Privacy policy
Last updated 19 October 2026
This policy covers handfultasks.com, the Handful web app at app.handfultasks.com, the Handful desktop and phone apps, and the API behind them (together, "Handful"). Handful is run by [operator name] ("we"). Questions go to [email protected].
The short version.
- We collect what Handful needs to work, and nothing for advertising.
- We don't sell your data, show ads, or use your data to train AI models.
- Your data is stored in Singapore.
- You can export or delete everything; deletion is complete within 30 days.
What we collect
- Your account. Your email address. If you sign in with Google, Google also shares your name and profile picture. We never see your Google password and get no access to your Gmail, Drive or anything else in your Google account. Handful stores no passwords.
- What you create. Your tasks, notes, checklists and estimates; your plan (what is on Today, its order, snoozes, what you finished); and your workspaces (names, colours, time zones, quiet hours).
- What you connect. Connections to Jira, GitLab, GitHub and Slack are not available yet. When they are, Handful stores the items assigned to you or waiting on you: titles, status, priority, assignee, due dates, links, review requests, pipeline results and mentions. See Connected tools.
- Technical data. Our servers log IP addresses, device and browser type, and requests and errors. We use these to keep Handful secure and to fix problems, and keep them for up to 30 days.
The apps keep a copy of your data on your device so they work offline. On desktop and phone your sign-in is kept in the system's secure storage (such as the macOS Keychain); on the web, in your browser's storage.
How we use it
To run Handful: sign you in, sync your data between your devices, send sign-in emails (and, later, notifications you turn on), keep the service secure, and fix bugs.
We don't sell or rent your data, share it for advertising, show ads, or use it to train AI models. We don't look at your content unless you ask us to (for support), or we need to investigate a security problem or abuse, or the law requires it.
Connected tools
When you connect a tool such as Jira, GitLab, GitHub or Slack:
- Handful asks for read access only, with the narrowest permissions the tool offers. It asks for write permissions only if you turn on write-back.
- Nothing is written to a tool unless you take an explicit action in Handful, such as pressing a button that says so. Every write is logged: what, when, through which connection, and the result.
- Access tokens are encrypted, separately for each connection, with a key kept outside the database. They stay on our servers and are never sent to your devices.
- When you disconnect, we revoke the token, hide that tool's items, and delete them within 30 days.
Your use of a tool is also covered by that tool's own terms and privacy policy, and by your organisation's rules.
Where your data is stored and who processes it
Your account and data are stored in a database in Singapore. These companies process data on our behalf, only to provide their part of Handful:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Singapore |
| Railway | Runs the Handful API | Singapore |
| Cloudflare | DNS, security firewall, content delivery, and hosting for this website and the web app | Global network |
| Resend | Sends sign-in emails (your email address and the message) | Japan (Tokyo) |
| Sign-in with Google, if you use it; the fonts on this website (your browser loads them from Google, which sees your IP address) | Global |
Later we plan to add sign-in with Microsoft and Apple, and push notifications through Google Firebase Cloud Messaging (a device token and the notification text) if you turn them on. We will update this list before any new provider receives your data.
Cookies
This website sets no cookies. Cloudflare may set a strictly necessary security cookie to tell people from bots. The web app keeps your sign-in in browser storage. Handful uses no advertising or tracking cookies.
Keeping and deleting your data
We keep your data while your account is open. You can delete any task or workspace at any time. When you delete your account, everything in it is deleted within 30 days, backups included.
Your choices
You can ask for a copy of your data (as JSON and CSV), ask us to correct it, or delete your account. Until these are buttons in Handful's settings, email [email protected] from the address you sign in with, and we will do it within 30 days. Depending on where you live, you may also have the right to complain to your data protection authority.
Security
All traffic is encrypted in transit. Only the Handful API can reach the database; it is not exposed to the internet directly. Tool tokens are encrypted as described above. If a breach affects your data, we will tell you without undue delay.
Children
Handful is not meant for anyone under 16, and we don't knowingly collect their data.
Changes
When this policy changes, we update the date at the top. If a change matters, such as a new use of your data, we will tell you by email or in the app before it takes effect.