Privacy Policy
This policy explains what data manh.run collects, why, who processes it, how long we keep it and how to delete it. It also covers using manh.run from ChatGPT or another AI agent.
1. Summary
- We collect only what we need to run your account, your projects and the apps you deploy.
- manh.run runs no AI model of its own. When you use it from ChatGPT, Claude or another agent, we receive the tool calls the agent sends (for example file contents or a database query): not your chat history.
- We do not sell personal data, do not show ads, do not use analytics or advertising trackers, and do not use your data to train AI models.
Controller: Manh Vu (manh.run), Vietnam, support@manh.run.
2. Data we collect
Account data: when you sign up or sign in (through Clerk): your email address, name and profile picture, and, if you sign in with Google or GitHub, the identifier that provider gives us.
Project data: what you or your agent create: app code, specs, files, configuration, code checkpoints, deploy history, cron schedules, and secrets you set (stored encrypted on the app's Worker).
App data: data your deployed apps store in their own database and file storage, including data about your app's users. You control this data; see section 6.
MCP tool calls: when an agent calls a manh.run tool, we receive the tool name and its arguments and return the result. We keep these only as needed to perform the call and in short-lived operational logs.
Feedback widget: when someone leaves feedback on an app: their message, the page and element they pointed at, viewport size, browser type, recent console errors, the name, email and role the app passes in (if any), and a daily-rotating hash of their IP address for rate limiting. We do not store raw IP addresses for feedback.
Early access sign-ups: the email address, plan and language you submit.
Technical logs: request logs and errors from Cloudflare and our servers (such as IP address, time, path and user agent), used for security and debugging.
3. How we use it
- to provide the service: sign you in, store and compile your projects, deploy and run your apps, perform the tools your agent calls;
- to keep the service secure and working: rate limits, abuse prevention, debugging;
- to contact you about your account, your apps (for example a feedback digest) and important changes;
- to tell you when paid plans open, if you joined early access.
Legal bases (where GDPR or similar laws apply): performing our contract with you, our legitimate interest in securing and improving the service, and your consent for early-access emails.
4. Using manh.run from ChatGPT or another agent
When you connect manh.run to ChatGPT, Claude, Claude Code or another MCP client, you sign in to manh.run with OAuth and the client receives a token limited to your account. Your agent only sees your projects.
The agent's provider (for example OpenAI or Anthropic) handles your conversation under its own privacy policy. manh.run receives only what the agent includes in tool calls and sends back tool results, which the agent's provider then processes. Avoid putting secrets in prompts; use env_set for secrets instead.
You can disconnect at any time from the agent's settings. Disconnecting stops new tool calls; it does not delete your projects.
5. Who processes data for us
We use these sub-processors, each only for the purpose shown:
- Cloudflare: hosting of manh.run and your apps, project storage (R2), app databases (Durable Objects), D1, queues and logs, the built-in AI helper (Workers AI: the prompt your app sends is processed by models Cloudflare runs), and email: the email your apps send through the built-in helper and the feedback digest sent to project owners (Email Sending), and replies to those emails (Email Routing);
- Clerk: sign-in and account management;
- Vercel: build infrastructure (fallback);
- Turso: databases of some older apps.
These providers may process data outside Vietnam, including in the United States and the European Union, under their own safeguards (such as standard contractual clauses).
6. Data of your apps' users
For data inside the apps you deploy, you are the controller and manh.run is your processor. We store and process it only to host your app, on your instructions. If one of your app's users contacts us, we will refer them to you.
7. How long we keep data
- Account data: while your account exists; deleted within 30 days after you ask us to delete the account.
- Projects and their checkpoints (last 10): until you delete the project.
- App databases: until you delete the project; snapshots are kept up to 30 days.
- Feedback: until the project is deleted or the owner deletes it.
- Operational logs: typically up to 30 days.
- Early access: until paid plans open or you ask us to remove you.
9. Security
Data is encrypted in transit (HTTPS). Each app runs isolated with its own database; app secrets and provider keys are kept out of app code, and built-in email and AI go through a gateway with per-project tokens. No system is perfectly secure; if a breach affects your personal data we will notify you as the law requires.
10. Your rights
You can ask to access, correct, export or delete your personal data, or object to or restrict its use, by emailing support@manh.run. You can delete projects yourself in the dashboard. We reply within 30 days. You may also complain to your local data protection authority.
11. Children
manh.run is not meant for children under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
12. Changes
We will update this policy when our data practices change, change the date at the top and, for material changes, notify you by email or in the dashboard.