Draft — last updated [date]. This page is pending legal review before launch.
This policy covers speakmano.com ("Mano"). Mano is operated by [legal entity name, registered address, country]. For any privacy question or request, contact [privacy@speakmano.com].
Mano has no user accounts. Everyone browsing, rating, or adding a place is anonymous — the sections below explain the small amount of data that still needs to be collected to make that work and to keep the ratings honest.
On your first visit, we set a cookie (mano_device) containing a randomly generated ID — not your name, email, or anything else about you. It's how a rating or an added place gets tied to "the device that made it" so we can show you your own pending places, stop the same device rating a place twice in 24 hours, and let you delete your own contributions on request.
This cookie is httpOnly (invisible to page scripts) and lasts up to 2 years. It's strictly necessary for the site to function — there's no way to browse or rate without it — which is why it's set automatically rather than behind a cookie-consent banner.
When you submit a rating or add a place, we hash your IP address (a one-way transformation — we can't recover the original address from it) and store that hash alongside the submission. It's used only to cap abuse: at most 30 ratings per IP address per day, in addition to the per-device cap. We don't use it to identify you, track you across visits, or for any purpose beyond that rate limit.
On your first rating, you can optionally give a first name or nickname to show on your reviews (e.g. "Sofia, Beginner"), plus the language level you pick for yourself. Both are entirely optional, saved only in your browser's local storage (never sent to us until you submit a rating), and reused on later ratings from the same device so you don't have to re-enter them. If you leave the name blank, your reviews show with no name at all.
The map, place search, and address autocomplete on Mano are provided by Google Maps Platform. Loading them means your browser talks directly to Google, which processes data such as your IP address and device information under Google's own privacy policy. We don't control what Google collects through the map itself — only what we separately store, as described above.
Every public write (a rating, an added place, a report) is checked by Cloudflare Turnstile, an invisible bot-detection challenge, before it's accepted. Cloudflare processes some device and browser signals to make that check under Cloudflare's privacy policy.
We use [Plausible / PostHog] in its cookieless mode to see aggregate numbers like page views and which cities and languages are popular. It doesn't use cookies, doesn't collect or store your IP address, and can't identify you individually or across sites — which is also why no cookie banner is needed for it.
Under GDPR and the ePrivacy rules, cookies and similar technologies that are strictly necessary for a service you've asked for don't require consent — only a clear explanation, which is what this page is. The device cookie is necessary for Mano to function at all (there are no accounts to fall back on); the hashed IP and display name are collected only as part of an action you take (submitting a rating); and our analytics are cookieless and anonymous. We don't use any advertising or cross-site-tracking cookies.
We don't sell data or share it for advertising. Data passes through the infrastructure providers that run the service: Supabase (our database), Vercel (our hosting), Google (maps and address search), Cloudflare (bot protection), and [Resend, for admin sign-in emails only — never for visitor data]. Each processes data only as needed to provide their service to us, under their own security and privacy commitments. [Confirm each provider's data-processing agreement and hosting region before launch.]
Ratings and places stay live as part of the public record of what other learners experienced, unless removed by our moderation team or by you. The device cookie and hashed IP tied to a rating are retained for as long as that rating exists. If a rating or place is removed, its data isn't used for anything further.
Under GDPR you can ask to access, correct, or delete data tied to your device, or object to how it's used. Since Mano doesn't have accounts or emails tied to visitors, the practical way to do this is to contact us at [privacy@speakmano.com] — if you can tell us roughly what you rated and when (or share your device cookie value), we can locate and act on it. You can also lodge a complaint with your local data protection authority [— in the Netherlands, the Autoriteit Persoonsgegevens].
Mano isn't directed at children, and we don't knowingly collect data from anyone under 16.
If this policy changes in a material way, we'll update the date at the top of this page. Continued use of Mano after a change means you accept the updated policy.