Manifold is operated from Germany. This notice therefore follows German law (DDG, MStV) and the GDPR, and is published in English because the site and the application are in English.
Information pursuant to Section 5 of the German Digital Services Act (DDG):
Responsible for the content pursuant to Section 18(2) of the German Interstate Media Treaty (MStV): Lukas Rahn, address as above.
No business is registered and no VAT identification number exists. Manifold is currently provided free of charge as part of a no-cost early access programme.
I am neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board.
This site links to external websites operated by third parties, over whose content I have no influence. The respective provider is always responsible for such external content. No legal violations were apparent at the time the links were added.
Manifold is proprietary software. The content created on this site is subject to German copyright law; use of the software itself is governed by the End User License Agreement (EULA) supplied with the download.
Last updated: 1 September 2026
The controller for the processing of personal data on this website and in the Manifold application is Lukas Rahn, Karlstraße 18, 48599 Gronau, Germany, lukas@rahn.email. There is no legal obligation to appoint a data protection officer.
This website and the associated services (api.rahnlab.de, dl.rahnlab.de) run on a server operated by me at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany, and a data processing agreement under Art. 28 GDPR is in place with Hetzner.
When a page is requested, server log files are written automatically. They contain the IP address, the time, the requested address, the HTTP status code, the volume of data transferred, the referrer and the user agent. The legal basis is Art. 6(1)(f) GDPR: my legitimate interest in operating the service securely and free of technical faults. The log files are rotated daily and deleted automatically after 14 days at the latest.
When the start page loads, the public leaderboard is additionally retrieved from api.rahnlab.de. This creates a further log file entry there, of the scope described above; it is the same server run by the same controller, not a third party.
When you create an account in the application, I process the email address you provide and the time of the request. The purpose is to send a confirmation code to that address; the code completes the creation of your account (section 6 describes the account data stored in the process). The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). This website itself contains no registration form.
Retention: the confirmation code is stored only as a hash value and is valid for 30 minutes. Codes that are not redeemed are deleted automatically 24 hours after they were requested; redeemed codes remain associated with the account created and are anonymised when that account is deleted. To prevent abuse (Art. 6(1)(f) GDPR), the number of codes per address and the total number per day are limited. Invitation requests from the earlier, closed early access phase remain stored as before: requests placed on hold are deleted after 180 days, while answered and rejected ones are kept permanently, because without that record the same address could receive another invitation.
Security-relevant events of the API (such as login attempts, registrations, and the request and redemption of a confirmation code) are logged together with the time, the type of event, the email address concerned and the IP address. The legal basis is Art. 6(1)(f) GDPR (detection and investigation of abuse). These entries are deleted automatically after 90 days.
The download link redirects to the current program file. No account is required for this; it merely produces a log file entry as described in section 2. The installed application checks at regular intervals whether a newer version is available and retrieves a file from dl.rahnlab.de to do so; that too produces only a log file entry.
The following are stored for signing in to the application: your email address, a hash value of your password (Argon2id; the password itself is never stored), the time of creation, the time of last access, and hash values of the session tokens issued. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The data is deleted when you have your account deleted.
This website sets no cookies for analytics, profiling or advertising purposes, and embeds no analytics services, no external fonts and no social media plugins. No cross-site tracking takes place. That is also why there is no cookie banner here.
The start page links to an Instagram profile. No data is exchanged with Instagram (Meta Platforms Ireland Ltd.) until you actively click the link; the provider's privacy policy then applies.
All connections to this website and to the associated services are encrypted with TLS (HTTPS).
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).
Right to object: where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).
To do so, simply contact lukas@rahn.email.
Independently of this, you have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.
I update this policy when the processing described here changes. The version published here at any given time is the applicable one; the date above states its current status.