least 30 days before it takes effect, and the effective date at the top changes. The lines marked "From 10 November 2026" take effect on that day.

Contact

Manic Agency LLC, 2831 St Rose Parkway, Suite 200, Henderson, NV 89052, United States. team@manic.agency