Your data, plainly.

ActualHumanTake is a small human-run review service. This page explains what we collect, why, and how to get rid of it.

What we collect

• Product details you submit: name, URL, category, description, audience, stage, and the focus areas you choose.
• Contact details: your email address when provided and, optionally, your name. Email is required for human submissions but optional for agents.
• Submitter details if you identify as an agent: agent name and model/runtime, if provided.
• Technical data: a hashed IP address, user-agent string, source label, and timestamps. We hash IPs and do not store them in plain text.
• The review we write, and internal notes about the request.

Why we collect it

• To use your product and write the review you asked for.
• To email receipts and finished reviews when you provide an email address.
• To prevent spam, duplicates, and abuse of the free API.
• To keep a record of what was requested and what was delivered.
• To understand site traffic and agent usage, including page views, distinct browsers, estimated tab sessions, public API calls by route, MCP tool calls, referring site hostnames, and broad device sizes.
• A random first-party browser ID is used to count distinct browsers. The server stores only a keyed hash of that ID and its last-seen timestamp; it does not receive a name or contact detail from this analytics feature.

What is public

If you choose a public review, the product details you submitted and the finished review may be visible on a public page and indexed by search engines. Your email address, name, and internal notes are never shown publicly. If you choose a private review, it is only readable with your receipt token. If you provide an email, we also send a delivery link.

Where it lives

Data is stored in Google Firebase / Cloud Firestore and the app runs on Vercel. Transactional email is sent through Gmail SMTP. These providers process data on our behalf. We do not sell your data, and we do not use advertising or third-party analytics trackers. Traffic and API totals are stored as daily aggregates in Firestore, alongside keyed browser hashes used to deduplicate unique-visitor counts.

Cookies

The public site does not set analytics cookies. It keeps a random first-party browser ID in localStorage to count distinct browsers, and a temporary tab-session marker in sessionStorage to estimate sessions. Analytics do not store IP addresses, request bodies, full referrer URLs, page query strings, or raw browser fingerprints. The admin area uses one httpOnly session cookie after password sign-in. The password is checked on the server and is not stored in the session cookie.

Retention

We keep review requests and reviews so the receipt links keep working and so we can improve the service. Traffic analytics keep a keyed browser hash and last-seen timestamp for unique-browser counts; page and API activity is stored as daily aggregates. Rejected or spam submissions may be deleted sooner. You can ask us to delete your request at any time.

Your choices

Email magi.autonomous@gmail.com to access, correct, or delete your data. Include the request ID or the email you used. We will handle it manually and confirm when it is done.

Children

This service is not directed at children under 13. Do not submit personal information about a child.

Changes

If this policy changes in a meaningful way, we will update this page and the date at the top.