Privacy

Draft in plain language, not legal advice. The operator of this server must review it before launch.

Short version: your learning data is yours. This page lists what ManySpace stores, who else touches a page load, and how to take your data or delete it.

Account

Email address, optional display name, and either a password hash (Argon2id) or your Google account identifier. Passwords are never stored or logged in readable form.

Learning data

Study, practice and review sessions, notes, mistakes, goals, lesson progress and your settings. On a local install they live in a SQLite file on your own machine and nowhere else.

Sign-in security

Trusted devices (a label such as “Chrome, Linux”, a network hint of the first three IPv4 groups, and dates) and a short log of sign-in events, so you can review and revoke devices in Settings.

Cookies and storage

First-party only: a session cookie, an optional “keep me signed in” cookie, a trusted-device cookie, and a language cookie. Your theme choice is kept in browser storage. There are no advertising or analytics cookies.

Other companies on a page load

Fonts come from Google Fonts and pinned open-source libraries from jsDelivr, so those providers see your IP address and browser when a page loads. Google sees your sign-in only if you choose Google. Payments are handled entirely by Gumroad; ManySpace never sees card numbers. Verification emails go through the mail provider the operator configures.

Payments

We keep the purchase status, Gumroad identifiers, the purchase email and, if you activate one, your license key (encrypted) so access can be re-verified.

Your controls

Export everything as JSON and delete your account from Settings. Deleting removes your learning data, devices and sign-in records. Server backups made earlier may keep a copy until they rotate out.