Privacy, in plain words

ManyCP uses PostHog to measure how the site is used, so I can find what is broken and what people skip. PostHog is our processor: it handles this data for us, under a data processing agreement, and does not use it for its own purposes. It is provided by PostHog Inc. and the data is stored in the United States. Your browser talks to ManyCP's own address for this (e.manycp.com), which passes it on to PostHog.

What is measured. The pages you view (the address without its query string, apart from the campaign tags of a link such as utm_source, and with account ids removed), clicks on links and buttons (which element, never its text), errors in your browser, how fast pages load, and your country and city. Passwords, email addresses, your name, API keys and tokens are never recorded: they are masked or blocked before anything leaves your browser. A link that leaves ManyCP (a pull request, an email link) is recorded without its address: the name of the site at most.

Your IP address. Your browser's request carries your IP address, and ManyCP passes it on so PostHog can work out your country and city. PostHog is set to discard the address once it has done that: it does not keep it with your events or your recordings. It is not used for anything else.

Session recordings. PostHog records a replay of how pages look and move, including the page's text and what you type into ordinary boxes such as a repo address or your listing, so I can see where people get stuck. Email addresses, your name and GitHub username, passwords, phone numbers, API keys, tokens, environment variables and install configs are replaced with placeholder characters in your browser before anything is sent. Images, hidden fields, password fields and anything marked private are not recorded at all. The owner's admin pages are never recorded.

If you are signed in, this activity is linked to your account by an internal id and your plan. It is not linked to your email address or your name.

Your choice. If you are in the EU, the EEA, the United Kingdom or Switzerland, or I cannot tell where you are, nothing is measured until you press "Sounds good". Everywhere else measuring starts when you arrive and you can turn it off at any time, below. If your browser sends Do Not Track or Global Privacy Control, analytics stay off unless you turn them on. You can change your mind at any time and it takes effect at once. Your yes also covers the Google ads tracking described below, except while your browser sends Do Not Track or Global Privacy Control. If you are in the EU, the EEA, the United Kingdom or Switzerland, or I cannot tell where you are, and said yes before this page mentioned Google ads, that yes does not cover it. The banner will ask you again, or you can turn analytics off and on here to say yes to both.

What is stored in your browser. While analytics are on:

• –PostHog keeps a random identifier in your browser's local storage and in two first-party cookies (named like ph_phc_…_posthog and ph_phc_…_posthog_cpm). They also hold the address of the first page you visited and the site you came from, with sign-in tokens and other sensitive parts of the address masked.
• –PostHog keeps a session id and a window id in your browser's session storage (ph_phc_… keys), which goes when you close the tab.
• –While you are signed in, mcp_analytics_identified in local storage holds your internal user id and plan, so a sign-out that reloads the page still resets the identifier.
• –mcp_analytics_auth_attempt in local storage holds the sign-in method and the time, for at most 30 minutes around a sign-in, so the page you land on can count the sign-in.

Your choice is kept in local storage too (mcp_analytics_consent). So is a note that your yes came after this page mentioned Google ads (mcp_analytics_ads_notice). Turning analytics off deletes all of the above except your choice, so I do not ask you again.

If you arrived from a Google ad, local storage also holds mcp_ad_click_sent. It has no click id in it. It only says that a click may be saved, so that ManyCP can delete it again if you turn analytics off. It is removed once the deletion is confirmed. When you turn analytics off, mcp_ad_click_withdrawn stays in local storage until a click saved against your account has been deleted too. That needs you to be signed in, so if you turn analytics off while signed out, it stays until you next sign in. It has no click id in it either.

How long. PostHog keeps session recordings for 30 days and events (page views, clicks, errors, speed) for 12 months, and then deletes them. To have what is recorded about you deleted sooner, email hello@manycp.com.

I advertise ManyCP on Google Search. A link from one of those ads carries a click id from Google (named gclid, gbraid or wbraid) and campaign tags (utm_source and the like). This is how I learn whether an ad brought a signup or a purchase, so I can stop paying for the ones that did not.

What happens. If you arrive from a Google ad and analytics are on for you, ManyCP keeps that click id, the time and the campaign tags in one first-party cookie, mcp_ad_click, for up to 90 days. The next time you are signed in, ManyCP saves them against your account and deletes the cookie. If you then sign up, or later buy something, ManyCP tells Google Ads that the click led to it: the click id, the name of the conversion ("ManyCP signup" or "ManyCP purchase"), the time and, for a purchase, the amount and currency. That is all Google Ads receives. Google Ads does not receive your name, your email address, your account id or anything you typed, and I do not ask Google for anything about you in return. Google can connect what it receives to the ad click it already knows about.

What does not happen. No Google tag or any other advertising script runs on ManyCP. Google and other ad companies set no cookies here. The one cookie for ads, mcp_ad_click, is ManyCP's own, and it is used only to report ad conversions. ManyCP does not use this to show you ads, to follow you to other sites or to build a profile. Google uses the conversions it receives to measure and tune my ads. Google Ads fetches the list of conversions from ManyCP over HTTPS, with a password, on a schedule, so your browser never talks to Google for this. The click id never goes to PostHog.

When it stays off. If you are in the EU, the EEA, the United Kingdom or Switzerland, or I cannot tell where you are, nothing is kept until you press "Sounds good". A yes from before this page mentioned Google ads does not count. If your browser sends Global Privacy Control or Do Not Track, nothing is kept, even if you switched analytics on. If your browser starts sending either signal later, what is saved against your account is deleted the next time you are signed in on this browser. If you did not arrive from a Google ad, there is nothing to keep.

Taking it back. Turning analytics off (the buttons above) deletes the cookie and, if you are signed in, the click id and the conversions that are still saved against your account. It cannot recall what Google Ads already received. Otherwise I keep the click and its conversions with your account until you turn analytics off or delete your account. The list Google fetches shows only the conversions of the last 60 days. To have them removed sooner, email hello@manycp.com.

The ManyCP extension for Chrome stores a connection token on your device and sends it only to manycp.com, so ManyCP can show your servers and directories and record the ones you submitted. It receives your account email and your listing details from manycp.com and types them, including the contact email, into the directory form you have open, only when you press Start run, Next, Fill form or Fill this page. You decide whether to submit: it never presses a Submit, Publish or Pay button, never solves a captcha and never reads, types or stores a password.

When you press "I submitted it", it sends the address of that directory page (site and path, without the query string). When you press "Ask Claude what to do", it sends the structure of that one directory page (see Anthropic under Who else sees it): never a value you typed, a password, an email address, a link to another site or a query string, and nothing from the site's header, menu or footer. It works only on the directory sites it lists and on manycp.com. It does not read your browsing history.

Disconnecting in the extension ends its token on our servers. You can also remove the browser in ManyCP settings. Removing the extension deletes what it stored on your device. We do not sell this data.