Privacy

What we hold

Your knowledge: the memories and records your organization writes, the evidence they cite, and who wrote each one.

Your identity: the name, the email address and the organization your sign-in provider tells us. Sign-in is handled by Clerk; we never see your password.

How the service ran: which requests were made, by which agent, and whether they were allowed. This is what makes it possible to answer "who read that".

Where it is

In Amazon Web Services in Ireland, in one region, encrypted at rest and in transit. It is not copied to another region.

The people who run the service can reach the store to operate it. Nobody reads your knowledge to look at it.

Who else sees it

Clerk, for signing in and for the subscription. Stripe, for the card payment that Clerk Billing takes. Amazon Web Services, for running and storing. Amazon Bedrock, for the model that answers and the model that builds the search index, as the next section says. Vercel, for serving these pages. TypeSafe, for the answer check and the order of search results, as the next section says.

We use Vercel Analytics on the public pages and on the application. An address inside the application is redacted before it is sent: the question you typed and the key you opened never leave. Only the shape of the page does. When you click the call at the end of a guide, Vercel Analytics records the click with the guide and the address of the call, and an address inside the application is redacted in the same way.

No one else, and no advertiser.

Agents and models

When you ask the store a question, the evidence it selected is sent to the model that answers. That model is named in Settings. It is not trained on what you send.

Amazon Bedrock runs that model, in AWS regions in the European Union. For an answer or a summary, it receives the question and the evidence that the store selected. To build the search index, it receives the text of each record that is not labelled confidential or restricted, and it receives each question that you search for.

Where the service checks answers, TypeSafe does the check. For a search, a retrieval, and the evidence lookup of an answer, TypeSafe receives the question and, for each of the first 20 results, its title, the first 600 characters of its passage, its kind and its memory key. To check an answer or a summary, it receives the question, the answer, and the passages that the answer cites.

A record labelled confidential or restricted is never sent to TypeSafe. When an answer or a summary is written from one, none of it is sent, and the result says that it was not checked in full. Mana adds no name, email address or organization to what it sends.

TypeSafe does not decide who reads what. It only puts in order the results you may already read, and says whether the evidence supports the answer.

An agent connected to your store reads only what its grant allows, and every one of its reads is checked before anything is retrieved.

How long

Your knowledge stays until you delete it. A deleted memory and its earlier versions are erased after thirty days, or at once when an owner chooses Erase now. Backups keep them for up to fourteen more days. The ledger keeps the memory key and the fact of a correction or a deletion, not the text; its older entries can also hold the reason.

The record of each search, with the question asked, and the service logs are kept for thirty days. Other operational records of how the service ran are kept for as long as they are useful to run it, and they hold identifiers rather than your knowledge.

What you can ask for

A copy of everything: Settings, Your data. Deletion: the same place, or any memory from its own page.

Anything else, including a question about how your data is handled, goes to the address on the support page, and we answer.