← Home

Privacy Policy

Effective May 20, 2026

Manabook is a learning app for kids. This policy explains what information we collect, how we use it, and the choices you have. We wrote it in plain language. If anything is unclear, email [email protected].

Who we are

Manabook is operated as a personal project by the site owner. The service is hosted at mymanabook.com (also reachable at manabook.suru.tools).

Information we collect

From parents (when you create an account)

  • Email address
  • Password (stored only as a salted bcrypt hash — we never see your raw password)
  • Display name (optional)

From kid profiles (created and managed by a parent)

  • Display name or nickname (we encourage non-identifying names)
  • A short handle (used for the optional “claim” flow across devices)
  • Age and grade
  • An avatar emoji you pick
  • Gameplay data: which tools were used, mana/XP earned, quiz results, streaks, and timestamps of activity

From your device

  • A session cookie (named manabook_session) that keeps you signed in. It contains a random session ID, nothing else.
  • A local-only cookie (manabook_kids) listing kid profile IDs created on this browser, so anonymous use works without an account.
  • Standard web-server logs (IP address, user-agent, request path, status code). Used to debug errors and prevent abuse.

We do not collect: location, contacts, photos, health data, microphone or camera input, advertising identifiers, or any data not listed above. We do not use third-party analytics, ad networks, or tracking pixels.

How we use information

  • To create and authenticate your parent account
  • To save kid profiles and progress, and sync them across your devices
  • To show appropriate content (e.g. spelling words for the kid's grade)
  • To prevent abuse (rate limiting, content filtering of submitted names)
  • To diagnose and fix bugs

Children's privacy

Manabook is designed for children with the involvement of a parent or guardian. Kid profiles are created and managed by the parent from their account. The parent chooses what name, age, and grade to enter and can edit or delete the profile at any time. We treat the parent's account creation and profile setup as their consent to the limited data collection described above.

We do not knowingly collect information directly from a child without the parent setting it up. If you believe a kid profile was created without the involved parent's knowledge, email [email protected] and we will delete it.

How we share information

We don't sell your data, ever. We don't share it with advertisers, data brokers, or analytics providers. The only services that touch your data are:

  • Our own infrastructure (a self-hosted Kubernetes cluster + Postgres database) where the app runs
  • Cloudflare, which routes web traffic to the app and provides TLS termination
  • ElevenLabs, but only to pre-generate the spelling and sight-word audio files during development. The generated MP3s are bundled with the app; ElevenLabs does not receive any data when a kid plays a sound.

How long we keep it

Account and profile data are kept until you delete the parent account or kid profile. Server logs are retained for up to 30 days. Deleted profiles are removed from active storage; backups (if any) are rotated within 30 days.

Your choices and rights

  • View or edit a kid profile: sign in, open the profile, edit name/age/grade/avatar
  • Delete a kid profile: open the profile and delete it; all associated progress data is removed
  • Delete your parent account: email [email protected] with the email on the account; we'll confirm and delete within 7 days
  • Request a copy of your data: same email address; we'll export your profile and gameplay data as JSON

Security

All traffic is encrypted with HTTPS. Passwords are hashed with bcrypt. The database is not exposed to the internet — only the web pods inside the cluster can reach it, enforced by network policy. We follow the principle of least privilege and store secrets outside the codebase.

Cookies

We use two cookies and only two: manabook_session (signed-in session) and manabook_kids (local list of anonymous kid profiles on this browser). Both are first-party, HttpOnly where possible, and have Secure + SameSite=Lax. We do not use analytics or advertising cookies.

International users

Manabook is operated from the United States. By using the service you understand that your information will be processed on servers located there. Where required by law, contact us to exercise GDPR or other regional data-protection rights.

Changes to this policy

If we change this policy, we'll update the “effective date” above. Material changes will be announced on the site.

Contact

Questions or requests: [email protected]