Privacy, plainly.

Privacy notice · Updated September 16, 2026

What you give us

You do not provide an email address, a password, or a social account. When you create an account, Manylane generates a high-entropy account code and stores its cryptographic hash. The original code is shown only at creation or rotation. API keys and session tokens are also stored as hashes.

What we record

Our application database stores your account identifier, creation time, membership period, named API key metadata, session expiry, and request metadata. Request metadata includes the model, protocol, timestamp, response status, duration, and model-reported token counts. It does not include prompts or generated answers. Payment records include order IDs, plan prices, quoted token amounts, public receiving addresses, verification state, and membership activations. Your recovery code is never sent to the payment gateway or recorded on the blockchain.

How inference works

Your prompts, conversation history, tool definitions, and any inline content you submit are sent to third-party inference services to produce an answer. Processing may take place outside your country. Manylane's database policy is not a zero-retention guarantee for those services. Do not submit secrets or sensitive personal information without evaluating the applicable processing requirements.

Cookies, security, and your browser

One essential HttpOnly cookie keeps you signed in for up to 30 days. It uses SameSite=Strict and Secure on HTTPS. We do not add advertising cookies or analytics trackers. Fonts are self-hosted. Playground messages live in the current tab's memory and are cleared when it is closed or reloaded.

Cloudflare processes connection information to deliver and protect the service. Hashed IP-derived identifiers are used for short-lived sign-in and registration protections. When configured, Cloudflare Turnstile verifies account actions and has its own processing terms.

Retention and control

Request metadata is scheduled for deletion after 90 days through a daily cleanup job. Session records expire after 30 days. Membership history is kept while your account exists. In Settings you can download up to the latest 10,000 retained metadata records, revoke API keys, rotate your account code, sign out all sessions, or permanently delete your sign-in and usage records. Payment records are retained separately for reconciliation and disputes with the account link removed; they are not automatically erased on account deletion. Public blockchain records cannot be erased. The account export also includes up to 1,000 payment orders. Infrastructure backups may age out separately.

No email recovery

We cannot email you a reset link, identify your account by an email address, or restore access from a lost code. Anyone who has the account code can access the account. Keep it in a password manager and never share it with an application.