





Check out Mana - Visuals, voices, and text are all generated together
Hello everyone, if you have a sec I would like for you to check out the RP platform I been building: Mana (https://mana.land), an AI roleplay platform where the visual and audio layers aren't an afterthought. As the story streams in, the scene art updates with it, characters speak their lines with their own unique voices, and new NPCs the narrator invents get cast with faces and sprites on the fly.
- Scenes, not walls of text: the story plays out like a visual novel, with sprites and backgrounds that follow the narrative.
- Per-character voices: dialogue is voiced line by line, not one narrator droning through everything.
- In-Scene Images: See what's happening in the story in 3rd person or POV. Max character consistency across images.
It's free to try and there is unlimited free messaging with deepseek v4 pro up to 20k context. Mana is 18+ only.
_________________________________________________________________
Required Sub-reddit Disclosures
🤖 AI Usage
AI is used to for most new feature implementations. Human developers are brought into the loop for code reviews and bug fixes before beta branch changes hit the live version.
👤 Developer Experience
One full time front end developer and project manager- 6 years experience.
Two part time full stack developers, 7 years experience and 9 years experience.
🔍 Code Review & Testing
Every change goes through code review and tested on staging version of our site for 2-5 days before it's live on the production branch.
🔒 Security & Data Handling
Here's exactly how we secure the platform and handle your data.
Authentication & passwords
- Most people sign in with Google or Discord (OAuth). We never see or store your Google/Discord password — we receive only your name, email, avatar and a provider ID. Google sign-ins are verified server-side against Google's ID token, not trusted from the browser.
- If you use email + password, your password is hashed with PBKDF2-SHA256
- Sessions use short-lived signed tokens with refresh-token rotation and blacklisting — a stolen refresh token stops working the moment it's used, and the signing key is dedicated and rotatable (we have rotated it, and every session was invalidated as intended).
Encryption in transit
- HTTPS everywhere. Plain HTTP is 301-redirected to HTTPS, and we send HSTS (1 year, includeSubDomains) so browsers refuse to talk to us insecurely. Traffic terminates at Cloudflare's edge.
- Standard hardening headers are set: X-Frame-Options, X-Content-Type-Options: nosniff, and a Content-Security-Policy restricting who can frame the site.
Encryption at rest
- All infrastructure runs on Google Cloud (US). The database, uploaded images and backups live on Google Cloud persistent disks and Google Cloud Storage, both of which are encrypted at rest by default (AES-256).
- Nightly backups are encrypted with a separate backup key before being shipped off-site, so a backup file on its own is unreadable.
- User-generated images sit in a private storage bucket — nothing is publicly listable. Every image request is individually signed at the edge before storage will serve it.
- The database is not a public-facing service; only the application talks to it.
Payments
- All payments are handled by Stripe using Stripe-hosted Checkout and the Stripe Customer Portal. Card numbers never touch our servers — we never see, store or transmit raw card data. Our database holds only your Stripe customer/subscription IDs and a record of what you bought. Stripe webhooks are signature-verified before we act on them.
What we collect, and who else sees it
- Account: email, display name, sign-in provider ID, avatar. Content you create: stories, chats, characters and images. Technical: Country, device/browser info and usage events, used for fraud and abuse prevention and aggregate analytics.
- We never use or share the content of your conversations, stories or images for marketing or advertising, and we don't sell it. Aggregate site analytics use Google Analytics.
- Other processors: Stripe (billing), Resend (transactional email — sign-in codes and receipts), Cloudflare (edge/CDN), Google Cloud (hosting).
Access controls
- Staff access to production is by named SSH key only, with role-based permissions inside the admin console and rate-limited admin login. We audit who has access and rotate credentials whenever staff change — we did a full access audit and key rotation in August 2026.
Your rights & deletion
- Delete your account yourself any time in Account → Delete account. It's immediate and permanent: your stories, chats, characters, images, coin history, and session tokens are purged in a single transaction, your AI memory vectors are wiped, and any active Stripe subscription is cancelled. No "soft delete", no 30-day limbo.
- Access, correction and export requests: email hi@mana.land. Mana is 18+ only.
Breach notification
- Our privacy policy commits us to notify you via the email associated your your account as soon as we identify a security incident affecting your data. In practice that means: contain it and rotate any affected credentials, determine from logs exactly whose data was affected, then notify affected users by email plus a notice on Discord and the site, with plain-language detail on what happened and what to do — and notify regulators where the law requires it.
Published policies
- Privacy Policy: https://mana.land/main/legal/privacy
- Terms of Service: https://mana.land/main/legal/terms
- Contact & Support: https://mana.land/main/legal/contact — or hi@mana.land