Is Manus AI safe? What its agent keeps, and what the Meta split deleted

The Morse teamPublished October 29, 20269 min read

As of October 29, 2026, Manus AI is safe enough for public research and throwaway drafts, but think twice before giving it your logins, your inbox, or work you can't afford to lose. Its agent works on Manus's servers with your files, your signed-in sessions, and whatever its connectors pull in. In August 2026, Manus deleted some users' data to unwind its sale to Meta. Its privacy policy, updated September 28, 2026, also lets it use de-identified content "to develop and improve our models."

We read Manus's privacy policy and terms of use (both dated September 28, 2026), its Trust Center, its Cloud Browser docs, more than a dozen help center articles, and its blog posts on the Meta deal and the split on October 29, 2026. We also read the decision China's National Development and Reform Commission (NDRC) published on April 27, 2026. Manus deserves credit in two places. Its Trust Center names every sub-processor with its country, and its deletion notice gave users exact hours and a backup tool.

Manus AI key facts, October 2026

Is Manus a Chinese company?

Legally it's Singaporean, but China's government still treated its sale as its business. Manus's privacy policy names Butterfly Effect Pte. Ltd. as the data controller and says "we are headquartered in Singapore." TNW reported on August 12, 2026 that Manus moved its headquarters to Singapore after launching in March 2025.

On April 27, 2026, the NDRC's foreign investment security review office published a decision prohibiting the foreign acquisition of "the Manus project" and requiring the parties to revoke it (our translation). The notice is one sentence long and gives no reasons.

Manus's terms of use put disputes under Singapore law, with arbitration in Singapore. If you're in the US, you're bound to arbitration unless you opt out by certified mail within 30 days of first accepting the terms.

Does Manus send your data to China?

Its own pages name only the US and Singapore. The Trust Center lists those two storage locations, and Manus's August 11 note says "our data is stored in the US and Singapore." Its sub-processor list has nine companies, all marked United States, including Google Cloud Platform, Microsoft Azure AI Foundry, Amazon Web Services, and OpenAI for "foundational models."

The privacy policy leaves room for more: your information "may be transferred to the United States or other locations." We found no mention of China in it. As of October 29, 2026, we can't confirm where Manus's servers are beyond what Manus says. DeepSeek's privacy policy, by contrast, says it stores personal data "in People's Republic of China"; we cover that app in whether DeepSeek is safe.

What happened to Manus user data after the Meta deal?

Some of it was deleted, on a schedule Manus published in advance. This timeline comes from Manus's blog and help center and the NDRC's notice.

Manus said the deletion was needed "to comply with regulatory requirements in specific jurisdictions" and "is not the result of any security incident." It didn't name the jurisdictions or say how many accounts were affected. The backup guide adds that "once the Data backup period has ended, a new backup cannot be made."

The September 28 policy, a month after the split, still describes sharing identifiers with marketing vendors "to promote Meta products and services on other platforms," in its California section. Manus's pages don't explain the line. For Meta's own assistant, see whether Meta AI is private.

Does Manus train AI on your data?

The model companies it uses don't, by contract, but Manus leaves room to use de-identified data itself. The Trust Center says Manus has "formal agreements with all third-party model providers to ensure they do not use your data for training their models."

The privacy policy says Manus may strip identifying details from your personal information and use the result "to develop and improve our models and related technologies." The opt-out is an email to privacy@manus.im, "depending on your jurisdiction." The terms also give Manus and its "affiliates, successors, and assigns" a transferable license to use your content to "develop and improve the Services."

The policy's retention section mentions content that has been de-identified "when you allow us to use your content to improve our models," which suggests a setting. We found no such setting in Manus's help center or docs. Solvea's guide, last updated June 23, 2026, says Manus doesn't use private prompts to train its base models. It predates the September policy and its wording on "our models."

What can Manus see when it uses your browser and accounts?

Whatever you let it log in to, and much of that reaches Manus's servers. Manus has four ways in:

• Cloud Browser. A browser in Manus's cloud. You log in once, and the Trust Center says it remembers your session, "meaning cookies and local storage," encrypted and kept per user. Manus's own docs point to My Browser, below, for a task like "Log into my bank and download last month's statements."
• My Browser. An extension for Chrome or Edge that lets Manus work in your own browser. The privacy policy says it reads page content "from premium or authenticated services you are logged into," uses "your existing browser sessions and login states," and sends that data "to our servers for task processing."
• Connectors. Gmail, Google Calendar, GitHub, Notion, and others, connected by OAuth. Content pulled through them "may be retained in conversations, task files, object storage or enabled memory," the policy says.
• My Computer. In the desktop app, once you authorize a folder, Manus "runs commands automatically" and "only asks for confirmation on sensitive commands," according to its help center.

The terms put the consequences on you: "Agent actions may be attributed to you by third parties," and revoking access "does not reverse an action already completed." An agent reading pages while you're signed in can also be steered by text hidden in them, which we explain in what prompt injection is.

Does Manus store your passwords?

Manus's pages give different answers. The privacy policy is the dated document, so it's the one we'd plan around.

How do you delete your Manus data?

Piece by piece, because each kind lives somewhere different:

1. Tasks. Open More options on the task and choose Delete. Manus's help center says deleted tasks "cannot be recovered."
2. Shared tasks. A shared task has a public link. Manus says it hides connector output and redacts API keys in shared sessions, but check what each shared task shows.
3. Saved logins. Go to Settings, Cloud Browser, Logged-in Accounts, and log out of each site or clear all sessions (docs). The same settings page can turn off saving logins altogether. For passwords you saved, the policy says you can ask Manus to delete them "by instructing the Service to do so (for example, in chat)."
4. Connectors. Revoke each one in settings. The policy says removing a connector "does not by itself delete content already retained."
5. Your account. Click your icon, then Account, Edit profile, and Delete account, and enter the emailed code (help center). Cue shares the same account, so it goes too. The policy says data is removed "within 30 days," apart from payment records, data held for legal or fraud reasons, and "the audit record of the erasure request."

How Morse keeps your chats out of a deal like this

Every question above comes back to where your work sits. Your tasks, files, sessions, and connector content are on Manus's servers, so a sale, a regulator's order, and a policy rewrite each decided what happened to them, and in August some users had to download their own work to keep it.

Morse is built so your history isn't on its servers in the first place. Your chats, Studio images, the characters you make, and your settings are stored in your browser, encrypted, and locked when you sign out. Opening them takes two keys, one of which never leaves your device. Our servers don't keep messages or log what you write. The account holds your sign-in details, plan, balance, and a usage ledger with no content. Morse doesn't train AI on your content, sell your data, or show ads, so there's no email to send for an opt-out. Because we don't store chats, we usually have very little to give authorities.

Clearing your browser, losing your device, or deleting your account deletes your chats, and Morse can't recover them, so copy anything you'll need into your own files. Then pick a mode for each chat:

• Private, the default, for the research and drafting you'd have handed Manus. It runs open-weight models like DeepSeek, Kimi, and GLM, plus Grok. Morse has zero data retention agreements with its inference, search, and other providers, which agreed to keep nothing, and where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't. See what zero data retention means.
• E2EE, for anything no company should read, Morse included. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can open it, and Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee depends on the enclave hardware and attestation working as designed. E2EE runs open-weight models, with no web search or image generation, and comes with Pro at $19 a month. Our guide to verifying enclave attestation covers each check.
• Anonymous, for GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy, so leave names out of what you send.

Our privacy policy has the details. Ask your next research question from the Morse home page without an account, or start free with no card.