Status and scope of this notice
This draft describes the website implementation currently reviewed; it is not a jurisdiction-specific legal determination. The responsible operator, applicable locations, legal bases, retention practices and request-handling duties have not been confirmed by the owner. Keep the draft notice until those facts and the actual services are verified.
Calculator information
The ten public calculators perform their arithmetic in the visitor’s browser. Their code does not send entered measurements, rates or results to a calculation server, and the public site has no visitor account or calculation-history feature. Values remain in the page unless the visitor chooses to copy, save or share them using their own device or other software.
Private administration records
The private admin workspace is not a public visitor account service. The owner and explicitly invited administrators sign in through Manus OAuth. The application stores the administrator’s Manus account identifier, display name, role and access status, invitation metadata, guide overrides, editable site settings, ad-unit metadata and administrative activity records in the managed database. Activity records include the actor, action, target, timestamp and limited operational details. An administrator login email is stored only when that administrator configures password sign-in. Passwords are stored as scrypt hashes, never in plaintext; OAuth access tokens are not stored. Short-lived sessions and hashed login-rate-limit keys are stored for security. Password setup or reset uses the administrator’s linked Manus OAuth account. Manus may accept an existing signed-in session without prompting for another password. Email reset and mailbox-verification messages are not enabled. Invitation tokens are stored as hashes. No automatic retention or deletion schedule is configured for these records; the owner must confirm a suitable policy and request-handling process before treating this notice as final.
Browser preference storage and administration cookies
The public preference interface stores a small choice in localStorage under the key hcl-cookie-preferences-v1 so the same browser can remember it. This is not an advertising or analytics cookie. The optional analytics control saves a local preference only. The advertising control also gates the site’s optional AdSense code: it remains disabled until the owner supplies real IDs and enables serving, and it is not loaded in a browser that has not allowed advertising. This local setting does not establish compliance with any jurisdiction-specific consent or certified CMP requirement and does not control hosting-platform diagnostics, request logs or other platform processing. The admin sign-in flow uses session and security cookies only for administration, including an application session, CSRF protection and short-lived OAuth or invitation state. Clearing browser site data can remove the saved preference and sign-in state.
Contact messages
When a visitor submits the Contact Us form, the site stores the optional name, reply email address, subject, message, language and submission time in the private administration database. The primary owner can read and delete messages in the Inbox; administrators with other roles cannot access it. Messages remain until the owner deletes them; no automatic deletion period is currently configured. If the owner configures a valid Gmail App Password accepted by Google, the application attempts to send a brief alert to the owner’s Gmail account that a new message is waiting and includes a link to the admin sign-in; the alert does not include the message body or visitor email. Google processes the email alert when that option is enabled. If Gmail is not configured or authentication or delivery fails, the message remains in the internal inbox and the owner can see its notification status. For abuse prevention, the server derives keyed HMAC tokens from the reply email and request network address for temporary rate-limit counters; it does not retain the raw IP address, and stale counters are cleaned after 48 hours. Do not send passwords, payment details, identity documents or other sensitive information through this form. The owner must confirm a suitable retention schedule, applicable locations and privacy-request process before removing this draft notice.
Analytics, advertising and hosting
Project site analytics are disabled. The application includes an AdSense loader behind a gate, but the current configuration has no Publisher ID or ad-unit ID and both serving and Auto Ads are off; Google ad code is requested only if the owner adds genuine IDs, confirms account/site approval and activity in AdSense, enables serving, and the visitor’s browser preference allows advertising. On 31 October 2026, a live audit found that a Manus-delivered script from files.manuscdn.com/manus-space-dispatcher/ initiated requests to Amplitude remote configuration and event endpoints. The inspected event batches described session starts, page views, Manus-space/file views, and page-element or form interactions. Fields observed included a device identifier, session identifier, IP address, user-agent, page URL/path/referrer, language, viewport details and interaction metadata. No email address, phone number, account user ID or test calculator value was found in the inspected requests; this is not proof about every visitor or interaction. No cookies accompanied the requests in the clean-browser test; Amplitude-related localStorage entries were present. The browser received HTTP 403 for remote-configuration requests and HTTP 400 for event submissions, so receipt of a response is confirmed but acceptance or retention of events is not. After the platform setting to hide the Manus badge and its scripts was enabled, repeat checks of the English home page and Arabic electricity calculator found no Amplitude requests or external badge script. This does not establish how earlier requests were handled or rule out other host/CDN security logs or telemetry. This preference is a technical gate, not a guarantee of jurisdiction-specific consent or certified-CMP compliance. The owner must verify actual Google processing, update disclosures and configure any required consent service before enabling ads. Before treating this notice as final, the owner must confirm platform processing, retention, subprocessors, locations, privacy-request handling and any remaining telemetry; document actual Google AdSense behavior before enabling ads. Update disclosures and consent controls where applicable before activating any new service.
Requests, retention and applicable rights
No owner identity, jurisdiction, retention schedule, privacy-request mailbox or response timetable has been provided. The owner must confirm these, determine which rights and notices apply to visitors, and publish an appropriate monitored contact route. This draft does not promise a particular legal basis, deadline or result.
Changes and final review
Review this notice whenever the owner, host, contact method, code, data flow, analytics, advertising or applicable legal requirements change. Remove the draft notice only after the real operator information and every live service and data practice have been checked by the owner.
Last updated
1 November 2026.