Public policy
Privacy policy
This page explains the product data practices that are implemented today. It is not a substitute for a completed commercial legal review.
What ChanYar is for
ChanYar is a personal financial planning workspace. It works from information you enter: manual assets and liabilities with dated histories, goals, shared deterministic scenarios, cash records, budgets, check-ins, and financial-journal notes.
The product does not connect to a bank feed or automatically create a bank balance. Cash ledger entries use the dates you enter. Recurring definitions are expectations only until you explicitly mark an occurrence as received or paid; they do not post money automatically.
Account and financial information
Email/password sign-up, sign-in, password recovery, and cookie-backed sessions are provided through Supabase Auth. ChanYar is for people aged 18 or older. Keep your password and recovery links private, and use the account settings available after sign-in for profile and language preferences.
Financial information is private workspace information. The application uses verified account access and owner-scoped controls for its private records. Enter only information you are entitled to use, and leave an amount, date, or currency unknown when it is not known rather than treating a missing value as zero.
- Assets, liabilities, goals, and deterministic scenarios remain based on the dates, currencies, and assumptions you provide.
- Monthly budgets have versions; a confirmed monthly check-in is an immutable historical version. Later corrections require a new draft and confirmation rather than silently rewriting history.
- Financial journal Markdown is intentionally limited and rendered safely. Private PDF and CSV exports are generated transiently for the authenticated owner with private, no-store responses; they are not public download links.
AI Planner consent and provider processing
The educational AI Planner is off until you give explicit, versioned consent. It is not a trading agent or licensed financial, tax, or legal adviser, and deterministic application calculations remain authoritative.
For an accepted AI request, the managed provider receives the selected topic and language, a best-effort redacted typed question, and limited qualitative descriptors. Stored amounts, names, dates, rates, source identifiers, transaction descriptions, journal text, full financial histories, and prior conversation history are not automatically sent. You should still avoid typing sensitive information into a question.
Automatic redaction is best effort, not a guarantee that all identifying text is removed. ChanYar does not promise zero provider retention, no training, or that a request already delivered to a provider can be recalled or erased. Provider handling remains subject to the applicable Manus and model-provider terms and policies.
AI history and retention choices
You can choose no history, 7 days, or 30 days for managed AI conversations; 7 days is the default. With no history, the application stores no managed question or answer content. When history is retained, expiry is measured from conversation creation rather than extended by every message.
Expired managed history becomes inaccessible immediately and is physically cleaned up by the application’s daily 03:00 UTC cleanup. Content-free AI usage receipts, used for abuse and cost controls, are retained for 90 days. Clearing history, selecting no history, or withdrawing consent deletes managed history, but does not erase a request already sent to an external provider or reset usage limits.
Analytics and service providers
Platform analytics are enabled. ChanYar does not claim that analytics are disabled or cookie-free. Analytics and service infrastructure may process technical information under their own applicable policies.
Supabase provides the implemented authentication and private-data infrastructure. Manus and the configured managed AI provider process the limited AI request data described above when you use the AI Planner. The product does not currently describe a separate public support processor, payment processor, checkout, or banking integration because none is implemented.
Questions and commercial readiness
See the Contact & support page for the currently configured support route and sign-in, password-recovery, and settings self-help links. Do not send passwords, one-time codes, or full financial records through an unverified channel.
A public operator identity, legal entity, physical address, governing jurisdiction, and complete commercial privacy review are not configured here. They must be completed and reviewed before a broader commercial launch; this policy does not invent them.