Sign in

Privacy policy

Draft, not legal advice: review before launch. This is a plain-English draft written for a small service. The owner must have it reviewed, fill in the operator's details and confirm every fact below before the site opens to the public.

Last updated: 25 October 2026.

Skill Manifest is run by its owner, called "we" below. Questions, requests and complaints about your data go to the contact address on this site.

What we collect

  • Your account. Your email address, your name and, if you use Continue with Google, the identifier Google gives us for your account (the Google "sub"). We never see your Google password. If your account was made by an administrator with a password, we store only a salted hash of it, never the password.
  • Your work. The projects you create, the files in them and their revisions, your conversations with the assistant, and your reading progress in the lessons.
  • Use and cost records. For each AI request: the model used, the time, how many tokens it used and what it cost. This is how your daily AI allowance is counted and how we find abuse.
  • Guests. If you are not signed in you have no account and we keep no profile of you. Your lesson progress stays in your own browser until you sign in, and then it is copied into your account.

Cookies, sessions and browser storage

  • One session cookie. When you sign in we set a cookie called acw_session. It keeps you signed in for 14 days, or until you sign out. It is HttpOnly (scripts on the page cannot read it), SameSite=Lax, and Secure on the public site.
  • A short sign-in cookie. While you are sent to Google and back we set acw_google for up to 10 minutes. It protects the sign-in against forgery and is deleted when you return.
  • Browser storage. Your own browser keeps your theme (light or dark), the width of the panes, your guest lesson progress and your picks in the catalog. These never leave your device until you sign in and progress is copied to your account.
  • No advertising or analytics cookies. We do not use advertising trackers or third-party analytics. If that changes, this page changes first.

IP addresses and logs

When you visit, the server sees your IP address and the pages you ask for. We use it to keep the site safe: to rate-limit sign-in attempts and new accounts, to slow down abuse, and to find faults. Requests are written to short-lived server access logs, and the rate limiters keep addresses in memory only until they expire or the server restarts. Cloudflare, which sits in front of the site, also sees your IP address (see below). We do not use IP addresses to profile you or to sell anything.

Who handles your data for us

We use these services. Each one only gets what it needs to do its job.

  • Cloudflare (tunnel and content delivery). Your requests to this site pass through Cloudflare's network, which sees your IP address and the content of the requests it forwards, because it ends the secure connection for us.
  • Hetzner (hosting). The site runs on a Hetzner server in Germany or elsewhere in the EU. Your account, projects, conversations and backups are stored there.
  • Google (sign-in). If you choose Continue with Google, Google tells us your email address, your name and your account identifier. Google's own privacy policy covers what Google does on its side.
  • The AI gateway (the Houshyar 24 AI gateway). When you ask the assistant something, your question, the conversation so far and the project files it needs are sent to the gateway, which passes them on to the AI model provider that answers. Providers may process this data outside the EU. Do not put secrets, passwords or other people's personal data into your projects or questions.
  • WaterCrawl (web search). When the assistant searches the web, the search words it chose are sent to WaterCrawl, which returns pages. Your account details are not sent.

We do not sell your data, and we do not give it to anyone else except where the law requires it.

Why we use your data

  • To run your account and show you your work: you asked for the service, so this is the basis for it.
  • To keep the service secure and fair (rate limits, daily allowance, abuse checks): our legitimate interest in protecting it.
  • To answer your messages: your request.

We do not make decisions about you by automated means beyond the daily AI allowance, which applies to everyone in the same way.

How long we keep it

  • Your account and work: until you ask us to delete them, or until we close an unused account.
  • Sessions: 14 days after you sign in. They end earlier when you sign out.
  • Use and cost records: as long as your account exists, so the allowance and any cost questions can be answered. They are deleted with your account.
  • Access logs: only briefly, until the server's rolling logs are overwritten.
  • Backups: a nightly backup of the whole database is kept for a limited time (about two weeks) and then deleted. A deleted account can remain in older backups until they expire.

Your choices and rights

  • Download your work at any time as Markdown or a ZIP from your project.
  • Ask us to delete your account and everything in it, or to correct or give you a copy of your data, by writing to the contact address on this site. We will answer within one month.
  • Object or complain. You can object to how we use your data, and you can complain to your data protection authority.
  • Stop sharing with Google. You can remove this site's access in your Google account settings.

Children

Skill Manifest is not meant for children under 16, and we do not knowingly collect their data. If you think a child has made an account, write to us and we will delete it.

Changes

We will change this page when what we do changes, and update the date at the top. If a change matters to you, such as a new service handling your data, we will say so on the site before it takes effect.

Contact

Write to the contact address on this site.