Privacy Policy

Manor (“Manor,” “we,” “us”) is a voice-first expense journal for Morocco, offered as an Android and iPhone app and website. It is built and operated by Rida Lamhadri, an independent developer in Morocco. This policy explains the data handled on this website and in the Manor app, and the choices available to you.

Questions or requests: support@talktomanor.com.

Data collected on this website

The earlier Android closed-test form collected the first name and Gmail address you provided, plus the consent-notice version and registration time. We use this data to operate the test and related launch communications. The Gmail address is normalized to prevent duplicate registrations.

The feedback form collects the request type, title, description, and submission time. You may also provide a public name, private email address, and up to three private screenshots. The name and email are optional, so you can submit anonymously.

Every submission stays private during moderation. If we publish it, the type, title, description, optional public name, date, public status, and any shipped-version link become public. The email address and screenshots are never public. Convex stores the content, private contact, and private files separately.

The feedback, registration, and deletion forms use Cloudflare Turnstile to prevent abuse. We do not store the raw Turnstile token or IP address with requests. Cloudflare Web Analytics measures aggregate, cookieless website visits and performance. We do not use Google Analytics or advertising cookies.

Turnstile also processes browser signals, including your IP address, TLS connection fingerprint, browser type, site key and associated origin. Cloudflare processes these signals to block bots for Manor. It also uses them under its own responsibility to improve Turnstile. Its Turnstile privacy policy explains these uses.

Optional store-link reporting

Website reporting stays off until you allow it in "Website reporting" at the bottom of the page. With your permission, Manor sends clicks to Google Play or TestFlight to PostHog Cloud US. It reports automatic redirects from the download page separately. Each event includes the language, store, page type, and, where applicable, the public article ID or article slug. These events do not prove an app install or app use.

Your choice stays in this browser's local storage. A random identifier and article context stay in tab storage. Article context expires after 30 minutes. We do not send full URLs, search parameters, referrers, form data, email addresses, account IDs, or expenses. Reporting creates no person profile and uses no autocapture, session recording, or advertising cookies. We disable location enrichment. PostHog still receives the IP address needed for the network connection.

You can turn reporting off in the same place. Manor then clears the tab's identifier and article context and stops new events. An event already sent cannot be recalled. The site respects Do Not Track and Global Privacy Control signals. This choice is separate from analytics consent in the app. PostHog's retention period is described below.

Earlier Android closed-test emails

For the earlier Android closed test, Manor used Resend to manage invitation emails and tester contacts containing first names and Gmail addresses. Open testing no longer requires that invitation process. Previously stored tester contacts remain subject to this policy until their deletion is confirmed. Contact support@talktomanor.com to request removal.

Data in the Manor app

Account and sign-in

Manor uses Google sign-in and, on supported iPhones, Sign in with Apple. Your provider supplies an account identifier and email address, and may supply your name. Better Auth, hosted in Convex, manages your Manor account and sessions.

If you choose Hide My Email with Apple, Manor receives an Apple relay address instead of your personal address. Use the address shown in your Manor account when contacting support about that account.

Expense entries: amount, category, date, note, and the original transcript of what you said or typed.
Budgets and fixed expenses that you enter.
Voice recordings you choose to make when capturing an expense.
Account-specific local data: pending captures, files, cache, onboarding progress, and scheduled reminders.

The app contains no advertising and connects to no bank account. We never sell this or any other personal information.

Google supplies standard identity information only. Manor does not request access to Gmail, Drive, Contacts, or other Google products.

Budget invitations

The owner enters a member’s email address manually. Manor matches it to an existing account and stores the recipient, budget, inviter, invitation status, and dates. The invitation appears in Manor. This feature does not send an email or access your device address book.

Shared-budget data

Active members of a shared budget can read its expenses, including amounts, dates, categories, notes, and transcripts. They also see active members' names, email addresses, roles, and membership dates. They can export the data they can access. Add only information you agree to share with those members. Removing a member does not delete copies other members have already exported.

Mobile product analytics

Manor uses limited mobile product analytics to understand completed feature usage and service reliability. Analytics stays off until you explicitly accept after sign-in. Declining does not block any feature. You can disable it at any time in Settings. An old default-on preference does not count as permission. The choice is account-scoped and synchronizes across that account’s devices. When analytics is disabled, Manor stops collecting these events for that account. An offline withdrawal stops this device immediately. It applies on other devices after the server receives the choice and those devices refresh it. Older queued events stay blocked after acceptance again.

PostHog is our service provider and processor for this analytics. Manor uses PostHog Cloud US and sends events to https://us.i.posthog.com. Manor identifies the account only with its pseudonymous internal appUserId, never with a name, email address, Google or provider identity, or Better Auth identity. On sign-out or account switch, Manor clears the old identity from the on-device analytics client and stops capture for the old account.

