Mana Privacy Policy
FIRST EFFECTIVE: October 22, 2026 · LAST UPDATED: October 30, 2026 · THIS VERSION TAKES EFFECT: October 30, 2026
This Privacy Policy explains how Eden Labs, LLC ("Eden Labs," "we," "us"), 499 President Street, Brooklyn, NY 11215, United States, handles personal information when you use Mana: the desktop app, Mana's AI agent (the "Agent"), the Mana parts of our website, and the online services they use. Eden Labs is the controller of the personal information described here. Read it with the Mana Terms of Service.
Our promise. Mana runs on your PC, and most of your data stays there. We collect only what we need to run your account and the features you choose to use. We never sell your data, never use it for advertising, and never use it to train AI models.
1. Information that stays on your PC
Mana keeps these on your PC, mainly in %APPDATA%\mana-workstation. The Agent's files, including its chats and what it remembers, are in %LOCALAPPDATA%\Mana, and clips and screenshots you capture are in your Videos\Mana folder. Mana never uploads them to us, except as section 2 describes. Screenshots and conversations you share with the Agent go to your AI provider, as section 4 describes.
- the games Mana detects, your installed mods, mod lists, load orders, profiles, and rollback points
- your save-game backups
- screenshots, clips, and recordings you capture, and the images the Agent takes when it looks at your screen or game
- your settings, preferences, and progress
- your chats with the Agent, what it remembers about your games and preferences, and the log of actions it took for you
- if you join the Workshop waitlist in Mana, a record that you joined: the email you used and when
- your own keys for other services, such as your Nexus Mods or OpenAI API key (an OpenAI key is stored encrypted for your Windows account)
- app logs (including a voice log of what Mana heard), crash and hang diagnostics, caches, and sign-in data for Mana and the services you connect (if you link Discord, Mana keeps that sign-in encrypted for your Windows account)
- the sites you open in Mana's built-in browser, with their cookies and sign-ins, kept in Mana's own browser storage. The Agent can click and type there for you. Mana is designed to block it from typing into boxes a page marks as password or one-time-code boxes, so sign in to sites yourself. When the Agent works in the browser, what it reads from the page goes to your AI provider, as section 4 describes. When the Agent uses other programs or browsers on your PC for you, what it sees there goes to your AI provider the same way
- what is playing in apps such as Spotify or your web browser, which Mana reads from Windows when you or the Agent use music or video controls
- if you link Discord, your Discord friends list and what your friends are playing
- the sound level Mana's visualiser measures from the sound your PC plays, only once the visualiser has been turned on (it is off by default). It is measured on your PC, never recorded, and never sent anywhere
Uninstalling Mana and deleting those folders removes all of it. We can't see it, so we can't recover it either.
2. Information we collect, why, and how long we keep it
This table is our notice at collection: what we collect, when, why, and how long we keep it.
| What | When | Why | How long we keep it |
|---|---|---|---|
| Account: username, display name, avatar (a link to the picture your sign-in service supplies), email address (if you give one, or if Google or Discord gives us a verified one) and whether it's verified, a salted scrypt hash of your password (if you set one), your plan, the sign-in services you link (service and account ID), a session counter used to sign you out everywhere, when you were last active, and when you created the account. If you connect Claude, that connection's status | When you create an account | To sign you in and know which plan you're on | Until you delete your account |
| Sign-in IDs from Epic Games, Steam, Google, or Discord | When you sign in with one | To match that sign-in to your account | Until you delete your account |
| Sign-in activity: the time, the kind of event (sign-up, sign-in, link, merge, or plan change), your account ID, and the sign-in service. No IP address or email | Each sign-in or account change | Security, and spotting account takeover | Until you delete your account |
| Agent requests: which tool or game the Agent asked for, your plan, and whether it was allowed. Workshop (making a mod): the request text and any image you attach | Each time the Agent uses a Mana service | To run assembly on our servers and protect our methods | Server logs, which are limited by size and overwritten as new entries arrive. Build requests are held in memory and deleted 24 hours after the result is ready |
| A crash log the Agent sends for a check (Fallout 4 and Skyrim): one log from the game's crash logger. It includes things like your mod list, load order, hardware, and the file paths of your game. Before it leaves your PC, Mana is designed to remove your Windows user name and profile folder, and it won't send a log it couldn't clean; our servers check again and refuse a log that still shows them. Mana may miss your user name where it is joined to other text, and other details in the log, such as your PC's name, your Windows account ID, and the names of network computers, are not removed | When the Agent checks what caused a crash. Mana asks you on a card first, unless your Agent control settings let the Agent do this without asking | To find which mod most likely caused the crash. Our own rules do this: no AI model sees the log, and no other company uses it (our network provider, Cloudflare, carries it to us, as section 5 describes) | The log is held in memory only while it is checked, then discarded. We keep a record that a check ran, for which game, and its result, in our server logs, which are limited by size and overwritten as new entries arrive; the record doesn't include your account, your user name, or your IP address |
