Privacy

The short version

We hold your account and the review you are writing, and nothing else. We don’t show ads, we don’t sell or share your data for marketing, and there are no tracking or analytics cookies — only the one cookie that keeps you signed in. We count page visits, without cookies and without knowing who you are.

What we hold

• Your account: your name, your email address, and a scrambled (hashed) form of your password — never the password itself. If you sign in with Google, we receive your name, your email address and Google’s identifier for your account, and nothing else from Google.
• Your review: your question and scope, your search strings, the paper records the search returned, your screening decisions, extraction rows, grades, themes and drafts, and the log of those actions that becomes your methods section.
• A record of purchases: your plan, what you paid and when, and which reviews used your plan. Card details go to the payment processor and never reach us.
• An email address for All access news, only if you asked us to tell you when it opens.
• An email address for a research guide, only if you asked us to send you its files. We write to it only when we have something that helps you get into research.
• Short-lived counters: to limit abuse we count sign-in attempts and tutor requests, by account and by network address, and clear those counts after a couple of days.

In your browser we keep a few preferences (whether the step list is collapsed, drafts of unsaved rows) in local storage. They stay on your device.

Who else processes it

• Vercel hosts the site and Neon hosts the database.
• Vercel Web Analytics counts page visits for us, without cookies. For each visit it records the page (with the id of a review and anything after the “?” in the address taken out, except a campaign tag such as “src=tiktok”), the site you came from, the country, region and city the visit comes from, and your browser, operating system and kind of device. It tells visitors apart by a code made from the request that it discards after 24 hours, so a visit is never tied to you or your account.
• OpenAI runs the tutor. When the tutor checks something, the text it is checking is sent to OpenAI: what you wrote at that step and, where the step needs it, the title and abstract of the paper on your screen or a passage you pasted. Your name, email address and password are never sent. OpenAI’s terms for this kind of access say the data is not used to train its models by default.
• Stripe, through its Link checkout, takes payments and handles tax. It receives your email address and what you enter at checkout.
• Resend delivers the two emails about your account — the link that confirms your address and the link that resets your password. It receives your email address and that message.
• Google, only if you choose to sign in with it, and for the typefaces the pages load.
• Gmail (Google) sends the email with a research guide’s files, if you ask for them. It receives your email address and that message.
• PubMed, CrossRef, OpenAlex, Unpaywall and Europe PMC receive your search strings and the identifiers of papers you look up — not who you are.

How long we keep it

Until you delete it. Deleting a review removes it and everything in it. Deleting your account, from the account page, removes the account and every review in it at once. The record that a payment happened is kept, without your account attached, because accounts have to be kept.

Your choices

You can export your manuscript, your papers and your references at the last step, delete any review, change your password, sign every device out, and delete your account — all without asking us. For a copy of what we hold, or to have something corrected, write to manny.script.app@gmail.com.

Security

Passwords are hashed, every page is served over an encrypted connection, each review can be opened only by the account that owns it, and sign-in is rate-limited. No service can promise it will never be breached; if yours were affected we would tell you.

Age

MannyScript is written for university students and older. It is not meant for children under 13, and we do not knowingly hold their data.

Changes and contact

When this page changes, the date at the top changes with it. Questions: manny.script.app@gmail.com.