Legal

Privacy Policy

Effective March 26, 2026

ManaWell is built with privacy as a core design principle, not an afterthought. Recipients' identities, addresses, and circumstances are handled with care. This policy explains what data we collect, how we use it, and your rights.

1. Information We Collect

We collect only what is necessary to operate the platform:

  • ›Account information: Email address, hashed password, role (donor or recipient), and account creation timestamp.
  • ›Recipient profile: Alias (never your real name), bio, hardship notes, support letters, and profile visibility preference. All set by you.
  • ›Shipping address: Encrypted with AES-256-GCM before storage. The decrypted address is only used at checkout to route fulfillment; it is never exposed to donors or third parties outside of the fulfillment provider.
  • ›Vitals List items: Product URLs, titles, images, and prices you add to your list.
  • ›Payment data: We do not store payment card data. Payments are processed by Rye, our third-party checkout provider. See Rye’s privacy policy for how they handle payment information.
  • ›Usage data: Anonymous event data (page views, feature interactions) collected via PostHog for product analytics. IP addresses are not stored; data is not sold.
  • ›Audit logs: Administrative actions are logged for security and accountability purposes.

2. How We Use Your Information

We use the information we collect to:

  • ›Operate and maintain the platform
  • ›Process and route fulfillments to recipients
  • ›Send transactional emails (order status, thank you messages, password resets)
  • ›Detect and prevent fraud or abuse
  • ›Understand how the platform is used so we can improve it

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in this policy.

3. Shipping Address Encryption

Recipient shipping addresses are encrypted using AES-256-GCM with a server-held key before they are written to the database. The encrypted value is decrypted only when needed to route a fulfillment. Donors never see any part of a recipient's address. Database administrators cannot read addresses without access to the encryption key.

4. Third-Party Services

ManaWell relies on the following third-party providers. Each has its own privacy policy and data handling practices:

  • ›Rye: Payment processing and checkout. Rye handles payment card data. See rye.com for their privacy policy.
  • ›Resend: Transactional email delivery (order confirmations, password resets, thank you messages). Email content is routed through Resend but is not stored beyond delivery.
  • ›PostHog: Product analytics. We use PostHog in a privacy-preserving configuration: no cross-site tracking, no ad targeting, and no PII is intentionally sent to PostHog.

5. Cookies and Sessions

ManaWell uses a single HTTP-only session cookie (`manawell_session`) to keep you logged in. This cookie is not used for tracking. We do not use third-party advertising cookies. PostHog may set an analytics cookie; you can opt out through your browser settings.

6. Data Retention

Account data is retained for as long as your account is active. If you request account deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal or operational reasons (such as transaction records). Anonymous analytics data may be retained indefinitely.

7. Your Rights

Depending on where you are located, you may have the right to:

  • ›Access the personal data we hold about you
  • ›Correct inaccurate data
  • ›Request deletion of your data
  • ›Object to or restrict processing of your data
  • ›Receive a copy of your data in a portable format

To exercise any of these rights, email support@manawell.org. We will respond within 30 days.

8. Children

ManaWell is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Security

We implement industry-standard security measures including HTTPS, encrypted session cookies, AES-256-GCM address encryption, bcrypt password hashing, and rate limiting on sensitive endpoints. No system is perfectly secure; if you discover a vulnerability, please report it to support@manawell.org.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For significant changes, we will notify registered users by email. Continued use of ManaWell after changes are posted constitutes your acceptance of the revised policy.

11. Contact

Privacy questions or concerns? Contact us at support@manawell.org.