Privacy Policy
Last updated: July 30, 2026
Mani ("we", "us", "the app") is a mobile app that pairs NFC-enabled nail tags to shareable public profiles. This policy explains what we collect and why. Mani is published by Melissa Loera. For questions, email [email protected].
1. What we collect
| Data | Purpose | Stored? |
|---|---|---|
| Email address | Magic-link login, account recovery | Yes, on our hosted database |
| Display handle and profile content you enter (name, bio, links, avatar) | Shown on your public profile | Yes |
| Tag IDs you pair | Links a physical NFC tag to your account | Yes |
| Device NFC reads | In-app pairing; the raw tag payload is processed locally | No, not stored server-side |
| Tap events on your tags (timestamp, hashed IP, user agent) | The tap counts you see in the app | Yes — the IP is SHA-256 hashed before storage, never kept raw |
We do not collect precise location, contacts, photo
library contents, or biometric data. The app requests the Android
NFC permission solely to read and write NFC tags you
physically tap.
2. How we use data
- To authenticate you via a one-time magic link emailed to your address.
- To render your public profile when someone taps your nail tag, or visits
mani.pink/u/<your-handle>. - To send transactional email (login link, security notices). We do not send marketing email without separate opt-in.
- To prevent abuse and fraud.
3. Sharing
We do not sell your data. We share the minimum necessary with these processors:
- Resend — delivery of magic-link email
- Neon — Postgres database hosting
- Railway — API and web hosting
- Google Play — distribution of the app itself
Your public profile content is, by design, visible to anyone who taps your tag or visits your profile URL. Do not put anything on your profile you would not share publicly.
4. Data retention
- Account data is kept until you delete your account, which you can do at any time at mani.pink/delete-account or from inside the app. Deletion is immediate and permanent.
- Inactive accounts (no login for 24 months) may be auto-purged.
- Tag pairings remain until you unpair or delete the tag.
5. Your rights
You can delete your account yourself, right now, at mani.pink/delete-account. It signs you in by email and then permanently removes your profile, your links, your nails and their tap history, the images you uploaded, and your email address. There is no waiting period and no recovery — we cannot undo it. The same button lives in the app under Settings.
Email [email protected] to export your data, correct it, or opt out of analytics. We respond within 30 days.
6. Security
- Magic links are single-use, expire within 15 minutes, and are sent only to the email address on file.
- All API traffic is HTTPS in production.
- Database credentials are scoped and rotated.
7. Children
Mani is not directed to children under 13. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.
8. Changes
We will update this policy as the app evolves. Material changes will be noted at the top of this document and, where significant, emailed to you.