Manor records only allowlisted product and reliability events: onboarding started, sign-in, account creation, and onboarding completion; foreground sessions; budget or custom-category creation; capture started, queued offline, parsing started, first result shown, result committed, needs attention, or failed safely; first expense committed; month view opened; search used; month exported; fixed-expense suggestion shown or resolved; fixed-expense template creation or status changes; quick capture opened; post-save context shown; invitation lifecycle changes; and membership removal.

Depending on the event, properties are limited to capture mode or source, normalized outcomes, item counts, queue, upload, reconciliation, and processing durations, export format, the origin or state of a budget, suggestion, template, invitation, or removal, and a general error class. An event may also include its time and a delivery identifier used to prevent duplicates. Mobile events add the app platform and operating system, app version and build, variant, EAS channel, runtime version, and available EAS update, project, and account identifiers. These properties do not contain the content used in the feature.

For Gemini reliability, Manor records one content-free event with voice or text mode, the fixed model, a normalized outcome and error class, processing latency, per-attempt and retry-wait timings, attempt counts, and input and output token counts when available. After authentication, and only while analytics is enabled, Manor may also record sanitized JavaScript errors: error type, a fixed label, generated-code locations, and the app surface. A JavaScript error report may include a short technical error message produced by the app’s own runtime; such a message names a programming identifier, never anything from your journal. All other error text is replaced with a general category label before it is sent.

Manor does not send PostHog names, email addresses, Google or provider identities, Better Auth identities, amounts, budgets, currency, categories, merchants, notes, transcripts, typed capture content, voice recordings, recording metadata, search text, export content, error text other than the short runtime messages described above, console or log output, or network request or response bodies.

Manor does not use Session Replay, screenshots, automatic screen capture, touch or text autocapture, console capture, advertising profiling, or remote analytics experiments, surveys, or feature flags. Native Android and iOS crash capture remains disabled. The current public PostHog React Native SDK bridge does not let Manor safely delete native reports that were already queued when analytics is disabled, at sign-out or account switch, or during account deletion. Manor will not enable native crash capture until queued reports can honor the account’s analytics choice. GeoIP and location enrichment are disabled for collected events; this does not mean network services cannot receive an IP address while routing a request. Mobile and server collection each have an independent production kill switch.

How voice and text are understood

With your permission in this version of the app, Manor sends your recording or typed expense to Google Gemini to identify expenses and corrections. The request can also include the date, timezone, language settings, budget currency, category choices, and relevant recent expense details such as amounts, dates, categories, and notes. Convex stores the resulting entries and original transcript. Gemini processing is separate from Google sign-in.

You can withdraw permission in Settings by turning expense processing off. The choice applies to your account across its connected devices. If you withdraw while offline, this device stops immediately and the server receives your choice after reconnection. Other devices use it once the server receives it. Manor stops new Google Gemini requests, including token counting. A request already sent cannot be recalled. You can still read your notebook and keep unfinished notes. Your next explicit microphone, typed-note, correction, or retry action asks for permission again. Accepting does not restart all old notes. Each iPhone’s system microphone permission is separate.

Manor deletes its uploaded recording after successful processing. A recording attached to an entry that needs attention remains until you resolve or discard that entry. This describes Manor's storage, not Google's independent handling of submitted data.

Manor uses the Gemini API through a Google Cloud project with billing enabled. Under Google's paid-service terms, Google does not use these prompts and responses to improve its products. Google's abuse-monitoring documentation states that it retains prompts, context, and output for 55 days. Authorized Google employees may review content flagged by its safety systems to investigate abuse. Google may also retain information where its legal obligations require it. Google's handling is separate from Manor's deletion of its own recordings.

Gemini API terms Google abuse-monitoring retention

Why we use this data

To sign you in and maintain the security of your session.
To operate your journal, budget, and account synchronization.
To turn your voice or text into an expense.
To understand completed feature usage and service reliability without financial, voice, or typed content.
To run the Android test and prevent abuse of public forms.
To receive, moderate, publish, and store feedback, and to contact you about it if you provide an email address.
To measure aggregate website traffic and performance.

