Consumer health data privacy policy

What we collect and why

The product holds your account: your email address, taken at sign-up to run your account, your password in a form that cannot be read back, your date of birth, the version of the terms you agreed to and when, the consents you give or withdraw, the times of your sign-ins, and, if you sign in with Google, the record of that sign-in method. Once you agree to it on the path page, it holds your goal record (the goal in your words, its kind, horizon, start day, time zone and the place you name, the stops with their states and lift lines, the steps, and the evidence you log). Once you agree to it on the guide page, it holds your conversations with your guide and the drafts your team writes for you. Once you agree to it on the money page, it holds the money figures you enter for your goal. The intake refuses a goal about mental or behavioural health, and still what you write on your path (a stop's name, a lift line, a note) or to your guide may touch your body or your mind: this policy covers that information wherever it sits.

When a part of the product asks for a kind of data, it asks you first, one kind at a time, and this page then names the kind, where it comes from, who receives it and for how long it is kept. As each part opens, we will ask for these kinds of data, each only after you agree to it, one kind of data and one use at a time:

• Your profile (your name), if a later part asks for it: to address you.
• Your goal record (your goal, its stops and steps, the evidence you log, and, when the upload opens, the picture of your place), asked for on the path page before your first goal: to build and keep your path.
• Your conversations with your guide and the drafts your team writes for you, asked for on the guide page before your first message: to plan with you and to carry the plan between sessions.
• Your week (the plan items and the time you say you have), when the week opens: to draft each week with you.
• The money figures you enter for your goal (what you can put toward it per year, for how many years, and each stop's cost range), asked for on the money page before your first figure: to do the arithmetic there. No model and no mentor reads them.
• The events of the calendars you list and the mail from the senders you list, when connections open: to put real dates and messages into your plan.

We will use each kind of data only for the purpose you agreed to. Every time data is used or sent anywhere, the product checks that your consent still stands. If the wording of a consent changes, we ask you again.

Where it comes from

From you: what you type. From the mentor you invite, when that seat opens: what they write beside your path. From the calendars and the senders you list, when connections open. Nothing comes from any other company.

How the data is processed

Your data is held in one database on a server in the United States that Manic Agency LLC rents from Akamai. Its disk is encrypted, and so are the backups. It is handled by Made By Days's own software. Where a company named below processes it, that company does so for that purpose and no other.

Who we share it with and why

• Your mentor, when you invite one and that seat opens: the kinds above that you mark shared, so your mentor can follow your path and write beside it, for as long as the seat is active.
• Resend (Plus Five Five, Inc.), which delivers the mail this product sends you. It receives your email address and the messages sent to it. Its privacy contact is privacy@resend.com.
• Cloudflare, which carries the connection between you and our server, and stores our encrypted backups. It receives everything you send to and receive from the product, on its way, and the backups, which it cannot read. Its privacy contact is privacyquestions@cloudflare.com.
• Akamai Cloud (formerly Linode), which runs the server the product and its database are on. It receives everything the product stores, on the disk of the server it runs. Its privacy contact is https://www.akamai.com/legal/dpr.
• Google Workspace (Google LLC), which hosts the mailbox behind our contact address. It receives the messages you send to our contact address, and our replies. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• Google sign-in (Google LLC), which signs you in with your Google account, if you choose that. It receives that you signed in to this product with your Google account, and when. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• From 10 November 2026: Stripe (Stripe, Inc.), which takes your payment when you buy a plan. It receives your email address, the amount, a reference to your account that is not your name, and, on its own page, your billing address and card details; with each payment's record Stripe shows us the billing name and address and the card's brand and last digits, which we read and do not keep; the card's number never reaches us. Its privacy contact is privacy@stripe.com.
• OpenAI, L.L.C., which when the guide opens: answers as your guide and your planner, and reads your messages for the crisis check. It receives the words you send your guide, and what your guide reads of your path and your week; never your address, your name or your date of birth. Its privacy contact is privacy@openai.com.
• Anthropic, PBC, which when the guide opens: a second model provider, used for a turn only when the operator switches your guide to it. It receives when it is used, the same as OpenAI: the words you send your guide and what your guide reads of your path and your week; never your address, your name or your date of birth. Its privacy contact is privacy@anthropic.com.
• AI providers, under written contracts that forbid training on your data: to produce your guide's work from the conversations and the record you agree to send, when the guide opens: OpenAI (abuse logs kept up to 30 days, none under zero data retention) and Anthropic (deleted within 30 days; flagged inputs and outputs kept up to two years). None receives anything in this release, and no other provider is added without being named here first.

We share consumer health data with no affiliate. We do not sell it. We use no advertising or analytics software that can see it.

Your rights and how to use them

You can use each of these rights in your account, or by writing to team@manic.agency from the address of your account.

• See what we hold. The export gives you everything in your account, and names each company that received any of it with its privacy contact.
• Correct something. Write to us and say what is wrong. As each part opens, you will be able to change its entries in your account.
• Withdraw a consent. It takes effect at once, and work that was waiting on it is cancelled.
• Delete your account and data. We ask for your password again, sign you out everywhere, tell each company that keeps records under your address to delete them, and erase your account, within 30 days at the latest and usually within minutes. Before anything is erased we write to you to confirm the request and to say what remains after it and for how long.

What remains after a deletion:

• Resend, which delivers our mail, keeps its delivery record of the messages we sent you for up to 30 days.
• Cloudflare, which carries the connection between you and our server, keeps its own record of that traffic, such as your IP address, under its own privacy policy, which names no fixed period (https://www.cloudflare.com/privacypolicy/).
• Akamai, which runs our server, keeps no copy of your data beside it, so the erasure removes your data there too.
• Google, which hosts the mailbox behind our contact address, holds the messages you sent to that address and our replies until we delete them from the mailbox.
• Google, if you signed in with it, keeps its own record of that sign-in under your Google account, where you can see and remove it.
• Stripe keeps the records of payments you made for as long as its legal duties require.
• OpenAI, whose models answer as your guide, keeps what it received for up to 30 days to check for abuse, then deletes it; it holds nothing under your address.
• Anthropic, the second model provider this product is set up with, deletes what it receives within 30 days and keeps only what its safety systems flagged, for up to two years; it holds nothing under your address.
• Our encrypted backups are kept for 180 days and then destroyed. If we ever restore from a backup, your data is deleted again before the service reopens, and the copy that the restore replaced is destroyed within 7 days.
• Our correspondence with you in the contact mailbox, which we delete within the same 30 days.

We answer every request within 45 days. If we need longer for a request other than a deletion, we tell you why inside those 45 days and finish within 45 more. A deletion is never extended. If you disagree with how we handled a request, write to team@manic.agency: we review it again and answer in writing, with our reasons, within 45 days. If you are still not satisfied, you can file a complaint with the Attorney General of your state: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov.

No tracking across sites

No advertising, analytics or tracking company collects your health data, or any data about you, across sites when you use Made By Days. Made By Days shows no advertising. Its only analytics is the maker's own counter, named in the privacy policy, which records which pages are opened and never what you write.

Changes to this policy

We email every account holder about a material change at least 30 days before it takes effect, and we ask for your consent again before any new kind of data is collected or used for a new purpose. The version number and the effective date at the top change with each revision. The lines marked "From 10 November 2026" take effect on that day.

How to reach us

team@manic.agency. Made By Days is operated by Manic Agency LLC, 2831 St Rose Parkway, Suite 200, Henderson, NV 89052, United States.