| Voice clips you speak to the Agent | Only when the Agent's microphone is on. You choose the mode in Mana's Voice settings: Push to talk (the default), Always listening, or Off. Push to talk: only what you say while using the talk key is sent. If you also turn on "Answer approval cards by voice", Mana listens for your yes or no without the key while the Agent is waiting for your answer on a change. Always listening: Mana listens for the Agent's wake word and your commands, and each time it hears speech it sends that short clip to us to turn into text. Off: Mana's voice engine doesn't run, and nothing is sent | To turn your speech into text | Passed to our speech-recognition server, written to a temporary file only while transcribed, then deleted. We keep neither audio nor transcript; logs record only size, length, and processing time. If "Answer approval cards by voice" is on, then while the Agent is waiting for your yes or no, Mana also listens for a few seconds to what your PC is playing, so it can tell your answer apart from game audio; that sound is turned into text the same way and not stored. With the microphone off, or that setting off, this doesn't happen |
| The text of the Agent's spoken replies | When the Agent talks | To make its voice | Not stored: processed in memory, then discarded |
| Images you upload to a published mod or a build request | When you add them | To show your mod, or build what you asked for | Mod images: kept on our servers with the mod, including after the mod is taken down, until it is deleted; email privacy@edenlabs.us to have a mod and its images deleted. Build images: deleted with the build, within 24 hours |
| Community features: your public profile and which sections you show, friends and friend requests, comments, endorsements, reports, mods you publish, and your mod download and install history | Only when you use that feature | To provide that feature | While your account exists. You can remove your own profile comments, endorsements, and friends in Mana; email us to remove a mod or a comment on one. A mod taken down from Mana stays on our servers, hidden, until you ask us to delete it. Friend requests expire after 30 days. If a moderator clears a reported mod, we keep a record of who reported it |
| Steam profile data: games, playtime, last played, achievements, Steam level and badges, recent activity, and your Steam friends list | Only if you link Steam and switch on showing that item | To show it on your profile, and which Steam friends use Mana | Until you switch that item off, which deletes it |
| Mod store searches: your search words and the mods shown to you | When you browse or search the mod store | To show you mods from mod.io and ModDB, and to merge them with the Nexus Mods results on your screen, one card per mod | Not stored: processed in memory, then discarded |
From our website and programs:
| What | When | Why | How long we keep it |
|---|---|---|---|
| Workshop waitlist: your email, what you'd like to build (if you tell us), when you joined, and your country (which our network provider works out from your IP address; we don't store the IP) | Only if you join the Workshop waitlist, in Mana or on our website | To invite you to the Workshop closed alpha and shape it | 12 months after you join, or sooner if you ask us to remove you (email privacy@edenlabs.us) |
| Creator outreach: public information about your channel (name, channel link, audience size, the games you cover) and a business email you've published, plus whether we contacted you and your reply | Only if you run a public channel or mod page we think fits Mana; we gather it from public sources | To invite you to try Mana before release | No fixed time limit yet; until you ask us to remove you |
| Invite-link visits: the time, the invite code, the step (viewing the invite, accepting it, or downloading Mana), where the link was shared (a link, Steam, or Discord), your browser's user agent, your country, and a salted hash of your IP address that lets us tell repeat visits apart (we don't store the IP itself) | When you open or use a Mana invite link on our website | To count which invites work, without counting the same visitor twice, and to spot invite abuse | 12 months, then deleted. Because we don't link these to an account, we may not be able to find yours on request |
Our network provider, Cloudflare, sees your IP address when you connect. Our own servers don't store it with your account, in the account log, or in service logs, and abuse limits are applied in memory only. The one exception is in the table above: invite-link visits keep a salted hash of it, never the address itself.
Cookies. Our sign-in pages set one short-lived, strictly necessary cookie that ties your sign-in to your browser. We use no analytics, advertising, or tracking cookies.
