Privacy Policy

Chipped Studios operates the Manila iPhone app. This policy describes what the current public app actually does.

The short version

• You do not create a Manila account.
• Records you type, saved document photos, recognized text, and confirmed suggestions stay in Manila’s app storage on that iPhone unless you turn on sharing.
• If you turn on sharing, this phone encrypts records before they leave. Manila’s relay stores that sealed copy and routing identifiers. Manila cannot read the records. Document photos do not sync in this beta.
• Manila Plus is purchased, verified, restored, and cancelled through Apple.
• There is no advertising, ad identifier, product-analytics SDK, or crash-reporting SDK.
• Erasing Manila data or deleting the app removes the local binder. It does not cancel an Apple subscription or delete a shared relay copy.

Who this covers

This policy covers the Manila iOS app published by Chipped Studios (bundle ID com.saifalesawy.manila). The website at chippedstudios.com is a static site. It does not host user accounts for Manila.

Information stored on your iPhone

Manila can store information a parent enters or confirms, including:

• a child’s name, date of birth, sex, and optional blood type;
• vaccines, allergies, medications, conditions, measurements, and visits;
• doctors, insurance, parent details, and emergency contacts; and
• saved document photos, text recognized on the phone, and titles.

This information is held in a SQLite database and app document storage inside Manila’s iOS app container. Manila applies and reads back iOS complete file protection and backup-exclusion metadata before opening the binder, after database initialization, and when it writes a new saved document. Manila does not add separate database encryption on top of those iOS protections.

Manila does not read the phone’s contacts. Choosing an existing photo uses Apple’s system photo picker, which gives Manila the one item selected rather than general access to the photo library.

Manila does not add a separate Face ID, Touch ID, or app passcode lock. Anyone who can unlock and use the iPhone can open Manila. Use the device passcode.

Device and iCloud backups

Manila marks the directory containing its health-record database and SQLite sidecar files, plus its saved-document directory, with Apple’s isExcludedFromBackup attribute. It applies and reads back that attribute on every app launch and after new durable files are written. The app stays closed if the check fails. These health records and saved documents are therefore not intended to restore onto a new phone from a device or iCloud backup.

Manila also applies iOS complete file protection to those locations and to health-bearing capture and PDF cache files. Temporary files are deleted after the operation when possible.

iOS Keychain items follow Apple’s separate Keychain backup behavior. In this public app they can contain preview credentials and consent choices, not the child-record database or saved document contents.

A printable family summary is a PDF for reading or printing. It is not a full backup.

Document capture

When you take or choose a document photo, Manila copies it into local app storage and uses Apple Vision to attempt text recognition on the phone. That text supports local search. Recognition may miss or misread words.

On a compatible iPhone, when Apple reports that its on-device Foundation Model is available, Manila can pass only the recognized text to that model on the same phone. Suggestions are editable. You must choose Include or Skip for every suggestion. Every included suggestion asks you to confirm that you checked it against the document after any edit. Manila does not choose a sibling. Nothing becomes a record until those checks and the final add action are complete. Manual entry stays available.

The public app does not send a document photo, recognized text, or suggestions to Chipped Studios, Cloudflare, Anthropic, or another AI provider for field reading. Cloud field extraction is not available. If a future release reconnects it, this policy will be updated first.

Family sharing

Sharing is optional. You do not create a Manila account. Turning it on enrolls this phone with a random family identifier and a device credential.

Before anything is sent, this phone seals the record with a key that stays in the iOS Keychain. The relay stores the sealed value and metadata such as family and device identifiers, timestamps, and sizes. Manila cannot open the sealed copy. Cloudflare and Manila can see that a family is syncing, not the child’s name, vaccines, or notes.

The other parent joins with a one-use link or QR code. Their phone publishes a public key. This phone wraps the family key to that public key. The link is not the family key. Anyone who opens a live link can ask to join. Revoke it if you did not mean to send it.

A new iPhone signed into the same Apple ID can restore the key from iCloud Keychain when that setting is on. A printed key plus family code can also rejoin. Uninstalling Manila is not the same as deleting the shared copy. Use Delete shared copy if you want the sealed relay copy removed.

Original document photos do not sync in this beta. The other phone receives the typed facts and any recognized text that fits in a sealed record. Other phones keep anything they already downloaded.

Sharing does not send photos to an AI provider.

Manila Plus and Apple

If you subscribe, Apple processes the purchase through StoreKit and your Apple Account. The product identifiers are manila.family.monthly and manila.family.yearly. Chipped Studios does not receive your full payment-card details and does not operate a billing server for Manila.

Apple’s handling of purchase data is described in Apple’s Privacy Policy.

If Plus ends, Manila does not delete or hide existing children or records and does not block reading, correction, removal, or export. It stops only a new Plus action.

Erasing Manila data does not cancel an Apple subscription. Use Manage subscriptions in the app or iOS Settings.

What we do not collect

The current public app does not:

• create an account or require an email address;
• read sealed family records on Manila’s relay;
• send document photos or model output to an AI provider;
• include advertising, ad identifiers, a crash-reporting SDK, or a product-analytics SDK;
• sell information;
• track you across other companies’ apps or websites.

PDFs and information you share

Emergency cards, form worksheets, and summaries are created on the phone. Once you save, print, AirDrop, email, or upload one, the destination you chose controls that copy. Manila cannot recall it.

These PDFs contain information entered or confirmed by a parent. They are not certified medical records.

Children

Manila is made for parents and guardians to keep records about children in their care. It is not directed at children, and children are not intended to operate it or create an account.

Deleting your information

In Privacy and data, Erase all Manila data on this phone removes Manila-managed records, saved document photos, recognized text, search data, preview credentials, and saved choices from that iPhone. It does not cancel, refund, or hide an Apple subscription.

Deleting the app also removes the local binder from that phone’s active app container. Those health-bearing locations are marked not to restore from backup. Deleting the app does not delete a shared relay copy. Use Delete shared copy for that. Subscription access can still be restored later with Restore purchases and the same Apple Account.

This website

These pages are a static site hosted by Netlify. If you send a support message, Netlify stores the contents so we can read them. Do not put child health information, record photos, or payment details in that form.

Opening a Privacy, Terms, or Support link from the app asks your browser to load this site. Netlify processes ordinary request and security metadata under its terms. Manila does not put a child record or document content in that request.

Medical and legal status

Manila is offered directly to parents. It is a parent-kept recordkeeping tool. It is not a clinician, medical service, official record system, or a tool for diagnosis or treatment. Manila does not claim HIPAA compliance, regulatory approval, or completed legal review.

Nothing in Manila is medical advice.

Changes

If this notice changes in a way that affects how a release handles information, the notice and App Store privacy answers will be updated before that release is distributed.

Contact

Questions about this policy: use the form on the Manila support page.