Service providers we use

PostHog : mobile product analytics and reliability processor, used through PostHog Cloud US with the pseudonymous appUserId and limited events described above.
Convex : database, file storage, server functions, and Better Auth hosting. Convex stores the profile, account and session data, expenses, budgets, fixed expenses, transcripts, voice files, feedback, private contact details, and private screenshots.
Google : Google OAuth confirms your identity; the Gemini API processes voice and typed captures. These services apply their own terms and privacy policies.
Apple : Sign in with Apple authentication and a relay address if you choose Hide My Email.
Paddle : merchant of record for website payments. Manor processes customer and transaction identifiers, subscription status, renewal dates, and the data needed to verify access. Paddle handles website payments, invoices, payment methods, and website refund requests.
RevenueCat : technical subscription synchronization for Apple and Paddle. Manor receives billing identifiers, status, access periods, and events needed for reconciliation. RevenueCat does not decide Manor access by itself.
Cloudflare : website hosting, Turnstile form protection, and aggregate cookieless website analytics.
Resend : email and contact provider for the earlier Android closed test. Historical contacts may remain until deletion is confirmed.

How providers protect data

Manor has signed PostHog's data processing agreement. Convex and RevenueCat also publish data processing agreements, the Convex DPA and the RevenueCat DPA. The paid Gemini terms refer to Google's data processing terms.

Convex's, PostHog's, and RevenueCat's agreements require processing on the customer's instructions, security measures and assistance with deletion requests, subject to legal obligations. They do not guarantee immediate deletion of all data.

Paddle is the merchant of record for website purchases. It acts as an independent controller of payment data. Its data sharing agreement describes Paddle's and Manor's responsibilities. Google and Apple sign-in providers apply their own terms. Cloudflare's role for Turnstile is explained above. These services do not all act only on Manor's instructions.

We require the providers that receive personal data from Manor to provide at least the same protection described in this policy. Their service terms and data protection agreements cover security, limits on data use, and handling deletion requests. Some providers also act independently for the purposes explained above, including payments and fraud prevention.

We share only the data these providers need to operate Manor. We do not share data for advertising and never sell personal information. We may disclose data if required by law or to protect the rights and safety of the service and its users.

Security

Data is sent over encrypted HTTPS connections. Sign-in secrets remain on the server, and local session material uses the device’s secure storage. No method is completely secure; we nevertheless take reasonable steps to protect your information.

Retention

We retain account data while your account exists, subject to the deletion and shared-budget rules below. We retain unpublished feedback for up to 12 months. We delete screenshots from rejected feedback within 30 days. Published feedback stays available until it is outdated, removed during moderation, or removed after a valid request. An in-app deletion receipt may remain for about 30 days, then expires during daily cleanup. Separately, Manor keeps only the former pseudonymous billing identifier, provider subscription identifiers, and deletion date for 30 days to block late payment events. Manor removes these identifiers during daily cleanup after that period. They contain no email address, expenses, transcripts, or payment details.

PostHog's free plan includes one year of event retention. It does not guarantee deletion immediately after that period. The public PostHog documentation describes this period. Retention is separate from stopping future collection. After account deletion, Manor asynchronously requests deletion of the PostHog person identified by the pseudonymous appUserId and associated events. Some aggregate or already de-identified information may no longer be linkable to the account.

Google, Apple, Paddle, RevenueCat, Convex, PostHog, Cloudflare, and Resend may retain some information under their own terms, security backups, and legal obligations. We do not promise to delete information those providers must retain independently of Manor.

Delete your account and data

To request deletion of feedback, its private email address, or its screenshots, email support@talktomanor.com. Include enough detail for us to find the submission. Feedback deletion is separate from Manor account deletion.

Before deleting your account, transfer ownership or delete any budget you own that still has other active members. Expenses in another person's shared budget can remain after you leave or delete your account. Manor removes your membership's account link and displays "Former member" instead of your name. Retained expenses may still contain the former account identifier, notes, and transcripts. Account deletion removes your uploaded audio. Leaving a budget alone does not delete its records.

Retained notes and transcripts may still contain personal information you entered. The "Former member" label does not make this content anonymous. These expenses remain until they are removed through the shared budget's controls.

Start account deletion in Manor whenever possible. If you cannot access the app, contact support or use the public request form. A form submission starts a manual support request; it does not immediately delete an account. We verify the request and explain the next steps. Use the exact account email shown in Manor, including an Apple relay address if applicable. Replying from a different personal address does not by itself verify that account.

During in-app account deletion, Manor attempts to revoke the linked Google or Apple authorization. If the provider cannot complete that step, further action may be needed. Deleting Manor data does not delete your Google or Apple account.

Data deletion

Your choices and requests

You can review your expenses in Manor, correct them according to your budget permissions, and export the data you can access. To request a copy, correction, or deletion of your data, contact support@talktomanor.com. We verify your identity before disclosing or changing account data. You can withdraw analytics or Gemini processing permission in Settings as described above. Our Data deletion page explains account deletion and the data that remains.

Children

Manor is intended only for adults aged 18 or older. If you believe a child has provided information, contact support@talktomanor.com.

Changes to this policy

We may update this policy as Manor evolves. When we do, we will change the effective date at the top of this page.

Privacy Policy | Manor