Privacy Policy
Handled holds information about your family — including your children's allergies and medical facts. This page says exactly what it stores, what leaves our servers, and how to get rid of it. It is written to be read, not to be survived.
The short version. We store what you tell it so it can be useful later. What your household tells Handled is never sold, rented, or used for advertising, and there are no adverts inside the app. Some of it is sent to an AI provider to be processed, and you can mark anything as never-leaves-this-device to stop that. You can delete any of it, or your entire account, from inside the app.
Separately, we advertise. Our public website uses ordinary marketing analytics and advertising tools, the same ones most companies use. Those see visits to handledassistant.com. They never see what is inside your household. The two are described below and they do not meet.
What we store
| What | Why |
|---|---|
| Your email address and a password hash | To sign you in. We never store your password itself — only a scrypt hash of it. |
| The people in your household — names, roles, birthdates, notes | So it knows who anything is about. |
| Facts about them: allergies, dietary rules, medical notes, schools, providers, preferences, sizes | The core of the product. An allergy it forgot is the failure this app exists to prevent. |
| Standing rules — "gymnastics every Monday", "no dairy on weekdays" | To know your week without being asked each time. |
| Things you tell it, as you typed them | So it can show you why it believes something. |
| Things coming up, and notifications it sent you | To raise them once, at a useful moment, and not nag. |
| Meal plans and your ratings of them | So next week's are better. |
| A push subscription for each device you turn alerts on for | To send notifications. See below. |
| Counts of AI usage and cost, per household | To keep the service within a spending cap. |
| Health vault records, if you turn that feature on | Separate notice, separate opt-in — see the Health Data Privacy Notice linked below. |
Children's information
Handled is for the adult running a household. It is not designed for, marketed to, or intended to be used by children, and children do not have accounts.
It does hold information about children — names, ages, schools, allergies, medical facts — because that is what a household assistant is for. All of it is supplied by the adult account holder, about their own family. We do not collect anything directly from a child.
None of it is ever used for advertising, shared with an advertiser, or sent to an analytics provider. Not a name, not an age, not an allergy, not a medical note. The marketing tools described below run on our public website and have no access to any of it — they are a different system holding different data, and nothing crosses from one to the other.
What leaves our servers
The AI provider
Handled uses Anthropic's Claude to understand what you write and to plan meals. To do that, relevant parts of your household information are sent to Anthropic as part of the request. This is the only third party that receives your household's content. One other company handles email, described below, and it receives none of it.
Two things it never sends. Safety questions — "is Clover allergic to peanuts" — are answered from the stored record by direct lookup and never go to a model at all. And anything you mark never leaves this device is excluded from what is sent, while remaining fully usable inside the app. The app tells you how many items it withheld.
Handled sends you email about your own account — a link to reset your password, and notices about the account itself. These are delivered by Resend, which receives the address we are writing to and the words of the message.
No email carries your household's information. That is not an intention, it is a check that runs before every message leaves: the text is compared against the names of the people in your household and against the allergy and medical facts you have stored, and a message containing any of them is refused rather than sent. It is why a reset email says nothing about you beyond the fact that somebody asked to reset a password.
The limit is the same one the rest of the app has, and we would rather write it down than claim the check is complete: it matches the words you stored, so a fact described some other way would not be caught. Very short names are skipped as well, because they would otherwise match ordinary words in every message and make the check useless.
Password resets and other account emails are not tracked. They carry no images and no tracking pixel, so opening one tells us nothing. That is deliberate: an email you receive because you are locked out is not a marketing opportunity.
Newsletters and other marketing email may be tracked in the ordinary way — whether it was opened, and which links were followed. That is how anyone sending marketing email knows whether it is wanted. These are sent from a different subdomain, and every one of them carries an unsubscribe link that works.
Notifications
Notifications are delivered through Apple's and Google's push services. The contents are encrypted to your device's own key before they leave us, so Apple and Google can see that a message was sent to your device and never what it said. That matters here, because a notification title can be "Clover's allergy plan expires Friday".
Nothing else
We do not sell, rent, or trade what your household tells Handled, and we never use it for advertising. There are no adverts inside the app.
Our website, and advertising
Everything above is about the app and what your household puts into it. This section is about something separate: the public website at handledassistant.com, and how we find people who might want Handled.
We use the ordinary tools a company uses to do that — website analytics, and advertising services such as Google's and Meta's. On our public pages they may record:
- Which pages you looked at, for how long, and which one you arrived from
- Rough location from your IP address — a region, not an address
- Your device and browser type
- Whether a visit came from a particular advert or campaign, and whether it led to a signup
Advertising services use that to show Handled to people who have visited the site, and to find others like them. This is standard practice and we are naming it rather than burying it, because a page that claims a purity the company does not practise is worse than one that says what it does.
The line, and it does not move. These tools see visits to a website. They never receive anything from inside a Handled account — no member's name, no age, no allergy, no medical note, no message, no meal plan, no notification. We do not build advertising audiences out of who is in your family or what they need. If you are signed in and using the app, you are not being tracked for advertising while you do it.
What this means about your choices
Because advertising services are involved, some US state privacy laws treat this as sharing your information for cross-context advertising, and give you the right to opt out. In the UK and Europe, non-essential cookies require your consent before they are set.
Being straight about the state of this: these tools are not switched on yet, and the consent and opt-out controls that have to accompany them are not built yet. They will be in place before any advertising tool runs on the site — we would rather publish this page early and honestly than switch the tools on first and describe them afterwards. We will say here when that changes.
Seeing and deleting what it knows
The Privacy screen inside Handled shows everything stored about your household, in plain language, on one page. From there you can:
- Mark any item never leaves this device — it stays usable but stops being sent to the AI provider
- Forget any single item — a real deletion including its history, not a hidden flag
- Forget everything — empties the household, keeps your login
- Delete your account — removes your login and the entire household with it
Account deletion shows you exactly what is about to go, and how much of it, before anything happens. It cannot be undone.
One honest limit. We take encrypted backups so that a server failure does not lose your family's information. When you delete something, it goes from the live service immediately — but it may remain in a backup until that backup ages out on its normal schedule. Backups are not rewritten. We would rather say this than claim an erasure we do not perform.
How long we keep it
For as long as your account exists, because the product's value is that it remembers. It goes when you delete it, or when you delete your account. Backups age out as above.
Security
- Passwords are stored as scrypt hashes, never as passwords
- Session tokens are stored hashed, so a database copy does not yield working sessions
- Households are isolated at the database level by row-level security, not only by application code — so a mistake in a query cannot return another family's rows
- Notification contents are encrypted to your device before leaving our servers
No system is perfect and we will not pretend otherwise. If you believe you have found a problem, please tell us at the address below and we will take it seriously.
Changes
If this policy changes in a way that affects what we do with your information, we will tell you in the app rather than quietly updating this page.