Legal

Privacy Policy

What we collect, why we collect it, and how it's protected.

Last updated: August 2026

1. Who we are

Source Manifest is operated by SourceManifest. This policy explains how we handle personal data for anyone who creates an account or otherwise uses the Service. If you have questions, email tahappd@gmail.com.

2. What we collect

Data	Why we collect it
Full name, email, WhatsApp number	Account creation, login, support, and (WhatsApp) urgent account/billing notices
Password (stored as a bcrypt hash — we never see or store your actual password)	Securing your account
Google profile info (name, email, profile photo) — only if you sign in with Google	Account creation via Google Sign-In
Payment records (amount, status, date) via JazzCash	Billing history — we never receive or store your card/account number; JazzCash processes payment directly
Hunt history and saved products	So your dashboard, past searches, and saved products page work
Basic technical data (IP address, browser type) via standard server logs	Security, fraud prevention, and debugging

3. Cookies

We use a single essential cookie to keep you signed in (a session token, marked httpOnly so it can't be read by page scripts). We don't use tracking or advertising cookies.

4. How your data is shared

We don't sell your personal data. We share it only where necessary to run the Service:

Google — for Google Sign-In (if you use it) and to create/deliver the Google Sheet containing your hunt results.
JazzCash — to process your subscription payment. They receive what's needed to charge you; we don't pass them anything beyond that.
eBay, AliExpress, Apify — these are used to source product data for the Service. We don't send your personal account data (name, email, password) to them — they're data sources for the research the Service performs, not data processors of your personal information.

We may also disclose data if required by law, or to protect the rights, safety, or property of Source Manifest or our users.

5. How we protect your data

Passwords are hashed with bcrypt — never stored or logged in plain text.
All traffic between your browser and our servers is encrypted (HTTPS).
Session cookies are httpOnly, so they can't be accessed by page scripts even if a page had a bug.
Database access and third-party API credentials are stored as encrypted secrets, not in application code.

No system is 100% secure, but we take reasonable, industry-standard steps to protect your information.

6. How long we keep your data

We keep your account data for as long as your account is active. If you delete your account, we remove your personal data within a reasonable period, except where we're required to keep billing records for tax/legal purposes.

7. Your rights

You can:

Update your profile information anytime from Settings;
Request a copy of the personal data we hold about you;
Request that we delete your account and associated personal data;
Cancel your subscription anytime from Settings.

To request a data export or deletion, email tahappd@gmail.com.

8. Children's privacy

The Service isn't directed at anyone under 18, and we don't knowingly collect data from anyone under 18.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you by email.

10. Contact

Questions about this policy or your data? Email tahappd@gmail.com.