Manifold is operated from Germany. This notice therefore follows German law (DDG, MStV) and the GDPR, and is published in English because the site and the application are in English.
Information pursuant to Section 5 of the German Digital Services Act (DDG):
Responsible for the content pursuant to Section 18(2) of the German Interstate Media Treaty (MStV): Lukas Rahn, address as above.
No business is registered and no VAT identification number exists. Manifold is currently provided free of charge as part of a no-cost open beta.
I am neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board.
This site links to external websites operated by third parties, over whose content I have no influence. The respective provider is always responsible for such external content. No legal violations were apparent at the time the links were added.
Manifold is proprietary software. The content created on this site is subject to German copyright law; use of the software itself is governed by the End User License Agreement (EULA) supplied with the download.
Last updated: 19 October 2026
The controller for the processing of personal data on this website and in the Manifold application is Lukas Rahn, Karlstraße 18, 48599 Gronau, Germany, lukas@rahn.email. There is no legal obligation to appoint a data protection officer.
This website and the associated services (api.rahnlab.de, dl.rahnlab.de) run on a server operated by me at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany, and a data processing agreement under Art. 28 GDPR is in place with Hetzner.
When a page is requested, server log files are written automatically. They contain the IP address, the time, the requested address, the HTTP status code, the volume of data transferred, the referrer and the user agent. The legal basis is Art. 6(1)(f) GDPR: my legitimate interest in operating the service securely and free of technical faults. The log files are rotated daily and deleted automatically after 14 days at the latest.
When the start page loads, the public leaderboard is additionally retrieved from api.rahnlab.de. This creates a further log file entry there, of the scope described above; it is the same server run by the same controller, not a third party.
The application can be used without an account; creating one is optional. When you create an account in the application, I process the email address you provide and the time of the request. The purpose is to send a confirmation code to that address; the code completes the creation of your account (section 6 describes the account data stored in the process). The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). This website itself contains no registration form.
Emails are sent via the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor under Art. 28 GDPR; a data processing agreement is in place. For this, Resend receives the recipient's email address and the content of the email (for example the confirmation code). The emails are sent from Resend's servers in the USA (region us-east-1). Plus Five Five, Inc. (Resend) is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). According to Resend, the log of sent emails is kept for 30 days.
Retention: the confirmation code is stored only as a hash value and is valid for 30 minutes. Codes that are not redeemed are deleted automatically 24 hours after they were requested; redeemed codes remain associated with the account created and are anonymised when that account is deleted. To prevent abuse (Art. 6(1)(f) GDPR), the number of codes per address and the total number per day are limited. Invitation requests from the earlier, closed early access phase remain stored as before: requests placed on hold are deleted after 180 days, while answered and rejected ones are kept permanently, because without that record the same address could receive another invitation.
Security-relevant events of the API (such as login attempts, registrations, the request and redemption of a confirmation code, and turning two-factor authentication on or off) are logged together with the time, the type of event, the email address concerned and the IP address. The legal basis is Art. 6(1)(f) GDPR (detection and investigation of abuse). These entries are deleted automatically after 90 days.
The download link redirects to the current program file. No account is required for this, nor for using the application. The redirect itself produces a log file entry on my server as described in section 2. The program files are hosted as releases of the public repository github.com/LukasRahn/manifold-releases by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. When you download a file, your browser connects to GitHub's servers; GitHub then processes your IP address and the technical data of the request (time, requested file, browser information) under its own responsibility. Details are set out in GitHub's privacy statement at docs.github.com. Because GitHub is based in the USA, this data may be processed there. GitHub, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR).
The installed application checks at regular intervals whether a newer version is available. To do so it retrieves a small release file from the same GitHub repository and, when you install an update, the program file itself; GitHub processes the IP address of your device as described above. No account data, device identifier or usage data is transmitted in the process. The legal basis is Art. 6(1)(f) GDPR: my legitimate interest in delivering the application and its security updates reliably. Versions of the application released before this change retrieve these files from dl.rahnlab.de instead, which produces only a log file entry as described in section 2.
A Manifold account is optional; the processing described in this section takes place only if you create one. The following are stored for signing in to your account: your email address, a hash value of your password (Argon2id; the password itself is never stored), the time of creation, the time of last access, and hash values of the session tokens issued. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). The data is deleted when you have your account deleted.
This website sets no cookies for analytics, profiling or advertising purposes, and embeds no analytics services, no external fonts and no social media plugins. No cross-site tracking takes place. That is also why there is no cookie banner here.
The start page links to a Discord server and to profiles on GitHub, Instagram and TikTok. No data is exchanged with Discord (Discord Netherlands BV), GitHub (GitHub, Inc.), Instagram (Meta Platforms Ireland Ltd.) or TikTok (TikTok Technology Limited) until you actively click the respective link; the provider's privacy policy then applies.
All connections to this website and to the associated services are encrypted with TLS (HTTPS).
You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), as well as the right to withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).
Right to object: where processing is based on Art. 6(1)(f) GDPR, you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).
To do so, simply contact lukas@rahn.email.
Independently of this, you have the right to lodge a complaint with a supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.
I update this policy when the processing described here changes. The version published here at any given time is the applicable one; the date above states its current status.