1. Introduction

This Privacy Policy describes how ScottyMade, LLC ("we," "us," or "our") collects, uses, and shares information in connection with your use of Mana (the "Service"), our websites, and any related services.

Mana is a token optimization service that operates as an MCP (Model Context Protocol) server. The Service intercepts tool outputs from AI coding assistants, routes them through lightweight language models for filtering, and returns optimized results. Mana acts as a filtering and processing layer—not an AI provider.

By using the Service, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use the Service.

2. How Mana Works: Understanding Our Data Flow

To understand what data we collect, it helps to understand how Mana processes information:

Tool outputs (file reads, bash command results, directory listings) from Claude pass through Mana
Mana routes these outputs to filtering models via OpenRouter
The filtered, optimized result is returned to Claude
Your prompts and Claude's code responses are never intercepted or processed by Mana

This architecture means content flows through Mana but is not stored in our systems. We collect only operational metadata necessary to provide, bill for, and improve the Service.

3. Information We Do NOT Collect

We want to be explicitly clear about what we do not collect or store:

Your prompts to Claude — Never intercepted
Claude's code responses — Never intercepted
Tool output content — Processed in transit only, never stored
File contents — Passes through, not retained
Code or source files — Passes through, not retained
Filtered/optimized output content — Returned to you, not stored

The actual content of your AI interactions remains between you, Claude, and the upstream AI providers. Mana processes content in transit solely to apply filtering—similar to how a network firewall inspects traffic without retaining it.

4. Information We DO Collect

4.1 Account Information

When you create an account, we collect:

Email address (via Clerk authentication)
Name (if provided)
Account preferences and settings

4.2 Usage and Operational Data

For each optimization request, we collect metadata including:

User ID and API key ID (not the actual API key—only hashed values and prefixes)
Tool name (e.g., "read_optimized," "bash_optimized")
Action type (e.g., "EXTRACT," "SUMMARIZE")
Token counts (input tokens, output tokens, tokens saved)
Model used for filtering
Cost in USD
Processing duration (in milliseconds)
Input character count
Timestamp

This metadata does not include the content of your prompts, responses, or filtered outputs—only information about the request itself.

4.3 Billing and Subscription Information

We collect information related to your subscription:

Subscription plan and status
Payment events and billing history
Trial dates
Lemon Squeezy customer and subscription IDs

Your actual payment card information is collected and processed directly by Lemon Squeezy, our payment processor. We do not store credit card numbers, CVVs, or other sensitive payment details.

4.4 Waitlist Information

If you join our waitlist, we collect:

Email address
Full name
Referral codes (if applicable)
Newsletter opt-in preference

4.5 Technical and Log Data

For security, debugging, and service improvement, we collect:

IP addresses
User agent strings
Error messages and error metadata
HTTP status codes
Audit logs for sensitive operations

5. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Process payments and manage subscriptions
Calculate usage and enforce plan limits
Send transactional emails (receipts, alerts)
Respond to support requests
Detect and prevent fraud or abuse
Debug errors and improve reliability
Analyze usage patterns to improve the Service
Send marketing communications (with consent)
Comply with legal obligations

6. How We Share Your Information

We share your information only in the following circumstances:

6.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

Clerk — Authentication and user management
Supabase — Database hosting
OpenRouter — LLM API routing (content transiently processed)
Lemon Squeezy — Payment processing
Resend — Transactional email
Upstash — Rate limiting and caching
PostHog and Google Analytics — Optional website analytics, with your consent

6.2 Upstream AI Providers

When you use Mana, filtered content is processed through OpenRouter and ultimately by the AI providers they route to (such as DeepSeek, Qwen, or Gemma). We do not control, and are not responsible for, how these providers handle your data, including whether they use it for model training.

6.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process.

6.4 Business Transfers

If ScottyMade, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information.

7. Data Retention

Usage logs — 90 days
Error and debug logs — 30 days
Account data — Duration of active account + 30 days after deletion
Billing records — As required by tax and accounting regulations (typically 7 years)
Support correspondence — 2 years or until resolved
Waitlist data — Until you subscribe or request deletion

8. Website Analytics & Cookies

8.1 Essential Cookies

We use essential cookies that are strictly necessary for our website to function. These cannot be disabled.

8.2 Analytics Cookies (Optional)

With your consent, we use PostHog and Google Analyticsto understand how visitors use our website. Analytics cookies help us measure page views, navigation patterns, referral sources, and feature usage so we can improve your experience.

Analytics data collected includes:

Pages visited and navigation path
Interactions with site features (e.g., calculator, FAQ)
Referring website or campaign
Browser type, screen size, and general location (country level)

Analytics data does not include:

Your name, email, or any personal contact information
Keystrokes, form inputs, or passwords
Session recordings or screen captures

8.3 Managing Your Cookie Preferences

When you first visit our site, a cookie consent banner lets you accept or decline analytics cookies. You can change your preference at any time using the "Cookie Preferences" link in our website footer. Declining analytics cookies does not affect your ability to use the site.

8.4 Data Retention for Analytics

Analytics data is retained for up to 12 months and is used solely to improve our website. We do not sell, share, or use analytics data for advertising purposes.

9. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

Encryption in transit (TLS/HTTPS for all connections)
Encryption at rest for stored data
API key hashing (we never store raw API keys)
Access controls limiting employee access to data
Audit logging for sensitive operations
Regular security reviews

10. International Data Transfers

Mana is operated from the United States. If you are located outside the United States, your information will be transferred to, stored, and processed in the United States.

11. Your Privacy Rights

Regardless of where you are located, you may:

Access the personal information we hold about you
Correct inaccurate or incomplete information
Delete your account and associated data
Export your data in a portable format
Opt out of marketing communications

To exercise these rights, contact us at [email protected].

Additional Rights for EEA, UK, and Swiss Residents (GDPR)

You have additional rights under GDPR including the right to erasure, restriction, data portability, and to lodge a complaint with your local data protection authority.

Additional Rights for California Residents (CCPA/CPRA)

California residents have rights to know, delete, correct, and opt-out of sale. We do not sell your personal information. To submit a request, email [email protected] with "California Privacy Request" in the subject line.

12. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal information from children under 16.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy and sending you an email notification.

14. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

ScottyMade, LLC
Email: [email protected]

Summary of Key Points

We do NOT store your prompts, Claude's responses, code, file contents, or filtered output content
We DO store usage metadata (token counts, costs, timestamps), account data, and billing information
Content flows through Mana for filtering but is not retained
You have rights to access, correct, delete, and export your data
We do not sell your personal information
Questions? Contact [email protected]