Update checks. Mana checks our website for updates and sends the version it is running. We don't store these checks.
If we ever close an account for misuse (Terms section 5.3), we keep the account and sign-in IDs needed to keep that account closed, for as long as the closure lasts.
3. How we use information and our legal bases
| Purpose | Information | Legal basis (EU/UK) |
|---|---|---|
| Running your account, sign-in, and plan | Account, sign-in IDs | Performance of our contract with you |
| Running Mana's online features you use: assembly, Workshop, voice, crash help, mod store, community | Agent and Workshop requests, voice clips, reply text, crash logs, images, community data, searches | Performance of our contract with you |
| Keeping accounts and services secure, detecting misuse, and enforcing the Terms | Sign-in activity, agent requests, crash-check records, the IDs of closed accounts | Our legitimate interest in security and in protecting our methods |
| Showing optional Steam profile data | Steam profile data | Your consent, which you can withdraw by switching the item off |
| Counting which invite links work | Invite-link visits | Our legitimate interest in understanding how people find Mana and spotting invite abuse; you can object at any time by emailing privacy@edenlabs.us |
| Inviting you to the Workshop alpha | Waitlist sign-up | Your consent, which you can withdraw by asking us to remove you |
| Inviting creators to try Mana | Creator outreach | Our legitimate interest in reaching creators who cover modding; you can object at any time and we'll remove you |
| Account emails, such as password resets | Email address | Performance of our contract with you |
| Meeting legal obligations and answering lawful requests | Any of the above, as required | Legal obligation |
Automated decisions. If we ever act on misuse automatically (Terms section 5.5), you can ask for a person to review that decision (Terms section 5.6). We make no other decisions about you by automated means.
4. Your AI provider
The Agent runs on the AI account you connect: your own Claude account from Anthropic or, if you choose ChatGPT in Mana's Agent settings, your own OpenAI API key. Your conversations with the Agent, and any screenshot, game frame, web page, or other program's window the Agent reads for you, go from your PC to that provider (Anthropic or OpenAI) under your account and its terms and privacy policy. Your text conversations and the screenshots the Agent takes don't pass through our servers. Our servers receive the things section 2 lists: the Agent's requests to Mana's services, your mod-store searches, voice clips and the Agent's spoken lines (not stored), crash logs the Agent sends for a check (the log isn't stored), and images you choose to upload. We use your Mana sign-in only to confirm your plan and to run Mana's assembly on our servers, so our methods never have to be shipped to your PC.
Claude (Anthropic). Mana never reads, stores, or sends your Claude credentials; Anthropic's sign-in stays inside Anthropic's own software on your PC.
ChatGPT (OpenAI). If you add an OpenAI API key, Mana checks it with OpenAI, then keeps it only on your PC, encrypted for your Windows account, and sends it only to OpenAI. The first time you choose ChatGPT, Mana downloads OpenAI's Codex software (about 167 MB).
5. Who we share information with
We share personal information only with these recipients, each only for the purpose listed:
| Recipient | What it handles | Why |
|---|---|---|
| Cloudflare | All traffic between Mana and our servers, and to our website, including your IP address | Network delivery and protection |
| Resend | Your email address and account emails | Sending password resets and account emails |
| Epic Games, Steam, Google, Discord | Your sign-in, when you choose one | Signing you in |
| Steam | Your Steam profile data, only if you link it and switch it on | Showing it on your profile |
| Authorities, when the law requires | What a lawful request requires | Legal obligation |
If Eden Labs is part of a merger, acquisition, or sale of assets, personal information may transfer as part of that deal, under this policy.
Services Mana connects to from your PC. Unless a paragraph below says otherwise, we don't receive this data:
Discord. This is separate from signing in to your Mana account with Discord (section 2). If you link Discord for its social features, Mana signs in to Discord on your PC and keeps that sign-in on your PC, encrypted for your Windows account; it is never sent to our servers. Mana reads your Discord friends list (and what your friends are playing) to show which friends play the same games, and sends a friend request or an invite message when you ask it to. Once you link Discord, while a game Mana supports is running, Mana shows that game in your Discord status. If you share a co-op list for that game, the status carries a Join button; the button holds a short code that identifies the list, not the list itself. Your Discord friends can see that status, as with any game on Discord. Your Discord friends list stays on your PC and never reaches our servers. You can unlink Discord in Mana, and hide your activity from friends in Discord's own privacy settings.
