Privacy Policy
Summary
- manseru stores your account, calendar, tasks, actual time, messages, comments and files on Cloudflare infrastructure to run the app.
- Only after you agree, and only when you message Kaito or import a spreadsheet, is the relevant data sent to the AI provider (Cloudflare Workers AI) to answer.
- No ads, no tracking tools, no selling data, no location collected.
- Delete your account in the app: Settings → Delete account.
1. Who is responsible
manseru is a calendar, task, Gantt and messaging app with an AI assistant, Kaito, running on iPhone and on the web at manseru.com. manseru is built and operated by DBR (DBR Group, “we”). DBR is an independent developer and has not yet registered a separate legal entity. DBR is the controller and processor of your personal data in manseru.
This policy follows Vietnam’s Personal Data Protection Law No. 91/2025/QH15 and Decree 356/2025/ND-CP, and Apple App Store rules.
2. Data we collect
| Category | Details | Purpose |
|---|---|---|
| Account | Name, email, password (stored only as a salted PBKDF2 hash), language, time zone, sign-up date. | Sign-in; showing the right time and language. |
| Calendar and tasks | Events, timeboxes, day templates, tasks and sub-tasks, checklists, milestones, notes, due dates, people involved, company, categories, planned time and actual time (check-ins / check-outs). | Running Calendar, Timeline (Gantt) and Tasks. |
| Collaboration | Messages with other users, comments on tasks, files you send (up to 10 MB each), category / calendar shares. | Delivering them to the people you choose. |
| Kaito chat | Messages you send Kaito, its replies, action cards (done / confirmed / cancelled / undone) and when you agreed to the use of AI. | Answering and carrying out your scheduling requests. |
| Blocking and reports | The people you block; what you report (the message or user reported and the reason). | Protecting you from abuse and handling violations. |
| Notifications | In-app notifications (reminders, comments, messages, shares); a device token for push notifications if that feature is enabled. | Reminding you at the right time. |
| Connections you turn on | Google Calendar: access token issued by Google (AES-GCM encrypted). Apple Calendar: reads / writes a “manseru” calendar on your iPhone. Never Late: signs in to your Never Late account to read your own clock-ins. Google Sheets: the spreadsheet you attach. | Syncing and importing at your request. |
We do not collect location, contacts or advertising IDs, and we use no behavioural analytics or advertising tools.
3. Where data is stored and who processes it
| Party | What they do | When |
|---|---|---|
| Cloudflare, Inc. | Runs the web server and API and stores all data in section 2 (Cloudflare Workers, Durable Objects). May process data outside Vietnam. | Always. |
| AI model provider: Cloudflare Workers AI (Cloudflare, Inc., USA) | Generates Kaito’s replies from your message and the related calendar, tasks and categories; when you import a spreadsheet, reads the column names and a few sample rows to map the columns. Used only to answer you, never for advertising. | Only after you agree, and only when you message Kaito or import a spreadsheet. Withdraw consent in Settings. |
| Google Calendar sync, reading Google Sheets. | Only if you connect it or send a spreadsheet link. | |
| Apple | Distributes the iPhone app through the App Store; Apple Calendar on your device. | When you use the iPhone app. |
| Never Late (Supabase) | Returns your own clock-in times, read-only. | Only if you connect Never Late. |
Data may be transferred abroad for these parties to process. We share only what each task needs and never sell data to anyone.
4. What other people see
People you message see the messages and files you send. People you share a category or calendar with see (and, with edit rights, can change) the tasks in that share, with comments. Others can find you only if they know your exact email.
5. How long we keep data
Data is kept until you delete it or delete your account. Sign-in sessions expire after 180 days. Technical backups at the infrastructure provider expire within 30 days.
6. Deleting your account
Open Settings, scroll to the bottom and choose “Delete account”. We revoke the Google connection and immediately delete your account, sessions, calendar, timeboxes, tasks, actual time, categories, day templates, notifications, Kaito chat and action cards, the messages and comments you sent, the files you uploaded, all shares and any conversations left with no one in them. Cloudflare’s technical backups expire within 30 days.
7. Your rights
- View and edit your data in the app.
- Delete data or your account (section 6).
- Get a copy: there is no export button yet, so email us.
- Withdraw consent for connections (Google, Never Late) and for the use of AI (Kaito) in Settings at any time.
- Complain to the competent personal data protection authority.
We reply within 30 days.
8. Security
Connections are always HTTPS. Passwords are hashed with salted PBKDF2-SHA256; sign-in tokens are stored only as hashes; Google tokens are AES-GCM encrypted. No system is perfectly secure; if an incident affects you, we will notify you as the law requires.
9. Age
manseru is not intended for anyone under 16. If you know someone under 16 has an account, tell us and we will delete it.
10. Changes
If this policy changes materially, we update the date at the top and mention it in the app’s “What’s new”.
11. Contact
DBR · Email: contact@dbr.business. See also the Terms of Use.