What manch stores, and why.

The short version

Manch is a canvas tool. We store the boards you draw, the workspace you create, and the email address you sign in with. That's it. We don't track you across the web, we don't sell data, and we don't train AI on your boards.

What we collect

• Account: your email address (from Google sign-in or magic-link) and a hashed session identifier.
• Boards: the canvas data you draw — shapes, arrows, text, images you upload — stored as JSON snapshots in our Postgres database.
• Workspace metadata: workspace name, board titles, member emails, share-link tokens (hashed).
• Operational logs: request logs (IP, path, status) retained for 7 days for debugging and abuse prevention. Not joined to your account beyond that window.

Where it lives

All data is stored on Eleven11's own infrastructure (Hetzner, Germany). We don't use Google Analytics, Facebook Pixel, or any third-party tracker. The only third parties that touch your data are Google (when you sign in via OAuth) and Cloudflare (DDoS protection / DNS).

Your control

• Export your boards as JSON or PNG any time from the editor.
• Delete a board → its snapshots and assets are removed.
• Delete your account → email [email protected] from your sign-in address. We remove your tenant rows + any workspaces you solely own within 7 days.
• Magic-link tokens are sha256-hashed at rest, expire in 15 minutes, and can be used only once.

Cookies

We set one cookie: manch_session — an HttpOnly, signed session identifier with a 12-hour lifetime. It tells our server you're signed in. We do not set marketing cookies.

Contact

Privacy questions: [email protected]. Manch is built by Eleven11 (Abhishek Srivastava, sole proprietor; Lucknow, India).