Spotify. Mana has no Spotify sign-in of its own. It reads what is playing from Windows and can pause, skip, or play it there, and it can open Spotify's own search. If you sign in to Spotify's web player in Mana's built-in browser, the Agent can use it like any other site, as section 1 describes. We don't receive your Spotify sign-in, and we don't store anything from Spotify on our servers.
Other services Mana connects to from your PC receive your IP address and what that feature sends, under their own policies: Nexus Mods, mod.io, Steam, Discord, Spotify, YouTube (game trailers), the websites you open in Mana's built-in browser, GitHub and the npm registry (downloading mod tools and the Agent's software), and your AI provider (Anthropic or OpenAI). Signing in with Epic Games: we ask Epic only for your basic profile and keep your Epic account ID (if you create your Mana account with Epic, your Epic display name becomes your starting Mana display name and username); we don't receive your email, friends list, or Epic password, and don't keep Epic's sign-in token. You can remove Mana's access in your Epic account settings.
6. What we never do
- Sell, rent, or trade your data, or "share" it for cross-context behavioral advertising as California law defines it.
- Use it for advertising, or share it with advertisers.
- Use it, or your conversations, to train AI models.
- Watch your screen or your games in the background. The Agent takes a picture of your screen or game only during a conversation with it, when it needs to see it. (Instant replay, if you turn it on, keeps a short buffer on your PC only.)
- Read your files beyond what a feature needs. To find your games, Mana reads your game stores' library files and your games' folders, settings, and crash logs, on your PC. Otherwise it reads files outside its own folders only when you ask the Agent to work with them.
7. Retention and deletion
We keep each kind of information only as long as section 2 says. To delete your account, email privacy@edenlabs.us from the email on your account, or tell us your username. Deleting your account removes from our servers, within 30 days, everything we keep while your account exists: your account record, linked sign-ins, sign-in activity, profile, friends, comments, endorsements, download and install history, and Steam data. We keep only the moderation record of mods you reported, to handle abuse. Copies can remain in our encrypted server backups; we don't yet delete backups on a fixed schedule. Tell us whether you want mods you published removed or kept without your name.
8. Your rights and choices
Choices in Mana. You can see your account details and change your profile, switch Steam profile items off, link or unlink Discord, remove your own profile comments, endorsements, and friends, set the microphone to Off, Push to talk, or Always listening, turn answering approval cards by voice on or off, and change your AI provider. You can leave the Workshop waitlist by emailing us. You don't have to give us any data, but Mana's online features need an account.
EU, EEA, and UK. You have the right to access your personal information, get a copy in a portable format, correct it, erase it, restrict or object to how we use it, and withdraw consent at any time without affecting earlier use. You can complain to your data protection authority.
California and other US states. You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; and not to be treated differently for using these rights. We don't sell or share personal information. We use sensitive personal information (your sign-in details and password) only to provide Mana, so there's no right to limit to exercise. Section 2 is our notice at collection.
How to use your rights. Email privacy@edenlabs.us. We may ask you to confirm you own the account before acting. We answer within 30 days (45 days for California requests, as the law allows). You can use an authorized agent where the law allows it.
9. Security
Passwords are stored only as a salted scrypt hash, and password-reset links only as a hash. We never store sign-in tokens or secrets from other services on our servers. Traffic to our servers is encrypted. When you choose a password, we check it against the Have I Been Pwned list of breached passwords; only the first 5 characters of a one-way hash of it are sent, never the password (the Have I Been Pwned service receives only that prefix from our server, never your IP or account). Sign-in sessions are signed by us and not stored, and signing out ends them on every device. No system is completely secure, but we will tell you and the authorities about a breach affecting you as the law requires.
10. International transfers
Our servers are in the United States. If you use Mana from outside the United States, your information is transferred to and processed in the United States.
11. Age
Mana is for adults: you must be 18 or older, or the age of majority where you live if that is higher, to use it. We don't knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we close the account and delete their personal information within 30 days. If you think someone under 18 has an account, email privacy@edenlabs.us.
12. Changes and contact
If we change this policy, we'll update the "Last Updated" date and tell you in Mana or by email before a change that affects you takes effect.
Eden Labs, LLC499 President Street, Brooklyn, NY 11215, United States
Privacy: privacy@edenlabs.us
Support: support@edenlabs.us