Draft — last updated 27 September 2026. This page is pending legal review before launch.
This policy covers speakmano.com ("Mano"). Mano is operated by [legal entity name, registered address, country]. For any privacy question or request, contact [privacy@speakmano.com].
Mano has no user accounts. Everyone browsing, rating, or adding a place is anonymous — the sections below explain the small amount of data that still needs to be collected to make that work and to keep the ratings honest.
On your first visit, we set a cookie (mano_device) containing a randomly generated ID, the time it was created, and a signature that stops it being forged — not your name, email, or anything else about you. It’s how a rating or an added place gets tied to "the device that made it" so we can show you your own pending places, stop the same device rating a place twice in 24 hours, and let you delete your own contributions on request.
This cookie is httpOnly (invisible to page scripts) and lasts up to 400 days, after which your browser gets a new one. It’s strictly necessary for the site to function — there’s no way to browse or rate without it — which is why it’s set automatically rather than behind a cookie-consent banner.
When you submit a rating (including the first rating that comes with a place you add) or a report, we combine your IP address with a secret key, hash the result, and store only that hash with it. For an IPv6 address we use only its network part, since one connection usually has many addresses. The IP address itself is never stored. The hash is used only to cap abuse: at most 30 ratings and 20 reports per network per day, in addition to the per-device caps. Looking up a place to add records the hash briefly too, to cap how many lookups one network can make. We don’t use it to identify you, track you across visits, or for any purpose beyond those limits, and every hash is deleted after 48 hours.
On your first rating, you can optionally give a first name or nickname to show on your reviews (e.g. "Sofia, Beginner"), plus the language level you pick for yourself. Both are entirely optional, saved only in your browser’s local storage (never sent to us until you submit a rating), and reused on later ratings from the same device so you don’t have to re-enter them. If you leave the name blank, your reviews show with no name at all.
The map, place search, and address autocomplete on Mano are provided by Google Maps Platform. Loading them means your browser talks directly to Google, which processes data such as your IP address and device information under Google’s own privacy policy. We don’t control what Google collects through the map itself — only what we separately store, as described above.
Every public write (a rating, an added place, a report) is checked by Cloudflare Turnstile, an invisible bot-detection challenge, before it’s accepted. Cloudflare processes some device and browser signals to make that check under Cloudflare’s privacy policy.
We use Vercel Web Analytics to see aggregate numbers like page views and which cities and languages are popular. It doesn’t use cookies. To count unique visitors, it works out a temporary code from your request that is thrown away after 24 hours, so the page views it records aren’t tied to you or your IP address and can’t be used to follow you across sites. For each page view it keeps the page address, the site you came from, your approximate location (country, region and city), and your browser, operating system and device type. It doesn’t count admin pages or sign-in links. Because it’s cookieless and anonymous, no cookie banner is needed for it.
Under GDPR and the ePrivacy rules, cookies and similar technologies that are strictly necessary for a service you’ve asked for don’t require consent — only a clear explanation, which is what this page is. The device cookie is necessary for Mano to function at all (there are no accounts to fall back on); the hashed IP and display name are collected only as part of an action you take (submitting a rating); and our analytics are cookieless and anonymous. We don’t use any advertising or cross-site-tracking cookies.
We don’t sell data or share it for advertising. Data passes through the infrastructure providers that run the service: Supabase (our database), Vercel (our hosting and analytics), Google (maps and address search), Cloudflare (bot protection), and [Resend, for admin sign-in emails only — never for visitor data]. Each processes data only as needed to provide their service to us, under their own security and privacy commitments. [Confirm each provider’s data-processing agreement and hosting region before launch.]
Ratings and places stay live as part of the public record of what other learners experienced, unless removed by our moderation team or by you. The device ID tied to a rating is kept for as long as that rating exists; the hashed IP is deleted 48 hours after the rating or report was submitted. If a rating or place is removed, its data isn’t used for anything further.
Under GDPR you can ask to access, correct, or delete data tied to your device, or object to how it’s used. Since Mano doesn’t have accounts or emails tied to visitors, the practical way to do this is to contact us at [privacy@speakmano.com] — tell us roughly what you rated or added, where, and when, and we can find it and act on it. You can also lodge a complaint with your local data protection authority [— in the Netherlands, the Autoriteit Persoonsgegevens].
Mano isn’t directed at children, and we don’t knowingly collect data from anyone under 16.
If this policy changes in a material way, we’ll update the date at the top of this page. Continued use of Mano after a change means you accept the updated policy.