ManlyToes.com: Privacy Policy
Comprehensive Privacy Policy governing reader authentication, social OAuth sign-ins, Lookbook favorites curation, and non-transactional member accounts.
1. Overview & Data Controller
MT Digital Media, LLC, doing business as Manly Toes (“we,” “us,” or “our”), owns and operates the website manlytoes.com (the “Site”). We respect your privacy and are committed to safeguarding the personal information you share when browsing our guides, saving looks to your Vault, or registering a member account.
This Privacy Policy explains what information we collect, how we process and store it, the third-party services we use for authentication and bot protection, and your legal rights under applicable privacy legislation, including the Virginia Consumer Data Protection Act (VCDPA), the California Consumer Privacy Act (CCPA/CPRA), and the General Data Protection Regulation (GDPR).
Contacting the Data Controller:
MT Digital Media, LLC
Woodbridge, Virginia, United States
Email: contact@manlytoes.com
Web: https://manlytoes.com/contact/
2. Information We Collect
Because Manly Toes has expanded from a passive publication to a personalized member curation platform, we collect information in the following categories:
A. Information You Provide Directly
- Member Registration: When you register for an account to access My Pedicure Vault, we collect your chosen username and email address. Your password is encrypted and stored using standard one-way hashing algorithms (bcrypt/phpass); we never store or have access to raw passwords.
- Communications: If you submit an inquiry through our Contact page or send us an email, we collect your name, email address, and message contents.
B. Information Collected via Third-Party Social Sign-Ins (OAuth 2.0)
If you choose to register or log in using third-party social providers (Google, Meta/Facebook, X/Twitter, or Sign in with Apple via Nextend Social Login), we receive authorized profile tokens and data from that provider:
- Google OAuth: Email address, name, and unique Google account identifier.
- Meta (Facebook Login): Email address, public profile name, and unique user ID.
- X (Twitter): Verified email address, display handle, and unique account ID.
- Apple: Apple ID email address (or private relay alias generated by Apple) and unique user identifier.
We do NOT access your social feeds, friends lists, contacts, or personal private messages.
C. User Curation & Vault Preferences
When you favorite Lookbook cards, formula pairings, or product recommendations:
- Guest Curation: Saved looks are stored client-side in your browser’s
localStorage(key:mt_saved_looks). - Member Vault: When logged in, your saved looks are synchronized to your WordPress database profile (
wp_usermetaunder keysimple_favorites) so you can access your curated finishes seamlessly from your phone during pedicure appointments.
D. Automated Technical Data & Bot Defense
- Device & Connection Data: IP address, browser type and version, operating system, referring URL, and page request timestamps.
- Cloudflare Turnstile: To protect our registration and login forms from automated spam bots without intrusive CAPTCHAs, we utilize Cloudflare Turnstile. Turnstile evaluates browser telemetry and human interaction signals in the background. Cloudflare processes this data strictly for bot detection and security analysis.
3. How We Use Your Information
We process your personal information strictly for legitimate business and editorial purposes:
- Delivering Member Services: To authenticate your account, maintain your session, and render your personalized My Pedicure Vault dashboard across devices.
- Account Security & Platform Integrity: To prevent fraud, detect brute-force login attempts, block malicious spam bots, and protect site infrastructure.
- Transactional Notifications: To deliver essential account communications, such as password reset links and security alerts (via Hostinger authenticated mail).
- Site Optimization: To analyze aggregate reading trends, popular color finishes, and Lookbook engagement to improve future content.
4. Third-Party Service Providers & Subprocessors
We do not sell, rent, or trade your personal data. We share information only with trusted infrastructure providers necessary to operate the platform:
| Provider | Purpose | Privacy Governance |
|---|---|---|
| Hostinger | Managed WordPress hosting, database storage, and SMTP transactional mail delivery. | ISO 27001 certified; strict data processing agreements. |
| Cloudflare | Turnstile bot defense, CDN caching, and DDoS mitigation. | Zero puzzle tracking; GDPR/CCPA compliant telemetry. |
| Google Cloud Platform | OAuth 2.0 social sign-in authentication. | Google API Services User Data Policy adherence. |
| Meta / Facebook | OAuth 2.0 social sign-in authentication. | Meta Platform Terms & Developer Data Policy. |
| Apple Inc. | Sign in with Apple private authentication. | Apple Privacy Policy (Private Relay support). |
| X Corp. | OAuth 2.0 social sign-in authentication. | X Developer Agreement & Policy. |
| Affiliate Networks (Amazon, OluKai) | Outbound referral tracking when you click affiliate product links. | Referral cookies placed strictly on merchant sites upon click. |
5. Cookies & Local Browser Storage
We use essential cookies and browser storage technologies to maintain platform functionality:
- Authentication Cookies: Standard WordPress session cookies (
wordpress_logged_in_*,wordpress_sec_*) to keep you signed in as you navigate between pages. - Browser LocalStorage: Used by our favorites engine to save look selections (
mt_saved_looks) for immediate client-side performance under LiteSpeed Cache. - LiteSpeed Cache: Caches static HTML for unauthenticated visitors; personalized vault views and favorite button states are loaded dynamically via client-side JavaScript to prevent cross-user caching.
6. Data Retention & Security Standards
We implement administrative and technical safeguards designed to protect your personal information:
- Encryption in Transit: All site traffic is encrypted using modern TLS/SSL (HTTPS).
- Password Security: Passwords are cryptographically hashed using salted one-way hashing algorithms.
- Retention Period: We retain your member account and Vault records for as long as your account remains active. If you request account deletion, your user record and associated vault meta are permanently purged from our database within 30 days.
7. Your Legal Privacy Rights
Depending on your geographic location, you possess specific statutory rights regarding your personal information:
Virginia Residents (Virginia Consumer Data Protection Act • VCDPA)
As a Virginia LLC, MT Digital Media complies fully with the VCDPA. Virginia consumers have the right to:
- Confirm whether we process your personal data and access that data.
- Correct inaccuracies in your personal data.
- Delete personal data provided by or obtained about you.
- Obtain a portable copy of your data.
- Opt out of targeted advertising, the sale of personal data, or profiling (Note: MT Digital Media does NOT sell personal data).
California Residents (CCPA / CPRA) & European Residents (GDPR / UK GDPR)
Residents of California, the European Economic Area (EEA), and the United Kingdom have the right to request access, rectification, portability, and complete erasure of their personal data (“Right to be Forgotten”), and will not be discriminated against for exercising these rights.
Exercising Your Rights: To submit a request for data access, correction, or permanent account deletion, email contact@manlytoes.com with the subject line “Privacy Rights Request”. We will verify and process your request within 30 days.
8. Children’s Privacy (COPPA Compliance)
Our website and member services are designed strictly for adults aged 18 and older. We do not knowingly collect or solicit personal information from individuals under the age of 18. If we discover that a user under 18 has created an account, we will immediately delete the account and associated records.
9. Updates to this Policy
We may update this Privacy Policy periodically to reflect new features, authentication methods, or regulatory requirements. Any modifications will be posted to this page with an updated “Last Updated” timestamp. Continued use of the Site after revisions constitutes acceptance of the updated terms.