Privacy Policy

Last updated October 10, 2026

Man In A Can Labs ("I", "me") is a one-person software studio. This policy covers this website (www.maninacanlabs.com), the client dashboard at kit.maninacanlabs.com ("the Kit"), and the websites I host for clients, for the data the Kit handles on their behalf.

What I collect

  • Project requests. When you send the contact form, I receive what you enter: your name, email, phone, business, website, project type, budget, timeline and details.
  • Form submissions on client websites. Forms on the sites I host are delivered through the Kit to the business that runs the site. That business decides what its forms ask for and what it does with your answers.
  • Technical details sent with a form. To block spam, the Kit stores a one-way hash of your IP address (not the address itself), your browser's user agent and the page you submitted from.
  • Dashboard accounts. Client staff sign in with an email code or with Google; I keep your email address and, with Google sign-in, your name.
  • Connected Google accounts. If a client connects a Google account to the Kit, I receive only what that connection allows. See "Google user data" below.

This website doesn't use advertising or tracking cookies. It counts visits with the Kit's own visit counter, which uses no cookies and doesn't store IP addresses: it records the page visited, the site that linked to it, the visitor's general location (city, looked up from the IP address at the moment of the visit) and the type of device and browser. A browser that sends a Do Not Track or Global Privacy Control signal isn't counted. The same counter runs on client websites built with the Kit, and the totals are shown to those clients.

How I use it

  • To reply to you, scope and quote your project, and do the work you hire me for.
  • To run the Kit for my clients: deliver form submissions, host their media and content, keep their business information and search listings current, and send them reports.
  • To keep things secure, including stopping spam and abuse.

I don't sell personal information or share it for advertising.

Services that process data for me

  • Fly.io (hosting) and Supabase (database and file storage).
  • Cloudflare (content delivery, media storage, and Turnstile spam protection on forms).
  • Resend (sending form notification and confirmation emails).
  • Anthropic (Claude). Some Kit features draft text with AI, such as image descriptions and search titles; the content involved is sent to Anthropic's API to do that, under terms that don't allow it to be used to train their models.
  • Google (Fonts on this site, Google sign-in, and the Google services clients connect). Microlink provides the screenshots of portfolio websites.

Loading this site's fonts, spam check and portfolio screenshots means your browser contacts Google, Cloudflare and Microlink, which see your IP address as part of any web request.

Google user data

Clients can connect Google accounts to the Kit so it can manage their business listing and measure their website: Google Business Profile (business details, reviews and posts), Google Search Console (search performance and sitemaps for their site) and Google Calendar (read-only, to show events on their website).

  • I use this data only to provide those features to the client who connected the account.
  • I don't sell it, use it for advertising, or use it to train AI models.
  • People can't read it except with the client's permission, for security, or as the law requires.
  • Access tokens are stored encrypted. Disconnecting the account in the Kit, or removing access in your Google account settings, stops access; I then delete the stored tokens.

Man In A Can Labs' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How long I keep it

Project requests and form submissions are kept until they're deleted in the Kit, or until a client's service ends. Submissions marked as spam are deleted automatically after 30 days. Individual page-view records are deleted after 13 months; only daily totals are kept after that.

Your choices

You can ask me what I have about you, to correct it, or to delete it. For a form you sent on a client's website, I'll help, but that business controls its own records, so you can also ask them directly.

Children

These services are for businesses and aren't directed at children under 13.

Changes

If this policy changes, I'll update the date at the top of this page.

Contact

Questions or requests: jon@maninacanlabs.com, or the contact form.